Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

China's Man-On-the-Side Attack on GitHub

netresec.com

Post reply on HN
Print view View original

161–170 of 323 posts

Re: China's Man-On-the-Side Attack on GitHub

#161

Post by cbsmith »

ma2rten wrote: post #100
JohnTHaller wrote: post #57

Since the question of "why" and "how" is coming up again, here's a quick summary I posted on reddit: From a few different analysis on HN and elsewhere... Baidu has an analytics product and an ads product, much like Google Analytics and Google AdSense, which are used on all kinds of websites via Javascript. China has set the Great Firewall of China to modify some of Baidu's assets so that any non-Chinese IP gets a mod…

actually both projects are still online on github. https://github.com/cn-nytimes https://github.com/greatfire

One solution that comes to mind for this is for CDN's to have an edge node just outside of the great firewall of China. Even with a simple edge side include, the impact on Github's servers should be near zero.

Re: China's Man-On-the-Side Attack on GitHub

#162

Post by martinald »

Aissen wrote: post #160

One thing I don't understand: when you have the infrastructure to run the Great Firewall, why not simply generate the traffic yourself ? At this point you might just fake traffic from inside China with any kind of amplifiable no-state protocol. Sure, the TCP/HTTP attack might be a bit more resource intensive, but it should be doable with the same capabilities provided by their DPI infrastructure, no ? Edit : Last but…

Because non-chinese visitors (who aren't behind the Great Firewall) also get served this malicious javascript if they load up the code. It's not just Chinese visitors that visit these sites and therefore get the JS code.

Re: China's Man-On-the-Side Attack on GitHub

#163

Post by clippit »

zaroth wrote: post #120
clippit wrote: post #36

Earlier quoted context omitted.

The injection has been stopped and Baidu's script checks if there exists a referer.

What do you mean "has been" stopped? There's no definitively stopping this without HTTPS, which I'm pretty sure hasn't magically "happened" in China in the last couple days. The GFW may have ceased its attack, but there's no check you can possibly add into an asset delivered over HTTP which can't be undone by the GFW. As long as there's a script being delivered over HTTP, the GFW can intercept that script request and…

I mean the Javascript hijacking has been stopped. This DDoS mixes several ways and during the js hijacking period, GitHub returns `alert()` on specific url for blocking browsers sending ajax requests. For now, the infected urls are back to normal.

Re: China's Man-On-the-Side Attack on GitHub

#164

Post by shawabawa3 »

Aissen wrote: post #160

One thing I don't understand: when you have the infrastructure to run the Great Firewall, why not simply generate the traffic yourself ? At this point you might just fake traffic from inside China with any kind of amplifiable no-state protocol. Sure, the TCP/HTTP attack might be a bit more resource intensive, but it should be doable with the same capabilities provided by their DPI infrastructure, no ? Edit : Last but…

> why not simply generate the traffic yourself ?

Couldn't github simply null-route all chinese-origin traffic in that case?

Currently the DDoS comes from everywhere except china

Re: China's Man-On-the-Side Attack on GitHub

#166

Post by bx_ »

methou wrote: post #110
gbog wrote: post #71

Earlier quoted context omitted.

> [China] an unfathomable degree of control over their citizens You obviously haven't been there. I think Chinese gov have the same level of control over its citizens as France: very erratic, sometime works well, some people try to play with fire, but overall the Chinese are all but lobotomized robots in the hands of a few puppet masters. There's over 500 strikes a year in China, not counting all the ones not big eno…

I live in China, and I disagree with your statement, but I can understand why you think like that. Usually when you reside in a country for a long time, you don't think the government as a whole, big, flat thing. The size of the it is gigantic, so that anything you do, you might be interacting with government at some level. I'm not judging this but giving you an image of what it's like living in China, salt, gas, new…

> China wants to fork their own internet, for their own people.

I thought it was pretty well known that the BRICS countries want their own internet:

http://www.infowars.com/brics-countries-build-new-internet-t...

Re: China's Man-On-the-Side Attack on GitHub

#167

Post by cxseven »

Aissen wrote: post #160

One thing I don't understand: when you have the infrastructure to run the Great Firewall, why not simply generate the traffic yourself ? At this point you might just fake traffic from inside China with any kind of amplifiable no-state protocol. Sure, the TCP/HTTP attack might be a bit more resource intensive, but it should be doable with the same capabilities provided by their DPI infrastructure, no ? Edit : Last but…

The current attack injects two TCP packets containing javascript that makes a person's web browser perform endless requests to the two Github URLs that host the apparent targets. This is a huge amplification. Also, the attacker is hitting fewer than 1% of the Baidu Analytics requests, which might indicate that the attacker is overloaded. In that case they don't yet have unlimited access to Chinese bandwidth.

Re: China's Man-On-the-Side Attack on GitHub

#168

Post by jonny_eh »

eloisant wrote: post #153
jonny_eh wrote: post #129

Earlier quoted context omitted.

Github wouldn't get baidu's cookies since they're different domains.

They could if they put code to read cookies in JS and send them home in the JS included in people's pages.

Good point, all the more reason page authors should use httpOnly cookies: https://www.owasp.org/index.php/HttpOnly

Re: China's Man-On-the-Side Attack on GitHub

#169

Post by cxseven »

cbsmith wrote: post #161
ma2rten wrote: post #100

Earlier quoted context omitted.

actually both projects are still online on github. https://github.com/cn-nytimes https://github.com/greatfire

One solution that comes to mind for this is for CDN's to have an edge node just outside of the great firewall of China. Even with a simple edge side include, the impact on Github's servers should be near zero.

This won't work because it's browsers outside of China that are being hijacked when browsing Baidu Analytics-using sites.

Re: China's Man-On-the-Side Attack on GitHub

#170

Post by teknologist »

TheDong wrote: post #132
peteretep wrote: post #106

Earlier quoted context omitted.

You'd think, wouldn't you. Or instead simply blacklist Baidu's analytics code completely. That will only hurt Chinese businesses using Baidu's product, and no-one else.

It would also hurt american, or european, or any nationality of business that uses baidu to get more insight into chinese visitors. Baidu is certainly most popular within china, but not exclusive to them.

Google Analytics does all that, no worries
Post reply on HN