141–150 of 323 posts
Earlier quoted context omitted.
Hi Djent, Would you mind sending an email to support@github.com with details on what you were doing when that happened? Thanks
It's happening for me constantly - just clicking the link from the discussion - I get a (very) slow page load, then the unicorn page. I'm assuming it's a timeout on the backend.
This is some terrible JavaScript. And jQuery?
Earlier quoted context omitted.
>can't stop a little 300 person operation. Police forces can infiltrate world-wide gangs. What's stopping China from infiltrating Github if this DDoS doesn't work out?
Is there any evidence of China infiltrating Microsoft or other major OS vendors?
Earlier quoted context omitted.
The difference between the U.S. and China/Russia is that the people in China/Russia know the media is controlled by the powers that be. Here, our press is also "defined by the vision of the oligarchy and information is carefully controlled to produce a desired set of beliefs." We just believe that it's free. See: http://en.wikipedia.org/wiki/Manufacturing_Consent
It is rather stupid to equate the degree of media manipulation in the West vs. China and Russia.
Can I black-hole all of China in my hosts file? Off the top of my head I'm not going to miss anything, and I'd hate to be an unwitting participant in future attacks.
hosts file blocking is more difficult since you must list each subdomain.
¹everyone should
They mention someone did this earlier with the iCloud hijack by using mtr and tcptraceroute, but it looks like these tools won't work as-is this time because the Github man-on-the-side attack waits for the HTTP GET request. It's probably stateless and if so could be triggered by a lone ACK with a proper HTTP GET inside. As long as they're not behind a stateful firewall, replaying their ACK at various TTLs to find the smallest TTL that triggers the hijack would probably do the trick.
If the hijackers are clever they could make it look like the compromised hop is further away than it actually is, but not closer. Even so, this could be useful information and I'd love to see the result if anyone tries it.
Edit: changed trace method so that it'd actually work.
Earlier quoted context omitted.
During an ongoing attack? I wonder why not...
Right. Not looking for specifics. My curiosity would be satisfied by something like "we've reached out to Baidu and they've done X and Y. Meanwhile, traffic has decreased so we've unblocked the affected repos." Just a bit more transparency on the situation.
Earlier quoted context omitted.
The injection has been stopped and Baidu's script checks if there exists a referer.
What do you mean "has been" stopped? There's no definitively stopping this without HTTPS, which I'm pretty sure hasn't magically "happened" in China in the last couple days. The GFW may have ceased its attack, but there's no check you can possibly add into an asset delivered over HTTP which can't be undone by the GFW. As long as there's a script being delivered over HTTP, the GFW can intercept that script request and…
If the attack happens as described, and those two repos are aimed at Chinese people, why doesn't Github just block all requests to those pages that come from outside China?