China's Man-On-the-Side Attack on GitHub • Hacker News Board

Re: China's Man-On-the-Side Attack on GitHub

#271

Post by codesuela » Tue, Mar 31, 2015, 2:24 PM UTC

jmngomes wrote: post #270

"Based on reports we've received, we believe the intent of this attack is to convince us to remove a specific class of content." Does anyone know what that "specific class of content" is, or can shed some light over the motivation of the attacks?

> As can be seen in the code, the two targeted URLs are github.com/greatfire and github.com/cn-nytimes, which are mirror sites for GreatFire.org and the Chinese New York Times. GreatFire and NYT both use GitHub to circumvent the online censorship performed by the Great Firewall of China (GFW).

Re: China's Man-On-the-Side Attack on GitHub

#272

Post by belorn » Tue, Mar 31, 2015, 2:28 PM UTC

mraison wrote: post #10

I still don't really get it. What's the actual goal behind the attack? When the Chinese government decides to block a website, I can at least understand their motivations, as bad as they may be. But DDOSing Github just seems to be pissing the whole world off for a few hours without any actual long term consequences.

I see many goals, but I find it most likely that this was the digital version of a weapon test. The arbitrary use of 1% and the simplicity of the attack seems perfect for demonstrating a capability. As a bonus, they get to send a message about circumventing, see the effectiveness, and test defenses against it. All without having to official claim credit for it.

Re: China's Man-On-the-Side Attack on GitHub

#273

Post by jmngomes » Tue, Mar 31, 2015, 2:39 PM UTC

codesuela wrote: post #271

jmngomes wrote: post #270

"Based on reports we've received, we believe the intent of this attack is to convince us to remove a specific class of content." Does anyone know what that "specific class of content" is, or can shed some light over the motivation of the attacks?

> As can be seen in the code, the two targeted URLs are github.com/greatfire and github.com/cn-nytimes, which are mirror sites for GreatFire.org and the Chinese New York Times. GreatFire and NYT both use GitHub to circumvent the online censorship performed by the Great Firewall of China (GFW).

I read that. Can someone shed some light over the motivation of the attacks?

Re: China's Man-On-the-Side Attack on GitHub

#274

Post by ethbro » Tue, Mar 31, 2015, 2:45 PM UTC

belorn wrote: post #264

JohnTHaller wrote: post #57

Since the question of "why" and "how" is coming up again, here's a quick summary I posted on reddit: From a few different analysis on HN and elsewhere... Baidu has an analytics product and an ads product, much like Google Analytics and Google AdSense, which are used on all kinds of websites via Javascript. China has set the Great Firewall of China to modify some of Baidu's assets so that any non-Chinese IP gets a mod…

The takeaway from this attack is the same as we got from the Snowden disclosure: Nations will abuse network services that is located on their borders. They will hack-tap-and-steal, modify, block, and use any method available to distribute malware. Any action is viable so long there is a target to attack which could produce political, economical or military advantages. I suspect we will reach a point where treaties ar…

I like to grab old books at yard sales, and found this an interesting read (Arms Control Disarmament And National Security, 1961, https://archive.org/details/armscontroldisar013124mbp). It's a collection of essays by various authors on a variety of arms control subjects.

Everyone sees nuclear / Cold War negotiations in hindsight, but in 1961 (and probably also ~1950) the logic is much more interesting, given that the theories were developed from a position of profound ignorance. How would things turn out? What did the other side actually want? How reasonable was the other side? Unknown!

On a technical point, is there a reason that javascript doesn't tend to be signed in any way? Or is it? Even if you're serving unsecured content for whatever reason, it'd be nice to allow the user to verify the code they received was as you intended. (Admittedly, encrypting all traffic as a default solves this)

Re: China's Man-On-the-Side Attack on GitHub

#275

Post by UhUhUhUh » Tue, Mar 31, 2015, 2:47 PM UTC

j42 wrote: post #23

mraison wrote: post #10

I still don't really get it. What's the actual goal behind the attack? When the Chinese government decides to block a website, I can at least understand their motivations, as bad as they may be. But DDOSing Github just seems to be pissing the whole world off for a few hours without any actual long term consequences.

Actually, someone here (who I cannot remember) said quite eloquently yesterday that our biggest export--and "influence" on the world--is culture. For the first time I realized that pissing people off may, in fact be the objective as the other reply stated. China and Russia are both (quite unique) examples of countries with an unfathomable degree of control over their citizens. It can be hard to grasp occasionally, co…

There are just as many (and few) conscious people in any country on the planet. Thinking otherwise is inaccurate and also reinforces and in fact validates the efforts of local powers to rally a larger part of their subjects in defence of a cultural, irrelevant but real, identity, thus muddling the problem. There were as many (and few) resistants in Nazi Germany as there were in France. I see all these people as my "brothers/sisters" and I don't like it when they are drowned in a sea of commiseration.

Re: China's Man-On-the-Side Attack on GitHub

#276

Post by e40 » Tue, Mar 31, 2015, 2:57 PM UTC

ethbro wrote: post #274

belorn wrote: post #264

Earlier quoted context omitted.

The takeaway from this attack is the same as we got from the Snowden disclosure: Nations will abuse network services that is located on their borders. They will hack-tap-and-steal, modify, block, and use any method available to distribute malware. Any action is viable so long there is a target to attack which could produce political, economical or military advantages. I suspect we will reach a point where treaties ar…

I like to grab old books at yard sales, and found this an interesting read (Arms Control Disarmament And National Security, 1961, https://archive.org/details/armscontroldisar013124mbp ). It's a collection of essays by various authors on a variety of arms control subjects. Everyone sees nuclear / Cold War negotiations in hindsight, but in 1961 (and probably also ~1950) the logic is much more interesting, given that th…

On a technical point, is there a reason that javascript doesn't tend to be signed in any way?

A good point. I think it's convenience that we don't do it, but I'd hope we move in that direction. It seems like a prudent move.

Re: China's Man-On-the-Side Attack on GitHub

#277

Post by jackdawjack » Tue, Mar 31, 2015, 3:13 PM UTC

cxseven wrote: post #147

Netresec should be able to gradually increase the TTL of their packets going to Baidu to see which hop or link is doing the hijack. They mention someone did this earlier with the iCloud hijack by using mtr and tcptraceroute, but it looks like these tools won't work as-is this time because the Github man-on-the-side attack waits for the HTTP GET request. It's probably stateless and if so could be triggered by a lone A…

I think this might be a daft question, but why can't they inject packets with a (roughly) appropriate TTL for the current sequence that they're hijacking? From the two examples shown one might think they're picking ttl's more randomly

Re: China's Man-On-the-Side Attack on GitHub

#278

Post by ethbro » Tue, Mar 31, 2015, 3:14 PM UTC

e40 wrote: post #276

ethbro wrote: post #274

Earlier quoted context omitted.

I like to grab old books at yard sales, and found this an interesting read (Arms Control Disarmament And National Security, 1961, https://archive.org/details/armscontroldisar013124mbp ). It's a collection of essays by various authors on a variety of arms control subjects. Everyone sees nuclear / Cold War negotiations in hindsight, but in 1961 (and probably also ~1950) the logic is much more interesting, given that th…

On a technical point, is there a reason that javascript doesn't tend to be signed in any way? A good point. I think it's convenience that we don't do it, but I'd hope we move in that direction. It seems like a prudent move.

> A good point. I think it's convenience that we don't do it, but I'd hope we move in that direction. It seems like a prudent move.

After a bit of Googling, (a) http://stackoverflow.com/questions/1368164/javascript-code-s... (b) http://www-archive.mozilla.org/projects/security/components/...

It seems it's simultaneously too difficult to do without ECMA spec support & would require a certificate chain anyway. And if you're running a cert chain infrastructure, why not use the one that already exists and run TLS?

Other side thought: with regards to the usefulness & impracticality of cert pinning, has any work been done on systems specifically designed to target low % injection systems? If 1/10 visitors gets the poisoned page, then it seems you'd have a 9/10 chance to pull a good page for comparison & verification if you (or a proxy you trust) made another request from a different IP.

Re: China's Man-On-the-Side Attack on GitHub

#279

Post by Sir_Cmpwn » Tue, Mar 31, 2015, 3:17 PM UTC

facepalm wrote: post #246

westiseast wrote: post #75

For me the most interesting thig about this incident is how the GFW is being used offensively. Most other governments so far have protested online censorship from a kind of moral standpoint, but not from a security standpoint per se. Now it's quite clear the GFW is being leveraged offensively - did anyone spot this capability previously?

It seems the only solution might be to block all content from China? Great - now they have the firewall working both ways.

I had to do that for a website I ran a while ago. It's unfortunate but at the end of the day blocking China means that the rest of the world can continue to use your services legitimately.

Re: China's Man-On-the-Side Attack on GitHub

#280

Post by nailer » Tue, Mar 31, 2015, 3:21 PM UTC

throwaway7767 wrote: post #261

nailer wrote: post #238

Earlier quoted context omitted.

If there is a specific infrastructure being leveraged by the someone to attack someone else, and the owner of the infrastructure is not taking steps to prevent its misuse, then yes, of course. Edit: yes, throwaway7767, this means any company. However LinkedIn, in this case, was being spoofed, and LInkedIn's infrastructure was not used: http://www.spiegel.de/international/world/ghcq-targets-engin... Edit 2: no, throwa…

Apparently I can now reply further into the thread, must be a timed thing. > Edit: yes, throwaway7767, this means any company. However LinkedIn, in this case, was being spoofed, and LInkedIn's infrastructure was not used: http://www.spiegel.de/international/world/ghcq-targets-engin... . LinkedIn was indeed being spoofed, which is exactly what was being done to baidu in this case we are discussing. So it seems to be w…

>> If there is a specific infrastructure being leveraged by the someone to attack someone else, and the owner of the infrastructure is not taking steps to prevent its misuse, then yes, of course.

> you have not seen fit to specifically state that companies like linkedin should move all their servers outside the US/UK/FVEY countries, reserving that course of action only for chinese companies.

Yes, I have. See quote above.