Live data from Hacker News

China's Man-On-the-Side Attack on GitHub

netresec.com

111–120 of 323 posts

Re: China's Man-On-the-Side Attack on GitHub

#111
post #7

Our government is using our own money to spy and undermine our tech companies. What exactly is it doing to ensure American companies are defended ? Protecting us from international thugs like China's Communisty Party is the primary duty of our government.

"... should be the primary duty of our government." Fixed it? Although it's interesting to think about. Actual government retaliation would/could be seen as war provocation, especially if China holds on to any plausible deniability. Cyber warfare is currently very hard to prove, but even harder to hold accountable for. Even with DPRK, and our little shut-down-the-"internet" quiet retaliation thing that happened a few…

China has no plausible deniability for anything at all, because it is run by a bunch of Communist cheats who censor the internet and violently put down any dissent. Practically any reasonable action taken by the US against China would not properly be seen as a war provocation.

Lots of people (and governments) hate the US and would call it a war provocation... but they wouldn't be right and generally, the opinions of scum don't actually matter and should just be ignored.

Re: China's Man-On-the-Side Attack on GitHub

#112
post #35

Most people might not know what kind of organization GreatFire really is because too much context is missing. I only discovered recently it's not so simple. There have been a lot of talks about the behavior of GreatFire for quite for a while but most of the talks are in Chinese. There are some in English though, to give everybody a glimpse here is an example: https://github.com/greatfire/wiki/issues/1 I have an impre…

Thanks for providing context. It might be unfair to thrust GitHub, and all Chinese developers into this fight. The Chinese government— if the DDoS fails — may very well just block access to Github, developer needs be damned. Of course that would provide an opportunity for a Chinese counterpart of Github to take market share, perhaps a favorable outcome?

Many of us Chinese developers have already equipped with VPNs and tunnels as a daily productivity tool. It seems that the purpose of the gov'nt is to block access from less tech-savvy users, which greatfire and nytimes-cn provide.

Re: China's Man-On-the-Side Attack on GitHub

#113
post #67
post #10

I still don't really get it. What's the actual goal behind the attack? When the Chinese government decides to block a website, I can at least understand their motivations, as bad as they may be. But DDOSing Github just seems to be pissing the whole world off for a few hours without any actual long term consequences.

I'm working in a 100% Chinese high-tech company, and asked my colleagues: they think it is just a test (that was my first impression too).

This means A LOT to the rest of the world.

China in history always claims that they don't intervene with things of other country, but in these days, they shamelessly attacked an US company.

Re: China's Man-On-the-Side Attack on GitHub

#114
post #71

Earlier quoted context omitted.

> [China] an unfathomable degree of control over their citizens You obviously haven't been there. I think Chinese gov have the same level of control over its citizens as France: very erratic, sometime works well, some people try to play with fire, but overall the Chinese are all but lobotomized robots in the hands of a few puppet masters. There's over 500 strikes a year in China, not counting all the ones not big eno…

I have been there ;) You're misinterpreting the nature of control. Yes, there are protests, mostly because the government lets them happen. It helps people let off steam, it gives the government an indication of how people feel, and quite often there are conflicting interests which the Party can rise above (remember, government and the Party are not the same thing). So, often it's a bunch of workers protesting agains…

> You're misinterpreting the nature of control.

I don't think so. I am just taking the other angle, from the people's perspective, and want to debunk the cliche that Chinese people are easy to control. They've had much more revolutions than any other country in their long history. They're all but easy to control. In French we say "like boiling milk", which means they can easily and suddenly get out of control and wash out anything on their way. Just blocking a few topics on social network is certainly not enough. As for things that are allowed or forbidden, it seems more cultural than anything else: In China direct verbal confrontation is very rare, while it is very common in the West, and this holds in families, in companies and also at the country's level. Not very surprisingly, in France insulting the head of state is not forbidden, and even something like a national entertainment. However, in France we have laws telling people if they are allowed to work on Sundays, which seems extremely weird and borderline "totalitarian" to the Chinese, which believe people should be allowed to work whenever they need to or want to.

Also, when talking about China, it needs to be reminded that in fact the core Western values (i.e. Enlightment values) and the core Chinese values (i.e. Confucean values) are very similar, and quite compatible. (See how fast Chinese immigrants adapt to and adopt Western values.) For instance, secularism and religious tolerance, equality of rights and before the law, meritocracy, etc.

I think the world is going very badly these days, and a big chunk of it is in the hands of people whose values are really opposed to the core of modern humanist values, and this chunk is not China. We'd better team up and fight (with ideas, not with guns) what really threatens humanity as a whole. Just my thoughts.

Re: China's Man-On-the-Side Attack on GitHub

#115
post #35

Most people might not know what kind of organization GreatFire really is because too much context is missing. I only discovered recently it's not so simple. There have been a lot of talks about the behavior of GreatFire for quite for a while but most of the talks are in Chinese. There are some in English though, to give everybody a glimpse here is an example: https://github.com/greatfire/wiki/issues/1 I have an impre…

[deleted]

Re: China's Man-On-the-Side Attack on GitHub

#116
post #23
post #10

I still don't really get it. What's the actual goal behind the attack? When the Chinese government decides to block a website, I can at least understand their motivations, as bad as they may be. But DDOSing Github just seems to be pissing the whole world off for a few hours without any actual long term consequences.

Actually, someone here (who I cannot remember) said quite eloquently yesterday that our biggest export--and "influence" on the world--is culture. For the first time I realized that pissing people off may, in fact be the objective as the other reply stated. China and Russia are both (quite unique) examples of countries with an unfathomable degree of control over their citizens. It can be hard to grasp occasionally, co…

The difference between the U.S. and China/Russia is that the people in China/Russia know the media is controlled by the powers that be.

Here, our press is also "defined by the vision of the oligarchy and information is carefully controlled to produce a desired set of beliefs." We just believe that it's free.

See: http://en.wikipedia.org/wiki/Manufacturing_Consent

Re: China's Man-On-the-Side Attack on GitHub

#118
post #114

Earlier quoted context omitted.

I have been there ;) You're misinterpreting the nature of control. Yes, there are protests, mostly because the government lets them happen. It helps people let off steam, it gives the government an indication of how people feel, and quite often there are conflicting interests which the Party can rise above (remember, government and the Party are not the same thing). So, often it's a bunch of workers protesting agains…

> You're misinterpreting the nature of control. I don't think so. I am just taking the other angle, from the people's perspective, and want to debunk the cliche that Chinese people are easy to control. They've had much more revolutions than any other country in their long history. They're all but easy to control. In French we say "like boiling milk", which means they can easily and suddenly get out of control and was…

Hey, I didn't see it was you! Still at Douban?

I know what you mean in terms of "boiling milk" - in that respect I agree. I keep thinking these days of that old saying of China as a sleeping elephant; instead I think the people are the sleeping elephant. I think the government's strategy relies a lot on ignorance and apathy, but if even half of these stories we read as standard on NYTimes etc made it into the public consciousness, there would be huge issues.

About the laws - I guess it's not the actual content of the laws or relatively different values that illustrates control. Eg in your example about working on Sunday's - if you decided to fight one of those laws, you could do it openly and publicly and in principle it would be a fair fight. You might even embarrass the government or a political leader, but here there's so little chance of that - that's the different nature of the Communist Party control. The government/party has taken away avenues to legitimately discuss/debate/fight, so the options are either total apathy or explosive revolution. That's scary!

Re: China's Man-On-the-Side Attack on GitHub

#119

Since the question of "why" and "how" is coming up again, here's a quick summary I posted on reddit: From a few different analysis on HN and elsewhere... Baidu has an analytics product and an ads product, much like Google Analytics and Google AdSense, which are used on all kinds of websites via Javascript. China has set the Great Firewall of China to modify some of Baidu's assets so that any non-Chinese IP gets a mod…

actually both projects are still online on github. https://github.com/cn-nytimes https://github.com/greatfire

They are back on github now; they were indeed temporarily changed to return only

    alert("WARNING: malicious javascript detected on this domain");
(or something similar). I saw this myself.

Re: China's Man-On-the-Side Attack on GitHub

#120
post #36
post #31

I wonder how GitHub mitigated the attack so successfully. I can't find any baidu scripts using the injected code anymore (in fact the original tracking scripts on baidu's own domain return nothing), and GitHub is now serving the two repos that were originally targeted. What happened? Whatever it is, I'm glad they were able to mitigate the attacks.

The injection has been stopped and Baidu's script checks if there exists a referer.

What do you mean "has been" stopped? There's no definitively stopping this without HTTPS, which I'm pretty sure hasn't magically "happened" in China in the last couple days.

The GFW may have ceased its attack, but there's no check you can possibly add into an asset delivered over HTTP which can't be undone by the GFW.

As long as there's a script being delivered over HTTP, the GFW can intercept that script request and replace with a script of its own.

Post reply on HN