Automated pattern analysis of 13 billion leaked GFW memory frames found over 52.8 million HTTP/1.x protocol signatures, 984,567 Authorization headers, 1.9 million Cookie headers, 79,090 password-in-URL occurrences, and 59,326 SMTP/IMAP plaintext credential sequences — yielding over 3 million pieces of potentially sensitive data collected at a deliberately limited rate of 5,000 exploit packets per second.
From 2024-sakamoto-bleeding — Bleeding Wall: A Hematologic Examination on the Great Firewall
· §4.3 Traffic Patterns, Table 2
· 2024
· Free and Open Communications on the Internet
Implications
The GFW's DNS injector has access to a shared packet buffer containing all transnational traffic it inspects — any plaintext protocol (HTTP, SMTP, POP3) passing through the GFW is at risk of partial credential exfiltration; circumvention tooling should enforce end-to-end encryption for all user-facing traffic, not just the tunnel itself.
The buffer contains packets from concurrent flows, not just the triggering connection — even short-lived plaintext handshakes (e.g., SMTP AUTH before STARTTLS) leak into the shared buffer and are recoverable.