Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

China's Man-On-the-Side Attack on GitHub

netresec.com

Post reply on HN
Print view View original

171–180 of 323 posts

Re: China's Man-On-the-Side Attack on GitHub

#171

Post by briandear »

westiseast wrote: post #139
palmer_eldritch wrote: post #128

Earlier quoted context omitted.

> but today they might let the protest get a bit wild if they want to allow the protesters a bit of leeway, and then those untrained, poorly equipped policemen will be screwed. I'd say most often than not, when a government lets a protest get wild it's because they want to justify the harsh repression that's coming or at least that when the time comes for decision, they won't side with the protestors. Or they're just…

The HK protests were interesting recently for that reason - the protestors had the momentum, and the governments first reaction if it was mainland China would probably be to crush it. They let it boil over, and eventually the momentum was lost and anti-protestor sentiment took over. Whether that was by design or 'helped along' is another issue, but it showed how popular protests can sometimes just sour if left to the…

Occupy Wall Street comes to mind as another example. NYC sentiment turned rather quickly against that movement once the public delectation, rape allegations and the inconvienient even caused by protestors started to boil over.

Re: China's Man-On-the-Side Attack on GitHub

#172

Post by vidarh »

obstinate wrote: post #138
abalone wrote: post #116

Earlier quoted context omitted.

The difference between the U.S. and China/Russia is that the people in China/Russia know the media is controlled by the powers that be. Here, our press is also "defined by the vision of the oligarchy and information is carefully controlled to produce a desired set of beliefs." We just believe that it's free. See: http://en.wikipedia.org/wiki/Manufacturing_Consent

It is rather stupid to equate the degree of media manipulation in the West vs. China and Russia.

Is it? Check out the CNN international edition and US edition on their website after a terrorist attack, and you'll see how blatant it can get (CNN is interesting in that respect since both versions are readily available from a selector at the top of their page). They don't even need to hide it - it's "sold as a feature" because most people are not interested in seeking out alternative viewpoints.

You see it even with more mundane cases in subtle differences in headlines even when they run the same articles. Many of the changes are perfectly reasonable and simply reflects differences in language or relative importance to different audiences. But a lot of the time there are blatant biases being introduced.

There certainly is a difference: In democratic countries people can get alternative viewpoints easily without risk of imprisonment if they want to. But unless they are already questioning the status quo, most people simply doesn't bother, so it doesn't make much real difference if they're censored or not.

As someone who has travelled quite extensively to the US for business, turning on the news channels when I arrived was always a shock, no matter how many times I did it, because even between the US and the UK, the difference in mainstream media world view is massive, and clearly one or both is heavily distorted (I'd go for both...).

Re: China's Man-On-the-Side Attack on GitHub

#173

Post by Aissen »

martinald wrote: post #162
Aissen wrote: post #160

One thing I don't understand: when you have the infrastructure to run the Great Firewall, why not simply generate the traffic yourself ? At this point you might just fake traffic from inside China with any kind of amplifiable no-state protocol. Sure, the TCP/HTTP attack might be a bit more resource intensive, but it should be doable with the same capabilities provided by their DPI infrastructure, no ? Edit : Last but…

Because non-chinese visitors (who aren't behind the Great Firewall) also get served this malicious javascript if they load up the code. It's not just Chinese visitors that visit these sites and therefore get the JS code.

Oh, I had missed that ! I thought GFW was for clients, never thought it would apply on servers too.

Re: China's Man-On-the-Side Attack on GitHub

#174

Post by roblabla »

rattray wrote: post #119
ma2rten wrote: post #100

Earlier quoted context omitted.

actually both projects are still online on github. https://github.com/cn-nytimes https://github.com/greatfire

They are back on github now; they were indeed temporarily changed to return only alert("WARNING: malicious javascript detected on this domain"); (or something similar). I saw this myself.

Actually, they never stopped being accessible from the "usual" link : https://github.com/greatfire . The alert was only sent for requests to https://github.com/greatfire/ (notice the leading slash).

Re: China's Man-On-the-Side Attack on GitHub

#175

Post by downandout »

JohnTHaller wrote: post #57

Since the question of "why" and "how" is coming up again, here's a quick summary I posted on reddit: From a few different analysis on HN and elsewhere... Baidu has an analytics product and an ads product, much like Google Analytics and Google AdSense, which are used on all kinds of websites via Javascript. China has set the Great Firewall of China to modify some of Baidu's assets so that any non-Chinese IP gets a mod…

Since this is the technique they used, the browsers would have sent referring URLs as part of each request. When traffic begins to spike suspiciously, why not send a headless browser to each referrer, and if any code on the referrer results in automatic loading of the domain you're trying to protect, blacklist it. I'm guessing that the bulk of the requests were referred by a relatively small number of pages/domains, so this would be a small processing task with a big payoff. This would effectively kill the use of this technique.

Re: China's Man-On-the-Side Attack on GitHub

#176

Post by [deleted] »

JohnTHaller wrote: post #57

Since the question of "why" and "how" is coming up again, here's a quick summary I posted on reddit: From a few different analysis on HN and elsewhere... Baidu has an analytics product and an ads product, much like Google Analytics and Google AdSense, which are used on all kinds of websites via Javascript. China has set the Great Firewall of China to modify some of Baidu's assets so that any non-Chinese IP gets a mod…

[deleted]

Re: China's Man-On-the-Side Attack on GitHub

#177

Post by Aissen »

shawabawa3 wrote: post #164
Aissen wrote: post #160

One thing I don't understand: when you have the infrastructure to run the Great Firewall, why not simply generate the traffic yourself ? At this point you might just fake traffic from inside China with any kind of amplifiable no-state protocol. Sure, the TCP/HTTP attack might be a bit more resource intensive, but it should be doable with the same capabilities provided by their DPI infrastructure, no ? Edit : Last but…

> why not simply generate the traffic yourself ? Couldn't github simply null-route all chinese-origin traffic in that case? Currently the DDoS comes from everywhere except china

Yeah, as I explained in reply to martinald, I had missed that. This is indeed a clever tactic. And very bad for Baidu's business, they must be outraged.

Re: China's Man-On-the-Side Attack on GitHub

#178

Post by po1nter »

samlambert wrote: post #40
djent wrote: post #26

DDOS seems to be impacting me intermittently here in Rhode Island https://imgur.com/pW59MG3

Hi Djent, Would you mind sending an email to support@github.com with details on what you were doing when that happened? Thanks

Same thing is happening to me. Let me know if I can help (I'm in France if that matters).

Re: China's Man-On-the-Side Attack on GitHub

#179

Post by adaml_623 »

shawabawa3 wrote: post #164
Aissen wrote: post #160

One thing I don't understand: when you have the infrastructure to run the Great Firewall, why not simply generate the traffic yourself ? At this point you might just fake traffic from inside China with any kind of amplifiable no-state protocol. Sure, the TCP/HTTP attack might be a bit more resource intensive, but it should be doable with the same capabilities provided by their DPI infrastructure, no ? Edit : Last but…

> why not simply generate the traffic yourself ? Couldn't github simply null-route all chinese-origin traffic in that case? Currently the DDoS comes from everywhere except china

The point of this DDoS attack is to prevent people in China from accessing content on github. To null-route chinese-origin traffic would mean that the attackers win.

(Obviously VPNs could be used to circumvent this null-route but they then become vulnerable to the same attack)

Re: China's Man-On-the-Side Attack on GitHub

#180

Post by kbart »

abalone wrote: post #116
j42 wrote: post #23

Earlier quoted context omitted.

Actually, someone here (who I cannot remember) said quite eloquently yesterday that our biggest export--and "influence" on the world--is culture. For the first time I realized that pissing people off may, in fact be the objective as the other reply stated. China and Russia are both (quite unique) examples of countries with an unfathomable degree of control over their citizens. It can be hard to grasp occasionally, co…

The difference between the U.S. and China/Russia is that the people in China/Russia know the media is controlled by the powers that be. Here, our press is also "defined by the vision of the oligarchy and information is carefully controlled to produce a desired set of beliefs." We just believe that it's free. See: http://en.wikipedia.org/wiki/Manufacturing_Consent

"The difference between the U.S. and China/Russia is that the people in China/Russia know the media is controlled by the powers that be."

That knowledge, sadly, doesn't prevent from believing propaganda made by the same media. I know a lot of Russians, and most of them (even otherwise smart ones) honestly believe even the most absurd propaganda statements.

Post reply on HN