Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

China's Man-On-the-Side Attack on GitHub

netresec.com

Post reply on HN
Print view View original

201–210 of 323 posts

Re: China's Man-On-the-Side Attack on GitHub

#201

Post by kbart »

johnbellone wrote: post #188
corford wrote: post #154

Earlier quoted context omitted.

Baidu have not been hacked. Their servers reside inside the great firewall meaning any request from outside China has to traverse the GFW before arriving at Baidu's servers. During traversal of the GFW, the Chinese gov is modifying the Baidu server response with malicious javascript. Baidu has no say in the matter. They could try and help Github by swapping to only serving their analytics scripts over HTTPS. Even the…

It sounds like to me despite Baidu not being involved they are being used as a vector of attack. It seems reasonable for anyone using Baidu to find an alternative for all of their services. After seeing that China is modifying responses how can we trust any request that goes past the GFW?

"It seems reasonable for anyone using Baidu to find an alternative for all of their services."

As always, majority of them simply don't care. Did many people stopped using Google after Snowden's leak on this side of GFW?

Re: China's Man-On-the-Side Attack on GitHub

#202

Post by mike_hearn »

westiseast wrote: post #75

For me the most interesting thig about this incident is how the GFW is being used offensively. Most other governments so far have protested online censorship from a kind of moral standpoint, but not from a security standpoint per se. Now it's quite clear the GFW is being leveraged offensively - did anyone spot this capability previously?

It's an identical setup to the NSA QUANTUM infrastructure, just in China instead of scattered around the western internet system. So I guess it's probably been used offensively in a more targeted approach for a while.

Re: China's Man-On-the-Side Attack on GitHub

#203

Post by mike_hearn »

peteretep wrote: post #197
abalone wrote: post #116

Earlier quoted context omitted.

The difference between the U.S. and China/Russia is that the people in China/Russia know the media is controlled by the powers that be. Here, our press is also "defined by the vision of the oligarchy and information is carefully controlled to produce a desired set of beliefs." We just believe that it's free. See: http://en.wikipedia.org/wiki/Manufacturing_Consent

No, the difference is that in the west you can access Russia Today ( http://www.rt.com ) and China Daily ( http://www.chinadaily.com.cn/en/ ), state-owned propaganda channels who delight in publishing anything that would make the U.S. look bad, and in China you can't access the NYT which helped break the Snowden stuff. The Guardian is owned by a trust who have legal obligations based on fair and balanced reporting, a…

Oddly, the Guardian is in fact not owned by a trust any more. It's owned by a private corporation that calls itself The Scott Trust, but it stopped being an actual trust in 2008.

Re: China's Man-On-the-Side Attack on GitHub

#204

Post by xxs »

bsaul wrote: post #135
westiseast wrote: post #95

Earlier quoted context omitted.

I have been there ;) You're misinterpreting the nature of control. Yes, there are protests, mostly because the government lets them happen. It helps people let off steam, it gives the government an indication of how people feel, and quite often there are conflicting interests which the Party can rise above (remember, government and the Party are not the same thing). So, often it's a bunch of workers protesting agains…

"How about an experiment - I'll hold up an anti government sign in front of the French parliament, and you do the same in Tiananmen Square and we'll see how much control the Chinese gov has ;)" Actually, i did just that 10 years ago, in front of the elysee ( white house french equivalent), alone, american style with my street sign ( although i didn't shout any sligan, i remained silent), and one policeman asked me my…

>>I wasn't beaten up or followed or spyed upon after that

How can you know?

Re: China's Man-On-the-Side Attack on GitHub

#205

Post by mike_hearn »

bsder wrote: post #137

So, the real question is how should we , the tech community, react?

More SSL.

This attack works because the firewall is capable of reading plain HTTP requests to spot the ones that are requesting the target javascripts, and then statelessly injecting raced packets. Neither technique works when SSL is in use. Even if China simply demanded the SSL keys from Baidu, they'd have to decrypt every single connection on the fly and significantly upgrade their infrastructure.

I think the only way to continue this technique in the presence of widespread SSL use is to actually force Baidu to insert the malicious Javascript on their own servers.

Re: China's Man-On-the-Side Attack on GitHub

#206

Post by mike_hearn »

carboncopy wrote: post #48
jjcc wrote: post #35

Most people might not know what kind of organization GreatFire really is because too much context is missing. I only discovered recently it's not so simple. There have been a lot of talks about the behavior of GreatFire for quite for a while but most of the talks are in Chinese. There are some in English though, to give everybody a glimpse here is an example: https://github.com/greatfire/wiki/issues/1 I have an impre…

Thanks for providing context. It might be unfair to thrust GitHub, and all Chinese developers into this fight. The Chinese government— if the DDoS fails — may very well just block access to Github, developer needs be damned. Of course that would provide an opportunity for a Chinese counterpart of Github to take market share, perhaps a favorable outcome?

I read that they tried blocking github already, but had to back down because of complaints from the software engineering community there.

Basically the Chinese government is desperately trying to disconnect the Chinese people from the global internet whilst simultaneously trying to minimise the economic damage that creates. Blocking news sites doesn't do a whole lot of damage. Blocking CDNs is totally different.

This sort of thing makes me think about an HTTP extension that lets arbitrary websites promise to proxy for others. Web servers could set an "X-Will-Relay-For: wikipedia.org, github.com, facebook.com, nytimes.com" header and then browsers would be programmed to store these mappings in their local cache as you browse the web. If attempting to reach a website fails, the browser would retry via an SSLd CONNECT request via one of the cached paths, sort of a Tor-lite but aimed purely at unblocking sites rather than anonymization.

Of course there are lots of practical details to work out like traffic management, how to avoid an outage of a large website causing cascading failures etc.

Re: China's Man-On-the-Side Attack on GitHub

#207

Post by rmchugh »

valgaze wrote: post #125
rattray wrote: post #119

Earlier quoted context omitted.

They are back on github now; they were indeed temporarily changed to return only alert("WARNING: malicious javascript detected on this domain"); (or something similar). I saw this myself.

From the Sony pictures incident to the attack on that satirical magazine in Paris to this, it's getting pretty tiresome having to deal with authoritarian types who believe they should dictate what other people can say or access. For those curious, see below for a write up of the malicious javascript (uses a simple ajax call & random number timer): http://insight-labs.org/?p=1682 document.write(" http://libs.baidu.com…

Loading all of jQuery seems a little bit excessive when the only thing they're using is the $.ajax function. http://youmightnotneedjquery.com/#request

Re: China's Man-On-the-Side Attack on GitHub

#208

Post by usrusr »

peteretep wrote: post #106
mwsherman wrote: post #25

Can browsers or OSs not treat the corrupted Baidu analytics as malware?

You'd think, wouldn't you. Or instead simply blacklist Baidu's analytics code completely. That will only hurt Chinese businesses using Baidu's product, and no-one else.

I agree and I even think that this will be unavoidable, if that kind of abuse keeps going on.

Government influence aside, Baidu would be free to host their analytics callbacks for the outside world outside of the GFW. If they stay accomplice to this kind of attack, no matter if forced or willingly, they will suffer.

Re: China's Man-On-the-Side Attack on GitHub

#209

Post by jpatte »

rattray wrote: post #119
ma2rten wrote: post #100

Earlier quoted context omitted.

actually both projects are still online on github. https://github.com/cn-nytimes https://github.com/greatfire

They are back on github now; they were indeed temporarily changed to return only alert("WARNING: malicious javascript detected on this domain"); (or something similar). I saw this myself.

Wait, how does that work? Looking at the malicious javascript code issuing ajax requests to github, it doen't seem github's response is evaluated. Is this alert even displayed?

If that is the case, why not do something even more radical in the response like changing the targeted urls ? They could replace them by baidu urls for example, effectively transforming a DDoS against github into a DDoS against baidu (not saying baidu is the author of the attack here, but that would certainly have an impact on the traffic being monitored by the GFW).

Post reply on HN