I'm looking forward for a post from GitHub describing what exactly was thrown at them and how they were able to mitigate it.
GitHub under ongoing DDoS attack
71–80 of 352 posts
Re: GitHub under ongoing DDoS attack
#72What is Github's backend like? Do they use cloud service providers or do they manage their own infrastructure?
Highly curious to know how Github is preventing the site from crashing down.
Re: GitHub under ongoing DDoS attack
#73This attack is perhaps just a taste of something nastier. The GitHub infrastructure is rock solid and gives valuable real time information via its status dashboard . This seems ideal for measuring the impact of an attack before choosing a more critical target.
[deleted]
Re: GitHub under ongoing DDoS attack
#74> 0:50 UTC - Into hour 71 defending the attack. Mitigation is holding and service is stable. Wow, this has been going on for quite some time now! > 8:18 UTC - The ongoing DDoS attack has changed tactics. Someone knows more about this new tactics?
I saw this on Weibo earlier, NOT from a trusted source. But the first and third rounds have been confirmed. > 第一轮外域JavaScript，一个alert防住；第二轮外域img，Referer挡外面；第三轮GitHub Pages被D；第四波正在进行，是TCP SYN Flood攻击。 My translation: > The first round was cross-domain JavaScript, stopped with an "alert()". Second round was cross-domain , stopped with referrer. Third was DDoS-ing GitHub Pages. Fourth is the ongoing TCP SYN Flood attack…
What about inserting invisible iframe to affected sites? I think it can not be prevented.
Re: GitHub under ongoing DDoS attack
#75I'm looking forward for a post from GitHub describing what exactly was thrown at them and how they were able to mitigate it.
For what it's worth there's an article[1] from Craig Hockenberry. His servers were hit by massive amounts of traffic from China earlier this year, targeted (randomly?) at Iconfactory's website. The charts are quite impressive.
Re: GitHub under ongoing DDoS attack
#76How would these kinds off DDOS attacks affect a service that is behind a major CDN like cloudfront or cloudflare? Would this affect those?
Re: GitHub under ongoing DDoS attack
#77Earlier quoted context omitted.
I saw this on Weibo earlier, NOT from a trusted source. But the first and third rounds have been confirmed. > 第一轮外域JavaScript，一个alert防住；第二轮外域img，Referer挡外面；第三轮GitHub Pages被D；第四波正在进行，是TCP SYN Flood攻击。 My translation: > The first round was cross-domain JavaScript, stopped with an "alert()". Second round was cross-domain , stopped with referrer. Third was DDoS-ing GitHub Pages. Fourth is the ongoing TCP SYN Flood attack…
What about inserting invisible iframe to affected sites? I think it can not be prevented.
Since GitHub (and other sites) can modify their webpages, something like:
if (window != top) top.location = 'http://www.google.com';
returned as a static webpage would do the trick.
Re: GitHub under ongoing DDoS attack
#78Earlier quoted context omitted.
Which raises the question: when will the rest of the world kick China of the internet? First it was redirecting Chinese internet users to random IPs, if the government didn't like their DNS queries and now they're doing ddos attack on a site that host a large percentage of open source code, used for a whole host of service and products. At some point it's going to make more economical sense to kick China of the inter…
>when will the rest of the world kick China of the internet? One day we're advocating net neutrality and the next day we want to ban entire countries from the internet? I still prefer net neutrality, thank you.
I don't think banning countries from the Internet is the answer, but net neutrality seems like a completely separate issue.
Re: GitHub under ongoing DDoS attack
#79Earlier quoted context omitted.
I saw this on Weibo earlier, NOT from a trusted source. But the first and third rounds have been confirmed. > 第一轮外域JavaScript，一个alert防住；第二轮外域img，Referer挡外面；第三轮GitHub Pages被D；第四波正在进行，是TCP SYN Flood攻击。 My translation: > The first round was cross-domain JavaScript, stopped with an "alert()". Second round was cross-domain , stopped with referrer. Third was DDoS-ing GitHub Pages. Fourth is the ongoing TCP SYN Flood attack…
What about inserting invisible iframe to affected sites? I think it can not be prevented.
You can serve an X-Frame-Options:"DENY" (or "SAMEORIGIN") header to prevent browsers from loading the iframes.
Re: GitHub under ongoing DDoS attack
#80Earlier quoted context omitted.
> > Which raises the question: when will the rest of the world kick China of the internet? Well, that's exactly what the DDoS wanted, so the government could just happily control all access to Internet in mainland China The DDoS targets github.com/greatfire and github.com/cn-nytimes by their so called "collateral freedom" [1] Suppose github could just ban Chinese IP all together, but @greatfire could easily jump to a…
The first attack based on the Javascript wasn't actually using Chinese IPs to do the attack. As otherwise it'd indeed be very easy to block by just blackholing Chinese traffic. What it was actually doing was a massive MITM attack against non-SSLd HTTP connections from inbound connections to China, from Chinese users abroad visiting Chinese websites. It's an extremely clever trick that is only possible if you have the…
I agree in general, but in this specific case, Beijing can just demand access to Baidu's private keys and MITM all traffic passing through the GFWoC.