Loading today’s stories
Security1 distinct publisher3 min readUpdated
Academics rebuilt Geedge Networks' Tiangou Secure Gateway firmware from a 100,000-file leak and matched its filtering to China's censorship system. The same box has been exported.
The Watch · Security desk
Compiled by The WatchSomething wrong?How this is made
A team of American academics told this year's USENIX Security conference that the Chinese government operates Geedge Networks' Tiangou Secure Gateway (TSG) as one of the Great Firewall's three known traffic filtering capabilities [s1c1][s1c2]. That converts a familiar advocacy line into a procurement fact, because reporting after last year's leak confirmed Geedge was exporting its internet censorship tools to countries including Kazakhstan, Ethiopia, Pakistan and Myanmar [s1c8].
The method matters as much as the finding. More than 100,000 files leaked from Geedge's network last year [s1c3], including the databases behind its Jira and Confluence portals and all of its Git source code repositories, with commit history reaching back to November 2024 [s1c4]. The researchers used that code and history to reconstruct TSG firmware, then matched the device's traffic filtering capabilities against specific sections of the Great Firewall and its observed behavior [s1c5]. That is identification at the level of build artefacts, not an inference drawn from packet oddities.
The scope claim should be read narrowly. Bill Marczak, writing on August 16, 2026, noted that Geedge is only one of the vendors involved in the Great Firewall, and that the authors found only one of the three characterised DNS injectors making up the system matched behavior from the Geedge code [s1c9]. On those numbers, two of the three injectors remain unattributed to Geedge [s1c10]. One appliance in one slot of a three-part filtering stack is still the first time a commercial product line has been tied this directly to the machinery.
The second finding is the one buyers should sit with. The authors concluded that TSG is just as insecure and poorly coded as its Western counterparts [s1c6]. In their words, complexity and flexibility are a double-edged sword: core components such as SAPP and its protocol plugins are written in memory-unsafe C, the system still leans on transitional arrangements like Stellar-on-SAPP, code is copied from several third parties, and the Jira tickets corroborate the patchwork process, including an AppSketch database upgrade that caused SAPP to restart, which they read as a lack of code verification [s1c7]. The researchers believe the leaked code, its poor quality and its abundance of bugs could be abused by Great Firewall circumvention tools in future [s1c11].
For anyone running a network in a country that bought this product, the supply-chain question is now concrete rather than reputational. The in-path inspection device parsing all of your traffic is built on memory-unsafe C assembled by an admittedly ad hoc process, and its source code and ticket history are outside the vendor's control. The same leak that made the Great Firewall attribution possible also handed every bug hunter a map.
Watch whether circumvention projects turn the leaked code into working evasions or exploits, which is the researchers' own stated expectation [s1c11]. Watch whether the other two filtering capabilities in the Great Firewall get attributed to named vendors [s1c9]. And watch procurement in the export markets already reported by InterSecLabs, Amnesty International and Justice for Myanmar [s1c8][s1c12], since a state-filtering pedigree is now a documented product attribute rather than a suspicion.
Follow any of these and your For You feed starts watching them — no settings page required.
Ranked by verification strength, evidence, and original report placement.
A team of American academics found source code overlaps between the products of a Chinese tech company and China's Great Firewall traffic filtering and censorship system, in research presented at this year's USENIX Security conference.
According to the USENIX research, the Chinese government uses the Geedge Networks Tiangou Secure Gateway (TSG) device as one of the Great Firewall's three known traffic filtering capabilities.
Researchers linked Geedge's device to the Great Firewall after more than 100,000 files leaked from Geedge's network last year.
The leak included databases for Geedge's Jira and Confluence portals as well as all its Git source code repositories, containing commit history going back to November 2024.
Researchers used the leaked source code and commit history to reconstruct Geedge TSG firmware, which allowed them to match TSG traffic filtering capabilities to some sections of the Great Firewall and its behavior.
A major conclusion from studying the leaked files was that Geedge's TSG device is just as insecure and poorly coded as Western counterparts.
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Strong primary artefacts, reported second-hand
The underlying evidence chain is unusually concrete for an attribution story: a 100,000-file leak with full Git history, reconstructed firmware, behavioral matching against live Great Firewall sections, a verbatim quotation from the research, and an explicit public caveat bounding the match. It is scored below the top band because the cluster contains only one secondary account, the USENIX paper and its authors are not cited or linked, and Geedge is given no response.
In production nationally and exported
Adoption is real and multi-jurisdictional rather than prospective: the appliance is reported in use as one of three known GFW filtering capabilities and the same tooling has been exported to Kazakhstan, Ethiopia, Pakistan and Myanmar. It is not higher because the cluster gives no deployment counts, contract details, install dates or per-country scope, and the GFW role covers one of three injector behaviors.
Slightly overstated framing, sound substance
The 'source-code match ties a shipping appliance to the Great Firewall' framing runs a little ahead of what the reported evidence establishes, since only 1 of 3 characterised DNS injectors matched Geedge code behavior and the match covers only some sections of the GFW. The gap is small because the publisher itself surfaces that caveat and the concrete claims (leak scope, reconstruction, exports, code quality) are stated without embellishment.
Mild commercial framing pressure
The publishing vehicle is a sponsored security newsletter (Socket Security sponsorship and podcast promotion appear in the body), which creates a general attention incentive, but the sponsor has no stake in Geedge or censorship tooling and the piece voluntarily includes a limiting caveat and points readers to independent corroborators. Underlying findings come from an academic conference presentation, which lowers commercial distortion risk; no vendor-funded or advocacy-funded claim is identified in the material.
Moderate: single publisher, verifiable underlying work
Confidence is capped by cluster composition: one publisher, one article, no primary paper, no author attribution and no vendor response. It is supported by the specificity and falsifiability of the reported details, the named public caveat, and pointers to independent corroborating coverage of the export findings.
security
The Great Firewall has a vendor: Geedge Networks, five client states, 100,000 leaked files1 distinct publisher
security
The dependency gate moves upstream: why post-commit SCA misses hallucinated packages1 distinct publisher
Distinct publishers with included, body-backed reporting in this cluster.
1 article · August 20, 2026