Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

China's Man-On-the-Side Attack on GitHub

netresec.com

Post reply on HN
Print view View original

311–320 of 323 posts

Re: China's Man-On-the-Side Attack on GitHub

#311

Post by peteretep »

abalone wrote: post #307
peteretep wrote: post #197

Earlier quoted context omitted.

No, the difference is that in the west you can access Russia Today ( http://www.rt.com ) and China Daily ( http://www.chinadaily.com.cn/en/ ), state-owned propaganda channels who delight in publishing anything that would make the U.S. look bad, and in China you can't access the NYT which helped break the Snowden stuff. The Guardian is owned by a trust who have legal obligations based on fair and balanced reporting, a…

The Snowden/NSA stuff doesn't fall outside of oligarchical perspectives. Tons of Silicon Valley companies for example, some of the most valuable in the world, are super anti domestic spying. The U.S. media system vigorously debates stuff that falls within the elite spectrum of opinion. But on issues that fall outside of that it is quite propagandistic. In fact that vigorous debate masks the ultimate bias of it. For e…

    > doesn't fall outside of oligarchical perspectives
http://en.wikipedia.org/wiki/No_true_Scotsman

    > within the elite spectrum of opinion. But on issues that
    > fall outside of that it is quite propagandistic
Occam's razor wants you to know that this means the elite have opinions on the same spectrum as the general public

    > major media is usually very nationalistic about U.S.
    > wars
US TV media is recently very nationalistic about U.S. wars; certainly weren't about Vietnam, for example. Accusing the NYT of being pro-Middle-Eastern war is a reach, and NYT is both the most respected newspaper in the US, but also, CRUCIALLY, the news source that is being censored here.

Re: China's Man-On-the-Side Attack on GitHub

#312

Post by peteretep »

thawkins wrote: post #265
usrusr wrote: post #208

Earlier quoted context omitted.

I agree and I even think that this will be unavoidable, if that kind of abuse keeps going on. Government influence aside, Baidu would be free to host their analytics callbacks for the outside world outside of the GFW. If they stay accomplice to this kind of attack, no matter if forced or willingly, they will suffer.

Given the amount of ad bourne malvertising that is floating around, a content based blacklist of javascript would be a good thing.

and is called "Ghostery"

Re: China's Man-On-the-Side Attack on GitHub

#313

Post by cxseven »

jackdawjack wrote: post #277
cxseven wrote: post #147

Netresec should be able to gradually increase the TTL of their packets going to Baidu to see which hop or link is doing the hijack. They mention someone did this earlier with the iCloud hijack by using mtr and tcptraceroute, but it looks like these tools won't work as-is this time because the Github man-on-the-side attack waits for the HTTP GET request. It's probably stateless and if so could be triggered by a lone A…

I think this might be a daft question, but why can't they inject packets with a (roughly) appropriate TTL for the current sequence that they're hijacking? From the two examples shown one might think they're picking ttl's more randomly

They could make the packets stand out less, but there'd still be the overlapping reply from the legitimate Baidu host, unless the attackers went full MITM.

In case anyone is confused: we're now talking about the TTL of the packets coming from hijackers, whereas I was originally talking about the TTL of the packets going towards Baidu and the hijackers. The TTL the hijackers send won't affect the tracing method I was suggesting.

Re: China's Man-On-the-Side Attack on GitHub

#314

Post by stevendaniels »

j42 wrote: post #121
jhedwards wrote: post #82

Earlier quoted context omitted.

> the entire reality they see and what they believe to be true is heavily distorted I have to disagree with others that this part of your comment is a bit too strong. I lived in China for two years and many people I talked to would say something like "We admire America because it is so free, our country is just so corrupt" or whisper something like "when the US says our human rights are bad, we agree."

I think the disillusionment exists, especially among the youth and democratically-minded. In my opinion, for such a regime to be successful in the modern day it must exist... that said, I would say the most telling aspect is how these particular individuals view their goals and/or definitions of "success." America certainly isn't the democratic ideal, however in contrast it's apparent how a sustained cultural ideal c…

>I think the disillusionment exists, especially among the youth and democratically-minded.

This. Except older, middle-class people are even more disillusioned than the young. As a rule, older Chinese people won't talk about their disillusionment, but those who lived through the 50s and 60s faced huge obstacles. They live lives of quiet desperation.

Re: China's Man-On-the-Side Attack on GitHub

#315

Post by misja111 »

mraison wrote: post #10

I still don't really get it. What's the actual goal behind the attack? When the Chinese government decides to block a website, I can at least understand their motivations, as bad as they may be. But DDOSing Github just seems to be pissing the whole world off for a few hours without any actual long term consequences.

>> What's the actual goal behind the attack?

The answer to that question is in the article:

"As can be seen in the code, the two targeted URLs are github.com/greatfire and github.com/cn-nytimes, which are mirror sites for GreatFire.org and the Chinese New York Times. GreatFire and NYT both use GitHub to circumvent the online censorship performed by the Great Firewall of China (GFW)."

Re: China's Man-On-the-Side Attack on GitHub

#316

Post by mike_hearn »

cbsmith wrote: post #216
mike_hearn wrote: post #205

Earlier quoted context omitted.

More SSL. This attack works because the firewall is capable of reading plain HTTP requests to spot the ones that are requesting the target javascripts, and then statelessly injecting raced packets. Neither technique works when SSL is in use. Even if China simply demanded the SSL keys from Baidu, they'd have to decrypt every single connection on the fly and significantly upgrade their infrastructure. I think the only…

> Even if China simply demanded the SSL keys from Baidu, they'd have to decrypt every single connection on the fly and significantly upgrade their infrastructure. Umm... not really. All you'd have to do is select whatever subset of connections you want to inject code in to, and then terminate them with your own web server that has Baidu's SSL keys, then let the rest of the connections go through transparently to Baid…

You can't easily select that unless the stuff you want is on a dedicated relatively low traffic hostname. If everything is served off e.g. ads.baidu.cn then you have to decrypt all ad traffic, which is a lot.

Re: China's Man-On-the-Side Attack on GitHub

#317

Post by hobs »

jc4p wrote: post #269
hobs wrote: post #222

Earlier quoted context omitted.

Really? We knew the world would not be the same. A few people laughed, a few people cried, most people were silent. I remembered the line from the Hindu scripture, the Bhagavad-Gita... "Now, I am become Death, the destroyer of worlds." Any engineer worth his salt absolutely understands the consequences of their actions on the world. Sometimes they understand a bit too late.

hey buddy

What's up pvam

Re: China's Man-On-the-Side Attack on GitHub

#318

Post by teknologist »

kuschku wrote: post #227
teknologist wrote: post #170

Earlier quoted context omitted.

Google Analytics does all that, no worries

Google Analytics is, sometimes, blocked by the GFW – so, if you already sell out your users to Google, using Baidu wouldn’t be an unrealistic use case anymore.

Except when it decides to ddos github

Re: China's Man-On-the-Side Attack on GitHub

#319

Post by nitrogen »

javert wrote: post #290
nitrogen wrote: post #134

Earlier quoted context omitted.

In other words, comparing Fox to the media situation in China or Russia is just ridiculous and irresponsible. The point of "comparing" anything to anything else is to see how the things are alike, and how they differ, as in "compare and contrast." If such comparisons are to be verboten, even if by stigma and not by fiat, then we are giving up an essential tool of understanding.

Let's look up definitions of compare. https://www.google.com/search?q=define%3Acompare&ie=utf-8&oe... I'm using it in a valid way, and not in the way you suggest, and it's clear from context which meaning I am using.

That may be the meaning you are using, but that's not what the other commenters are doing.

Re: China's Man-On-the-Side Attack on GitHub

#320

Post by cbsmith »

mike_hearn wrote: post #316
cbsmith wrote: post #216

Earlier quoted context omitted.

> Even if China simply demanded the SSL keys from Baidu, they'd have to decrypt every single connection on the fly and significantly upgrade their infrastructure. Umm... not really. All you'd have to do is select whatever subset of connections you want to inject code in to, and then terminate them with your own web server that has Baidu's SSL keys, then let the rest of the connections go through transparently to Baid…

You can't easily select that unless the stuff you want is on a dedicated relatively low traffic hostname. If everything is served off e.g. ads.baidu.cn then you have to decrypt all ad traffic, which is a lot.

You can select a random subset very easily at the layer-3/4 level. It's really not that different from just adding a host behind a layer-4 load balancer.

...and actually it doesn't have to be completely random. You could select specific IP addresses to intercept.

Post reply on HN