Can browsers or OSs not treat the corrupted Baidu analytics as malware?
there's lots of China company/sites, you can't block all of them.
China's Man-On-the-Side Attack on GitHub
151–160 of 323 posts
Re: China's Man-On-the-Side Attack on GitHub
#152Earlier quoted context omitted.
The difference between the U.S. and China/Russia is that the people in China/Russia know the media is controlled by the powers that be. Here, our press is also "defined by the vision of the oligarchy and information is carefully controlled to produce a desired set of beliefs." We just believe that it's free. See: http://en.wikipedia.org/wiki/Manufacturing_Consent
It is rather stupid to equate the degree of media manipulation in the West vs. China and Russia.
You are right. The degree and sophistication of media manipulation is profoundly greater in the west. While the Chinese block a lot of media, the manipulation is minimal. Most Chinese are very cynical and know exactly what is going on. The west, or at least the US, traps people in a matrix of sorts where they don't even see the manipulation. The narrative is exquisitely framed and guided to leave people with a sense of moral superiority and basic faith in the system despite perceived flaws, as is ironically exhibited by your comment.
edit: some good resources on the history and nature of western media manipulation are the BBC documentary "The Century of Self" and Noam Chomsky's book "Manufacturing Consent".
Re: China's Man-On-the-Side Attack on GitHub
#153Earlier quoted context omitted.
Damn! I just realized, github is getting a full 1% of baidu's traffic. I wonder if they're getting the search terms. I bet they're getting cookies. The ultimate mitigation might be google paying to show the results instead of baidu. Or just showing their own ads.
Github wouldn't get baidu's cookies since they're different domains.
They could if they put code to read cookies in JS and send them home in the JS included in people's pages.
Re: China's Man-On-the-Side Attack on GitHub
#154Does baidu have any say in this at all? Were they hacked to include this script or they just passively allowed it?
Baidu have not been hacked. Their servers reside inside the great firewall meaning any request from outside China has to traverse the GFW before arriving at Baidu's servers. During traversal of the GFW, the Chinese gov is modifying the Baidu server response with malicious javascript.
Baidu has no say in the matter. They could try and help Github by swapping to only serving their analytics scripts over HTTPS. Even then, this would only help once a large majority of existing websites that use Baidu analytics have updated their website code to point to the HTTPS URL. Until then the attack would probably still continue to work.
Re: China's Man-On-the-Side Attack on GitHub
#155Re: China's Man-On-the-Side Attack on GitHub
#156This is a really well article outlining how the man-on-the-side attack on Baidu is carried out. The only flaw here is the logical leap that goes from "Baidu is being hijacked" to "Baidu is being hijacked by the Chinese government"
The attack is not on Baidu, but via Baidu. Whoever is the attacker appears to control the great firewall of China. Who else would that be but the Chinese government?
The Honker Union http://en.wikipedia.org/wiki/Honker_Union and/or the Red Hacker Alliance http://en.wikipedia.org/wiki/Red_Hacker_Alliance
Re: China's Man-On-the-Side Attack on GitHub
#157I still don't really get it. What's the actual goal behind the attack? When the Chinese government decides to block a website, I can at least understand their motivations, as bad as they may be. But DDOSing Github just seems to be pissing the whole world off for a few hours without any actual long term consequences.
Actually, someone here (who I cannot remember) said quite eloquently yesterday that our biggest export--and "influence" on the world--is culture. For the first time I realized that pissing people off may, in fact be the objective as the other reply stated. China and Russia are both (quite unique) examples of countries with an unfathomable degree of control over their citizens. It can be hard to grasp occasionally, co…
> It can be hard to grasp occasionally, coming from a western mindset but for the vast majority within said countries, the entire reality they see and what they believe to be true is heavily distorted--in that, it is defined by the vision of the oligarchy and information is carefully controlled to produce a desired set of beliefs.
You are delusional if you believe the above doesnt apply to US and EU countries.
Re: China's Man-On-the-Side Attack on GitHub
#158This might not be a feasible reaction to the attacks, but in my mind the people who are "unsuspecting attackers" aren't necessarily trying to access GitHub in the first place.
So, what if they set up automated rule to block all IPs (for a period of time) who show traffic patterns that indicate they are part of the attack, and then for all those IPs who are trying to reach GitHub purposefully but are currently blocked, give them explicit instructions on how to tunnel to regain access to GitHub while the attack continues. This way only those who are (a) part of the attack, and (b) want to access resources on GitHub need to do anything special.
My guess is the number who would truly be affected by this are a tiny fraction of the total number of people who are part of the attack.
Re: China's Man-On-the-Side Attack on GitHub
#159Earlier quoted context omitted.
> the entire reality they see and what they believe to be true is heavily distorted--in that, it is defined by the vision of the oligarchy and information is carefully controlled to produce a desired set of beliefs. That's pretty much how I feel about the Fox-watching population of the US.
> That's pretty much how I feel about the Fox-watching population of the US. I used to think the same thing, and to some degree I think it holds truth. But after spending lots of time with my right-wing family, I think it's a bit more nuanced than that. Most avid Fox News watchers I've met fail to embrace the entire world-view or vision promoted on the channel, and share maybe 60-70% of the opinions elicited toward v…
I think it's generally safe to assume that a large chunk of people who happen to hold opinions you disagree with don't hold them because they are retarded. Even Fox News viewers.
Re: China's Man-On-the-Side Attack on GitHub
#160One thing I don't understand: when you have the infrastructure to run the Great Firewall, why not simply generate the traffic yourself ? At this point you might just fake traffic from inside China with any kind of amplifiable no-state protocol.
Sure, the TCP/HTTP attack might be a bit more resource intensive, but it should be doable with the same capabilities provided by their DPI infrastructure, no ?
Edit: Last but not least, if we are sure that this attack is indeed coming from the GFW, then why Obama isn't calling Xi Jinping right now ?