Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

China's Man-On-the-Side Attack on GitHub

netresec.com

Post reply on HN
Print view View original

231–240 of 323 posts

Re: China's Man-On-the-Side Attack on GitHub

#231

Post by tripa »

simonh wrote: post #195
psykovsky wrote: post #185

Earlier quoted context omitted.

Yet that Guantanamo ex-prisioner has his book for sale everywhere except in the US... Care to guess why it isn't for sale in the US?

A handful of books banned for a few individual legal issues does not make for a suppressive state. Are you seriously arguing that the USA is more suppressive of coimmunications and publications that China? Really?

> Are you seriously arguing that the USA is more suppressive of coimmunications and publications that China? Really?

He never was. And as seen from the outside, you're completely making his point.

Re: China's Man-On-the-Side Attack on GitHub

#232

Post by coldcode »

allochthon wrote: post #78
riscy wrote: post #38

"Our analysis shows that only about 1% of the requests for the Baidu Analytics script are receiving the malicious javascript as response. So in 99% of the cases everything behaves just like normal." The way I see it, this has been a diagnostic test by the Chinese government, ensuring they have the power to globally take down any website (or servers) they please.

Possibly. But whoever's behind it end up looking kind of bad, since Github has not capitulated.

But if it were 100% would github be able to survive?

Re: China's Man-On-the-Side Attack on GitHub

#233

Post by nailer »

paraboul wrote: post #229
nailer wrote: post #224

Earlier quoted context omitted.

> Another is that you should never ever have any webpage configured to load any resources from a server hosted within China IP address space as it is vulnerable to this sort of attack by the Chinese government. Yep. Baidu are a NASDAQ listed company, while they may not be the malicious actor here, they still have a responsibility to ensure their networks are not used to attack others - which they don't seem to be tak…

Baidu network is not used. The response is altered as the trafic goes out of China. The only thing they can do is hosting http://hm.baidu.com in another country.

> The response is altered as the trafic goes out of China.

By locating their network inside China, Baidu is allowing a malicious actor to leverage their network traffic - which indeed is a 'use' of Baidu's network.

> The only thing they can do is hosting http://hm.baidu.com in another country.

Most likely, yes. And until they do so, or come to another solution, their traffic should be blocked.

Re: China's Man-On-the-Side Attack on GitHub

#234

Post by throwaway7767 »

nailer wrote: post #224
JohnTHaller wrote: post #57

Since the question of "why" and "how" is coming up again, here's a quick summary I posted on reddit: From a few different analysis on HN and elsewhere... Baidu has an analytics product and an ads product, much like Google Analytics and Google AdSense, which are used on all kinds of websites via Javascript. China has set the Great Firewall of China to modify some of Baidu's assets so that any non-Chinese IP gets a mod…

> Another is that you should never ever have any webpage configured to load any resources from a server hosted within China IP address space as it is vulnerable to this sort of attack by the Chinese government. Yep. Baidu are a NASDAQ listed company, while they may not be the malicious actor here, they still have a responsibility to ensure their networks are not used to attack others - which they don't seem to be tak…

Does that mean we should drop everything coming from US prefixes also because the NSA uses them for man-on-the-side attacks?

Re: China's Man-On-the-Side Attack on GitHub

#235

Post by csteinbe »

corford wrote: post #154
taternuts wrote: post #49

Does baidu have any say in this at all? Were they hacked to include this script or they just passively allowed it?

Baidu have not been hacked. Their servers reside inside the great firewall meaning any request from outside China has to traverse the GFW before arriving at Baidu's servers. During traversal of the GFW, the Chinese gov is modifying the Baidu server response with malicious javascript. Baidu has no say in the matter. They could try and help Github by swapping to only serving their analytics scripts over HTTPS. Even the…

For HTTP connections, is there a current best practice that a javascript author can use to make sure that their code hasn't been modified by a MitM prior to execution on the browser?

Re: China's Man-On-the-Side Attack on GitHub

#236

Post by [deleted] »

TheDong wrote: post #132
peteretep wrote: post #106

Earlier quoted context omitted.

You'd think, wouldn't you. Or instead simply blacklist Baidu's analytics code completely. That will only hurt Chinese businesses using Baidu's product, and no-one else.

It would also hurt american, or european, or any nationality of business that uses baidu to get more insight into chinese visitors. Baidu is certainly most popular within china, but not exclusive to them.

[deleted]

Re: China's Man-On-the-Side Attack on GitHub

#237

Post by throwaway7767 »

tomjen3 wrote: post #218
interdrift wrote: post #211

Earlier quoted context omitted.

On which side are you ._.

Engineers don't care what side anybody is on, as long as the tech works.

> Engineers don't care what side anybody is on, as long as the tech works.

Good engineers do care. Don't mistake "being an engineer" with "being apathetic".

Re: China's Man-On-the-Side Attack on GitHub

#238

Post by nailer »

throwaway7767 wrote: post #234
nailer wrote: post #224

Earlier quoted context omitted.

> Another is that you should never ever have any webpage configured to load any resources from a server hosted within China IP address space as it is vulnerable to this sort of attack by the Chinese government. Yep. Baidu are a NASDAQ listed company, while they may not be the malicious actor here, they still have a responsibility to ensure their networks are not used to attack others - which they don't seem to be tak…

Does that mean we should drop everything coming from US prefixes also because the NSA uses them for man-on-the-side attacks?

If there is a specific infrastructure being leveraged by the someone to attack someone else, and the owner of the infrastructure is not taking steps to prevent its misuse, then yes, of course.

Edit: yes, throwaway7767, this means any company. However LinkedIn, in this case, was being spoofed, and LInkedIn's infrastructure was not used: http://www.spiegel.de/international/world/ghcq-targets-engin...

Edit 2: no, throwaway7767, Baidu's infrastructure - their bandwidth, their customers, and location within the Chinese Firewall are being used to attack GitHub. Baidu has control over where they locate their servers. Baidu are not exercising that control.

Re: China's Man-On-the-Side Attack on GitHub

#239

Post by peterjmag »

JohnTHaller wrote: post #57

Since the question of "why" and "how" is coming up again, here's a quick summary I posted on reddit: From a few different analysis on HN and elsewhere... Baidu has an analytics product and an ads product, much like Google Analytics and Google AdSense, which are used on all kinds of websites via Javascript. China has set the Great Firewall of China to modify some of Baidu's assets so that any non-Chinese IP gets a mod…

Wouldn't it be awesome if GitHub somehow exposed issues / pull requests / etc as actual git repos for each project, like they do for wikis? Seems like that would mitigate much of the risk associated with centralized issue tracking.

And yes, I'm aware that all the data is already accessible via their API, but that's not quite as easy to deal with as a simple "git clone". For now, perhaps something like https://backhub.co/ could help, but I'd like to have the option to self-host (which doesn't appear to be the case for BackHub).

EDIT: Something tells me they'd never do that, simply because their business model doesn't stand to benefit from it. But hey, I can dream.

Re: China's Man-On-the-Side Attack on GitHub

#240

Post by teamhappy »

nailer wrote: post #233
paraboul wrote: post #229

Earlier quoted context omitted.

Baidu network is not used. The response is altered as the trafic goes out of China. The only thing they can do is hosting http://hm.baidu.com in another country.

> The response is altered as the trafic goes out of China. By locating their network inside China, Baidu is allowing a malicious actor to leverage their network traffic - which indeed is a 'use' of Baidu's network. > The only thing they can do is hosting http://hm.baidu.com in another country. Most likely, yes. And until they do so, or come to another solution, their traffic should be blocked.

So what's the rule then? Block all packets coming out of countries with governments that do MITM attacks? Blame the companies for not locating their servers in other countries? Companies like GitHub? This is so hypocritical.
Post reply on HN