The Great Cannon has been deployed again • Hacker News Board

Re: The Great Cannon has been deployed again

#351

Post by DyslexicAtheist » Fri, Dec 06, 2019, 8:47 PM UTC

DyslexicAtheist wrote: post #254

This should be mitigated by browser vendors by integrating HTTPSEverywhere as a core functionality of the browser that needs to be explicitly turned off (instead of the current state of affairs where we have a tiny minority on the web who are familiar with installing security add-ons). Visiting a HTTP site should come with a scary warning. I understand this throws old sites under the bus, but there could be other sol…

for anyone interested, Brian Krebs did an excellent article[1] on The Great Cannon after the Citizen Labs incident.

> [Nicholas] Weaver said the attacks from the Great Cannon don’t succeed when people are browsing Chinese sites with a Web address that begins with "https://", meaning that regular Internet users can limit their exposure to these attacks by insisting that all Internet communications are routed over "https" versus unencrypted "http://" connections in their browsers. A number of third-party browser plug-ins — such as https-everywhere — can help people accomplish this goal.

> But Bill Marczak, a research fellow with Citizen Lab, said relying on an always-on encryption strategy is not a foolproof counter to this attack, because plug-ins like https-everywhere will still serve regular unencrypted content when Web sites refuse to or don’t offer the same content over an encrypted connection. What’s more, many Web sites draw content from a variety of sources online, meaning that the Great Cannon attack could succeed merely by drawing on resources provided by online ad networks that serve ads on a variety of Web sites from a dizzying array of sources.

[1] https://krebsonsecurity.com/2015/04/dont-be-fodder-for-china...

Re: The Great Cannon has been deployed again

#352

Post by RockIslandLine » Fri, Dec 06, 2019, 8:48 PM UTC

crazygringo wrote: post #209

I'm curious: is it technically and politically possible for the operators of all internet cables receiving traffic from China to filter out malicious scripts? AT&T's writeup says the injection is only possible because it's HTTP (not HTTPS), and that there are two specific JavaScript files which sometimes serve up the malicious code. So in case of known malware like this being served from within a geographic region...…

Technically possible maybe, politically possible no.

Any ISP could force unencrypted traffic through a deep packet inspection system that looked for this kind of malicious behavior. That would be widely seen as a betrayal of the "big dumb pipe" expectation.

The computation itself is not infeasible at scale. But any ISP attempting this would see swift and brutal political pushback and almost certainly lose customers over it.

Re: The Great Cannon has been deployed again

#353

Post by hsnewman » Fri, Dec 06, 2019, 8:55 PM UTC

MR4D wrote: post #142

pkilgore wrote: post #7

So if the cannon is created using the great firewall, how does the Chinese government establish any sort of plausible argument that this isn't state-sponsored activity? Do they just not care? Some day soon a war will not be started with an assassins bullet but with a tool like this. I wonder when we start looking at them the same way?

War seems to progress as follows: 0 - Peace 1 - Trade War 2 - Financial War 3 - Electronic War 4 - Shooting War Note that 1 & 2 are different types of Economic war, and could be grouped together. The steps occur in order, but steps can be skipped. From a US-centric point of view, North Korea and Iran seem to be at #3. China & Russia are at a limited version of #2. Chinese/HK seem to be at #3 with each other.Given how…

This is just babble.

Re: The Great Cannon has been deployed again

#354

Post by jacquesm » Fri, Dec 06, 2019, 9:06 PM UTC

RHSeeger wrote: post #342

earenndil wrote: post #324

Earlier quoted context omitted.

That's not the issue. The issue is that there is speech accompanying the malware, which should not be systematically censored. (Though any individual is free to do so for themselves.)

> The issue is that there is speech accompanying the malware I'm either misunderstanding what you're saying, or it doesn't make sense. If a bunch of people take signs (with legitimate messages, free speech) and hang them off a bridge over the highway (causing accidents), then those people go jail. The fact that their message is free speech is irrelevant. The source of the message is being punished/jailed, not the mes…

Another iteration of this and we'll have bullets with text on them and killing someone with those bullets will be an expression of free speech. The degree to which the 'free speech' analogy is contorted is amazing, more so because the original scope was quite narrow, both legal and geographical.

Re: The Great Cannon has been deployed again

#355

Post by jacquesm » Fri, Dec 06, 2019, 9:07 PM UTC

thenewnewguy wrote: post #336

jacquesm wrote: post #316

Earlier quoted context omitted.

That's not censorship. https://en.wikipedia.org/wiki/Censorship The criminal co-opting of networks and nodes on those networks is not speech by any definition.

The point is that technology could _also_ be used for censorship.

I'm sure spammers feel very much censored when they are blackholed. Tools are usually dual use.

Re: The Great Cannon has been deployed again

#356

Post by zentiggr » Fri, Dec 06, 2019, 9:07 PM UTC

Brain_Thief wrote: post #184

zentiggr wrote: post #114

Earlier quoted context omitted.

Bill Hicks had an answer. Nobody seemed to want to do that though.

Could you illuminate those of us who are not in the know?

Sorry - I was referring to his "Are you in marketing or advertising? Kill yourself." routine.

Re: The Great Cannon has been deployed again

#357

Post by GhettoMaestro » Fri, Dec 06, 2019, 9:17 PM UTC

xucheng wrote: post #155

jacquesm wrote: post #149

Earlier quoted context omitted.

So it does work. It doesn't really matter where you break the chain as long as it gets broken.

It only works if you somehow remove entire China from the Internet.

It is possible: De-peer AS4134 (China Telecom) and reject all of their routes. They are the only international ISP that lands into mainland China. They are extensively peered around the world.

Re: The Great Cannon has been deployed again

#358

Post by kitteh » Fri, Dec 06, 2019, 9:18 PM UTC

LeftHandPath wrote: post #313

DyslexicAtheist wrote: post #254

This should be mitigated by browser vendors by integrating HTTPSEverywhere as a core functionality of the browser that needs to be explicitly turned off (instead of the current state of affairs where we have a tiny minority on the web who are familiar with installing security add-ons). Visiting a HTTP site should come with a scary warning. I understand this throws old sites under the bus, but there could be other sol…

I recently (4 or 5 months ago) joined an online community of aircraft owners and pilots that is primarily focused around a single brand of aircraft (although it's not an official site of, property of, that brand nor is it endorsed by that brand). When I signed up, they emailed me to welcome me to the site (they actually require manual authorization of users by an admin, which is... refreshing, but uncommon). The emai…

That response is pretty typical from the GA community.

Re: The Great Cannon has been deployed again

#359

Post by onesmallcoin » Fri, Dec 06, 2019, 9:27 PM UTC

RL_Quine wrote: post #301

jiofih wrote: post #300

Earlier quoted context omitted.

I fail to see how this attack has anything to do with http? The scripts can be served over https no problem, it’s the host that is compromised. Maybe you’re thinking of sub-resource integrity attributes?

The cannon is injected into HTTP resources.

In most javascript sandboxes if you request a domain from an site you are restricted by the same content policy. This makes it harder to do things like make requests to sites for example that don't use https when your on one that does use it.

https://developer.mozilla.org/en-US/docs/Web/Security/Same-o...

Re: The Great Cannon has been deployed again

#360

Post by giggles_giggles » Fri, Dec 06, 2019, 9:31 PM UTC

gruez wrote: post #345

randyrand wrote: post #308

Earlier quoted context omitted.

I think China's government requires websites to give them their private keys. HTTPS is useless then.

And what do you think happens to sites caught serving malware? They get put on safebrowsing blacklists. That problem solves itself.

If the Chinese government wants to man in the middle traffic to foreign sites they can just force PC vendors to install a CCP controlled CA root on systems and make it illegal and/or very difficult to remove it. Shit, they can require vendors include a hardware backdoor, especially since so much of that hardware is produced domestically.

Then they can view the traffic even going to and from foreign sites who would not comply with an order to share private keys and no safe browsing blacklist (like that would be accessible from inside the regime anyway) will help you.