Defcon Alerts Threat Monitor

Defcon Alerts Threat Monitor

Share this post

Defcon Alerts Threat Monitor
Defcon Alerts Threat Monitor
China's Great Firewall Temporarily Enforces HTTPS Traffic Block
Cyber/Tech

China's Great Firewall Temporarily Enforces HTTPS Traffic Block

Evaluations based on available data point to an internal cause, such as a setup error or a test of network controls, rather than outside interference.

Defcon Level's avatar
Defcon Level
Aug 27, 2025
∙ Paid
3

Share this post

Defcon Alerts Threat Monitor
Defcon Alerts Threat Monitor
China's Great Firewall Temporarily Enforces HTTPS Traffic Block
1
Share

ASIA — On August 20, 2025, China faced a network disruption that cut off secure connections to services outside its borders for about 74 minutes, starting around 12:34 a.m. Beijing Time.

Share

Cyber Analysis: U.S. Maritime Cybersecurity Threats From Foreign Adversarial Technologies

Cyber Analysis: U.S. Maritime Cybersecurity Threats From Foreign Adversarial Technologies

Defcon Level and Donald Standeford
·
Apr 9
Read full story
Chinese-Backed Salt Typhoon Botnet Attacks Critical US Infrastructure, Volt Typhoon Adapts, Resurfaces Globally

Chinese-Backed Salt Typhoon Botnet Attacks Critical US Infrastructure, Volt Typhoon Adapts, Resurfaces Globally

Defcon Level and Donald Standeford
·
November 16, 2024
Read full story
Increase Of Cyberattacks On Critical US Water Infrastructure. Every Critical Infrastructure Sector Targeted

Increase Of Cyberattacks On Critical US Water Infrastructure. Every Critical Infrastructure Sector Targeted

Defcon Level and Donald Standeford
·
May 20, 2024
Read full story

More Cyber Alerts

This occurred through an unconditional block on TCP port 443, the standard network channel for secure web browsing that ensures encrypted data transfer between users and websites.

China's internet censorship system, known as the Great Firewall, inserted forged TCP RST+ACK packets—signals that abruptly end network connections—to stop both incoming and outgoing traffic on this port.

Technical reviews show that the device responsible for the block had features unlike those seen in earlier documented parts of the Great Firewall, such as increasing TCP window sizes in the inserted packets.

The disruption blocked access to many foreign websites and applications that rely on HTTPS, the protocol for secure online communications that protects information like login details and financial transactions.

This affected operations for organizations connected to China, including interruptions to platforms from companies such as Apple and Tesla. Checks during the event confirmed the issue was limited to port 443, with no interference on other common network channels.

Evaluations based on available data point to an internal cause, such as a setup error or a test of network controls, rather than outside interference. The short length of the outage and its focus on one port suggest it was not a planned widespread restriction.

Acronym Index

GFW: Great Firewall

HTTPS: Hypertext Transfer Protocol Secure

IP: Internet Protocol

RST+ACK: Reset + Acknowledge

SYN: Synchronize

SYN+ACK: Synchronize + Acknowledge

TCP: Transmission Control Protocol

TTL: Time to Live

Details of the Block:

This post is for subscribers in the Alerts & Reports: Custom plan

Already in the Alerts & Reports: Custom plan? Sign in
© 2025 Defcon Level
Privacy ∙ Terms ∙ Collection notice
Start writingGet the app
Substack is the home for great culture

Share