Pin-pointing China's attack against GitHub

#1

Post by zmanian » Thu, Apr 02, 2015, 12:56 AM UTC

Pin-pointing China's attack against GitHub
blog.erratasec.com

Re: Pin-pointing China's attack against GitHub

#2

Post by finnn » Thu, Apr 02, 2015, 6:45 AM UTC

That's cool, I didn't know how traceroutes work. Is he planning on releasing the http traceroute tool?

Re: Pin-pointing China's attack against GitHub

#3

Post by cleverjake » Thu, Apr 02, 2015, 6:46 AM UTC

finnn wrote: post #2

That's cool, I didn't know how traceroutes work. Is he planning on releasing the http traceroute tool?

you should comment there to ask them

Re: Pin-pointing China's attack against GitHub

#4

Post by itistoday2 » Thu, Apr 02, 2015, 6:48 AM UTC

finnn wrote: post #2

That's cool, I didn't know how traceroutes work. Is he planning on releasing the http traceroute tool?

Here ya go: https://github.com/robertdavidgraham/masscan

    @collinrm I just took masscan, changed the HTTP request,
    then tweeked the code to generate a small TTL.

Source: https://twitter.com/ErrataRob/status/583433175302479872

Re: Pin-pointing China's attack against GitHub

#5

Post by zombination » Thu, Apr 02, 2015, 7:20 AM UTC

This is important evidence for our government. It'll be interesting to see how they respond to these attacks -- attacks by a nation state against key United States Internet infrastructure.

It seems a bit of a stretch to say that Github is "key US Internet infrastructure"...

Re: Pin-pointing China's attack against GitHub

#6

Post by yeskia » Thu, Apr 02, 2015, 7:26 AM UTC

zombination wrote: post #5

This is important evidence for our government. It'll be interesting to see how they respond to these attacks -- attacks by a nation state against key United States Internet infrastructure. It seems a bit of a stretch to say that Github is "key US Internet infrastructure"...

Isn't GitHub hosted on AWS, which as a platform is pretty significant.

Re: Pin-pointing China's attack against GitHub

#7

Post by andyfleming » Thu, Apr 02, 2015, 7:30 AM UTC

zombination wrote: post #5

This is important evidence for our government. It'll be interesting to see how they respond to these attacks -- attacks by a nation state against key United States Internet infrastructure. It seems a bit of a stretch to say that Github is "key US Internet infrastructure"...

I don't know that it is "key US Internet infrastructure", but it's important to a lot of developers and companies. Thankfully GitHub handled the attack pretty well.

Disclaimer: I'm not sure what actual usage stats are like for GitHub.

Re: Pin-pointing China's attack against GitHub

#8

Post by mfkp » Thu, Apr 02, 2015, 7:32 AM UTC

While this is a very interesting read (learned a thing or two), the author's conclusion is a bit suspect.

Using my custom http-traceroute, I've proven that the man-in-the-middle machine attacking GitHub is located on or near the Great Firewall of China.

Although suspicious, it seems one would need to know a lot more about China Unicom and their infrastructure to say this conclusively.

Re: Pin-pointing China's attack against GitHub

#9

Post by klaustopher » Thu, Apr 02, 2015, 7:40 AM UTC

yeskia wrote: post #6

zombination wrote: post #5

This is important evidence for our government. It'll be interesting to see how they respond to these attacks -- attacks by a nation state against key United States Internet infrastructure. It seems a bit of a stretch to say that Github is "key US Internet infrastructure"...

Isn't GitHub hosted on AWS, which as a platform is pretty significant.

GitHub used to be hosted on EngineYard in the beginning, but later moved to bare metal servers at RackSpace: https://github.com/blog/493-github-is-moving-to-rackspace

Re: Pin-pointing China's attack against GitHub

#10

Post by [deleted] » Thu, Apr 02, 2015, 7:46 AM UTC

mfkp wrote: post #8

While this is a very interesting read (learned a thing or two), the author's conclusion is a bit suspect. Using my custom http-traceroute, I've proven that the man-in-the-middle machine attacking GitHub is located on or near the Great Firewall of China. Although suspicious, it seems one would need to know a lot more about China Unicom and their infrastructure to say this conclusively.

[deleted]