---
_id: '66726'
abstract:
- lang: eng
  text: In September 2025, over 100K internal documents (including code, communications,
    etc.) from Geedge Networks, a Chinese DPI company with ties to the Great Firewall
    of China, were leaked to the public. In this paper, we analyze the source code
    from this leak, focusing on Geedge Networks’ flagship product, the Tiangou Secure
    Gateway (TSG) firewall. Working across multiple repositories, we successfully
    build and run a local copy of TSG—revealing key aspects of its architecture, including
    the protocols it is capable of parsing and the format of blocking rules used to
    censor sites, proxies, and other resources. Finally, we extract several fingerprints
    from TSG, including custom random number generators and parsing idiosyncrasies
    that allow us to identify its use and similar deployments in the Great Firewall
    of China. This is the first time that the source code of a commercial DPI has
    been leaked, and our work is the first code analysis of a core firewall component
    used in national censorship infrastructure. This unprecedented investigation offers
    insights that can assist circumvention developers and Internet security researchers
    in further understanding the capabilities and limitations of modern censorship
    technology.
author:
- first_name: Anna
  full_name: Ablove, Anna
  last_name: Ablove
- first_name: Johnnie
  full_name: Walker, Johnnie
  last_name: Walker
- first_name: Ben
  full_name: Wolin, Ben
  last_name: Wolin
- first_name: Niklas
  full_name: Niere, Niklas
  id: '63563'
  last_name: Niere
- first_name: Felix
  full_name: Graf Lange, Felix
  id: '67893'
  last_name: Graf Lange
- first_name: Aaron
  full_name: Ortwein, Aaron
  last_name: Ortwein
- first_name: Armin
  full_name: Huremagic, Armin
  last_name: Huremagic
- first_name: Richa
  full_name: Priyanka, Richa
  last_name: Priyanka
- first_name: Ali
  full_name: Zohaib, Ali
  last_name: Zohaib
- first_name: Jade
  full_name: Sheffey, Jade
  last_name: Sheffey
- first_name: Nico
  full_name: Heitmann, Nico
  id: '74619'
  last_name: Heitmann
  orcid: 0009-0003-7687-7044
- first_name: J. Alex
  full_name: Halderman, J. Alex
  last_name: Halderman
- first_name: Juraj
  full_name: Somorovsky, Juraj
  id: '83504'
  last_name: Somorovsky
  orcid: 0000-0002-3593-7720
- first_name: Amir
  full_name: Houmansadr, Amir
  last_name: Houmansadr
- first_name: Roya
  full_name: Ensafi, Roya
  last_name: Ensafi
- first_name: Mingshi
  full_name: Wu, Mingshi
  last_name: Wu
- first_name: Eric
  full_name: Wustrow, Eric
  last_name: Wustrow
citation:
  ama: 'Ablove A, Walker J, Wolin B, et al. Technical Analysis of the Geedge Networks
    Firewall Source Code Leak. In: ; 2026.'
  apa: Ablove, A., Walker, J., Wolin, B., Niere, N., Graf Lange, F., Ortwein, A.,
    Huremagic, A., Priyanka, R., Zohaib, A., Sheffey, J., Heitmann, N., Halderman,
    J. A., Somorovsky, J., Houmansadr, A., Ensafi, R., Wu, M., & Wustrow, E. (2026).
    <i>Technical Analysis of the Geedge Networks Firewall Source Code Leak</i>. 35th
    USENIX Security Symposium, Baltimore.
  bibtex: '@inproceedings{Ablove_Walker_Wolin_Niere_Graf Lange_Ortwein_Huremagic_Priyanka_Zohaib_Sheffey_et
    al._2026, title={Technical Analysis of the Geedge Networks Firewall Source Code
    Leak}, author={Ablove, Anna and Walker, Johnnie and Wolin, Ben and Niere, Niklas
    and Graf Lange, Felix and Ortwein, Aaron and Huremagic, Armin and Priyanka, Richa
    and Zohaib, Ali and Sheffey, Jade and et al.}, year={2026} }'
  chicago: Ablove, Anna, Johnnie Walker, Ben Wolin, Niklas Niere, Felix Graf Lange,
    Aaron Ortwein, Armin Huremagic, et al. “Technical Analysis of the Geedge Networks
    Firewall Source Code Leak,” 2026.
  ieee: A. Ablove <i>et al.</i>, “Technical Analysis of the Geedge Networks Firewall
    Source Code Leak,” presented at the 35th USENIX Security Symposium, Baltimore,
    2026.
  mla: Ablove, Anna, et al. <i>Technical Analysis of the Geedge Networks Firewall
    Source Code Leak</i>. 2026.
  short: 'A. Ablove, J. Walker, B. Wolin, N. Niere, F. Graf Lange, A. Ortwein, A.
    Huremagic, R. Priyanka, A. Zohaib, J. Sheffey, N. Heitmann, J.A. Halderman, J.
    Somorovsky, A. Houmansadr, R. Ensafi, M. Wu, E. Wustrow, in: 2026.'
conference:
  end_date: 2026-08-14
  location: Baltimore
  name: 35th USENIX Security Symposium
  start_date: 2026-08-12
date_created: 2026-08-17T07:33:15Z
date_updated: 2026-08-17T07:39:32Z
ddc:
- '006'
file:
- access_level: local
  content_type: application/pdf
  creator: nniklas
  date_created: 2026-08-17T07:31:02Z
  date_updated: 2026-08-17T07:39:32Z
  file_id: '66727'
  file_name: usenixsecurity26-ablove.pdf
  file_size: 1838094
  relation: main_file
file_date_updated: 2026-08-17T07:39:32Z
has_accepted_license: '1'
language:
- iso: eng
main_file_link:
- open_access: '1'
  url: https://www.usenix.org/system/files/usenixsecurity26-ablove.pdf
oa: '1'
publication_identifier:
  isbn:
  - 978-1-939133-58-8
publication_status: published
status: public
title: Technical Analysis of the Geedge Networks Firewall Source Code Leak
type: conference
user_id: '63563'
year: '2026'
...