Pin-pointing China's attack against GitHub

To say that the "Chinese government" is involved I think understates the situation. We know as fact that their army has invested considerable time and money in a cyberwarfare unit. And that the company that operates the Firewall is a military contractor.

When Sony was hacked a few months ago, the media couldn't wait to label it a "terrorist act" by North Korea.

I just now searched Google News for "github terrorism".

1. http://www.itpro.co.uk/security/24319/github-falls-victim-to...

2. https://grahamcluley.com/2015/03/github-ddos-attack/

That's all, even though the evidence appears more clear that the Chinese government is involved. Whereas North Korea's responsibility was in doubt. The silence speaks volumes.

But is "terrorism" even the correct word for this? When Saddam invaded Kuwait, was that a terrorist act? Consider this quote written by a Chinese military analyst 30 years ago:

  those who take part in information war are not all soldiers. Anybody who
  understands computers may become a "fighter" on the network. Think tanks
  composed of non-governmental experts may take part in decision-making;
  rapid mobilization will not just be directed to young people; information-
  related industries and domains will be the first to be mobilized and enter
  the war..

(From http://fmso.leavenworth.army.mil/documents/chinarma.htm)

However, the Chinese may respond by claiming this was a preemptive defense. That GreatFire.com was designed to weaken their security and they were justified in taking action to protect the sovereignty of their computers. Haven't western nations done the same when they were threatened by terrorism or nuclear arms?

It seems to me that we have officially entered the era of a weaponized internet.

Is there a statement from github what they think who did the ddos?

You can really only use a method like this to say where a server is not (it can't be halfway around the world because the speed of light limits it), but this is assuming you're communicating directly with the server. The method used to inject these packets on the wire makes this sort of analysis even harder to do this sort of analysis (and if there was concern, appropriate amounts of random delay and noise could be added).

I apologize because I have not had time to really looking into this closely, but I think you are correct that the author's conclusions need to be reviewed. He repeatedly says that it is a man in the middle attack, but the link he points to says it is a man on the side attack. This is a very different beast: a man on the side attack does not rewrite packets, but rather uses it's position on the backbone to send replacement packets that will arrive before the real ones do. Also, the referenced link states that these packets are being sent on only 1% of responses. So if this is the case a traceroute is probably not going to find the issue. The offending node does not have to respond at all -- especially if it sends the bogus packets by a different route.

Again, I have not looked at this in detail yet and probably won't have time for a few days. I would welcome a discussion on this point.

I don't agree with author's conclusion, having a server in a chinese ISP does not mean it's orchestrated by chinese gov. Also, I don't suppose MITM attack organizers have no clue about how TTL works.