The Great Cannon has been deployed again • Hacker News Board

Re: The Great Cannon has been deployed again

#301

Post by RL_Quine » Fri, Dec 06, 2019, 6:35 PM UTC

jiofih wrote: post #300

DyslexicAtheist wrote: post #254

This should be mitigated by browser vendors by integrating HTTPSEverywhere as a core functionality of the browser that needs to be explicitly turned off (instead of the current state of affairs where we have a tiny minority on the web who are familiar with installing security add-ons). Visiting a HTTP site should come with a scary warning. I understand this throws old sites under the bus, but there could be other sol…

I fail to see how this attack has anything to do with http? The scripts can be served over https no problem, it’s the host that is compromised. Maybe you’re thinking of sub-resource integrity attributes?

The cannon is injected into HTTP resources.

Re: The Great Cannon has been deployed again

#302

Post by nihonium » Fri, Dec 06, 2019, 6:36 PM UTC

jiofih wrote: post #300

DyslexicAtheist wrote: post #254

This should be mitigated by browser vendors by integrating HTTPSEverywhere as a core functionality of the browser that needs to be explicitly turned off (instead of the current state of affairs where we have a tiny minority on the web who are familiar with installing security add-ons). Visiting a HTTP site should come with a scary warning. I understand this throws old sites under the bus, but there could be other sol…

I fail to see how this attack has anything to do with http? The scripts can be served over https no problem, it’s the host that is compromised. Maybe you’re thinking of sub-resource integrity attributes?

It's injecting the malicious script into the source of http pages. With httpS, this is not possible unless you also change the root certificate of the computer.

Re: The Great Cannon has been deployed again

#303

Post by Ruthalas » Fri, Dec 06, 2019, 6:37 PM UTC

jiofih wrote: post #300

DyslexicAtheist wrote: post #254

This should be mitigated by browser vendors by integrating HTTPSEverywhere as a core functionality of the browser that needs to be explicitly turned off (instead of the current state of affairs where we have a tiny minority on the web who are familiar with installing security add-ons). Visiting a HTTP site should come with a scary warning. I understand this throws old sites under the bus, but there could be other sol…

I fail to see how this attack has anything to do with http? The scripts can be served over https no problem, it’s the host that is compromised. Maybe you’re thinking of sub-resource integrity attributes?

From the article :

"Mitigations

These attacks would not be successful if the following resources were served over HTTPS instead of HTTP:

http://push.zhanzhang.baidu.com/push.js; orhttp://js.passport.qihucdn.com/11.0.1.js

You may want to consider blocking these URLs when not sent over HTTPS."

Re: The Great Cannon has been deployed again

#304

Post by masswerk » Fri, Dec 06, 2019, 6:38 PM UTC

chewbacha wrote: post #161

MR4D wrote: post #142

Earlier quoted context omitted.

War seems to progress as follows: 0 - Peace 1 - Trade War 2 - Financial War 3 - Electronic War 4 - Shooting War Note that 1 & 2 are different types of Economic war, and could be grouped together. The steps occur in order, but steps can be skipped. From a US-centric point of view, North Korea and Iran seem to be at #3. China & Russia are at a limited version of #2. Chinese/HK seem to be at #3 with each other.Given how…

I don't know who to attribute this to but I've heard a saying: "Countries that trade with each other don't make war with each other." As we isolate countries and disrupt trade we definitely are increasing the risk of conflict.

I think, the principal argument is by Immanuel Kant in "Zum ewigen Frieden" (Perpetual Peace), 1795.

Re: The Great Cannon has been deployed again

#305

Post by sli » Fri, Dec 06, 2019, 6:39 PM UTC

kortilla wrote: post #234

upofadown wrote: post #218

Browsers really have to be a lot more skeptical about the code they run. Running code should not be able to randomly attack any IP address on the internet. Code from non-TLS pages should not be able to run at all. Perhaps that should also apply to code loaded from 3rd party sites. Connecting to a web page should not be consent to allow the operators of that web page to make my computer/phone do whatever they want on…

You do know you’re suggesting that sites not be able to load assets from other sites right?

They are specifically suggesting that HTTP-only sites not be able to load from third party sites, which is quite a bit different than your interpretation of generally preventing any site from loading any external content. HTTPS ought to be the default and browsers can, and should, move towards that.

But to answer your question more directly, yes they clearly know what they are suggesting.

Re: The Great Cannon has been deployed again

#306

Post by alfalfasprout » Fri, Dec 06, 2019, 6:41 PM UTC

gruez wrote: post #197

revicon wrote: post #51

Earlier quoted context omitted.

Block all traffic from China?

Collateral damage aside, that doesn't really solve the issue. The attack goes something like this: 1. non-chinese user visits a chinese site 2. the traffic goes through the gfw, which inserts malicious javascript 3. the user executes the malicious javascript and starts ddosing the victim site Blocking chinese users won't help, since non-chinese visitors will still ddos your site.

If China is cut off, then people can't download the malicious JS either. Granted, it sets a pretty bad precedent and would have massive economic consequences.

Re: The Great Cannon has been deployed again

#307

Post by hombre_fatal » Fri, Dec 06, 2019, 6:42 PM UTC

Despegar wrote: post #262

saagarjha wrote: post #226

Earlier quoted context omitted.

> Running code should not be able to randomly attack any IP address on the internet. How would you prevent this? What constitutes an "attack", and how would you make sure you're not interfering with non-malicious use cases?

JavaScript was a mistake

This is just another kneejerk. They could have just injected an tag with randomized src="" directly.

Re: The Great Cannon has been deployed again

#308

Post by randyrand » Fri, Dec 06, 2019, 6:43 PM UTC

DyslexicAtheist wrote: post #254

This should be mitigated by browser vendors by integrating HTTPSEverywhere as a core functionality of the browser that needs to be explicitly turned off (instead of the current state of affairs where we have a tiny minority on the web who are familiar with installing security add-ons). Visiting a HTTP site should come with a scary warning. I understand this throws old sites under the bus, but there could be other sol…

I think China's government requires websites to give them their private keys. HTTPS is useless then.

Re: The Great Cannon has been deployed again

#309

Post by PavlovsCat » Fri, Dec 06, 2019, 6:44 PM UTC

cc81 wrote: post #122

dvfjsdhgfv wrote: post #108

Earlier quoted context omitted.

Some food for thought: In Tibet, people regularly self-immolate themselves to show to the world how desperate the situation of Tibetan is. Imagine in what circumstances you would need to live to see people around you self-immolate. It's not just one person, and just a dozen.

I'm not defending China at all, they have tons of shitty policies. I'm just saying it is nothing like the holocaust and it is pretty absurd when people do those kind of comparisons. It reminds me of just before the Iraq invasion when the propaganda was at it's highest (Freedom fries and Dixie Chicks). If I again compare with the US as an example even if people don't like that. You have had many hundred if not thousan…

[dead]

Re: The Great Cannon has been deployed again

#310

Post by nitwit005 » Fri, Dec 06, 2019, 6:45 PM UTC

upofadown wrote: post #218

Browsers really have to be a lot more skeptical about the code they run. Running code should not be able to randomly attack any IP address on the internet. Code from non-TLS pages should not be able to run at all. Perhaps that should also apply to code loaded from 3rd party sites. Connecting to a web page should not be consent to allow the operators of that web page to make my computer/phone do whatever they want on…

You don't need to inject scripts to make this sort of thing work. Just add img or style tags with the source set to the target you want to attack. The browser will happily go try to fetch the files from the server, adding to the request load.

You can see unintentional examples of this happening. Small sites get taken down occasionally when larger sites directly link to images or videos hosted there.