I also found a way to defeat their DPI. They are matching within a single packet instead of a stream. So if you make your HTTP request in two segments, one containing the URL and another containing the Host header, your request will not be filtered.
This (python code) will get stuck:
CODE
from socket import socket, IPPROTO_TCP, TCP_NODELAY
s = socket()
s.setsockopt(IPPROTO_TCP, TCP_NODELAY, 1)
s.connect(("www.facebook.com", 80))
s.send("GET /DAPMalaysia HTTP/1.1\r\nHost: www.facebook.com\r\n\r\n")
print s.recv(65536)
s = socket()
s.setsockopt(IPPROTO_TCP, TCP_NODELAY, 1)
s.connect(("www.facebook.com", 80))
s.send("GET /DAPMalaysia HTTP/1.1\r\nHost: www.facebook.com\r\n\r\n")
print s.recv(65536)
While this one succeeds:
CODE
from socket import socket, IPPROTO_TCP, TCP_NODELAY
s = socket()
s.setsockopt(IPPROTO_TCP, TCP_NODELAY, 1)
s.connect(("www.facebook.com", 80))
s.send("GET /DAPMalaysia HTTP/1.1\r\n")
s.send("Host: www.afacebook.com\r\n\r\n")
print s.recv(65536)
s = socket()
s.setsockopt(IPPROTO_TCP, TCP_NODELAY, 1)
s.connect(("www.facebook.com", 80))
s.send("GET /DAPMalaysia HTTP/1.1\r\n")
s.send("Host: www.afacebook.com\r\n\r\n")
print s.recv(65536)