21–30 of 144 posts
I don't agree with author's conclusion, having a server in a chinese ISP does not mean it's orchestrated by chinese gov. Also, I don't suppose MITM attack organizers have no clue about how TTL works.
I don't agree with author's conclusion, having a server in a chinese ISP does not mean it's orchestrated by chinese gov. Also, I don't suppose MITM attack organizers have no clue about how TTL works.
They didn't have a clue about $.ajax with a 'script' data type did they?
So when I get a packet with ttl so small that won't survive long enough to reach the target, instead of altering, I just leave it along. So the probe will never know where I am in the route.
When TPB was pretending to be in North Korea, someone proved that they weren't, [1] because of how quickly they responded to a ping. Could someone narrow down the physical location of the firewall similarly? [1]: https://rdns.im/the-pirate-bay-north-korean-hosting-no-its-f...
You can really only use a method like this to say where a server is not (it can't be halfway around the world because the speed of light limits it), but this is assuming you're communicating directly with the server. The method used to inject these packets on the wire makes this sort of analysis even harder to do this sort of analysis (and if there was concern, appropriate amounts of random delay and noise could be a…
I was under the impression that this was a man on the side attack, so they'd sent a bogus SYN-ACK back to you the moment that they saw a SYN. Theoretically, you should still only be dealing with one RTT.
>(and if there was concern, appropriate amounts of random delay and noise could be added).
I don't think China cares if it gets traced back to them.
To say that the "Chinese government" is involved I think understates the situation. We know as fact that their army has invested considerable time and money in a cyberwarfare unit. And that the company that operates the Firewall is a military contractor. When Sony was hacked a few months ago, the media couldn't wait to label it a "terrorist act" by North Korea. I just now searched Google News for "github terrorism".…
And GFW is indeed a WMD that must be stopped.
Earlier quoted context omitted.
You can really only use a method like this to say where a server is not (it can't be halfway around the world because the speed of light limits it), but this is assuming you're communicating directly with the server. The method used to inject these packets on the wire makes this sort of analysis even harder to do this sort of analysis (and if there was concern, appropriate amounts of random delay and noise could be a…
>The method used to inject these packets on the wire makes this sort of analysis even harder to do this sort of analysis I was under the impression that this was a man on the side attack, so they'd sent a bogus SYN-ACK back to you the moment that they saw a SYN. Theoretically, you should still only be dealing with one RTT. >(and if there was concern, appropriate amounts of random delay and noise could be added). I do…
No they don't, and when time arrives, they deny whatever the accusation is, and claims it's a defamation.
To say that the "Chinese government" is involved I think understates the situation. We know as fact that their army has invested considerable time and money in a cyberwarfare unit. And that the company that operates the Firewall is a military contractor. When Sony was hacked a few months ago, the media couldn't wait to label it a "terrorist act" by North Korea. I just now searched Google News for "github terrorism".…
While this is a very interesting read (learned a thing or two), the author's conclusion is a bit suspect. Using my custom http-traceroute, I've proven that the man-in-the-middle machine attacking GitHub is located on or near the Great Firewall of China. Although suspicious, it seems one would need to know a lot more about China Unicom and their infrastructure to say this conclusively.
I apologize because I have not had time to really looking into this closely, but I think you are correct that the author's conclusions need to be reviewed. He repeatedly says that it is a man in the middle attack, but the link he points to says it is a man on the side attack. This is a very different beast: a man on the side attack does not rewrite packets, but rather uses it's position on the backbone to send replac…
To say that the "Chinese government" is involved I think understates the situation. We know as fact that their army has invested considerable time and money in a cyberwarfare unit. And that the company that operates the Firewall is a military contractor. When Sony was hacked a few months ago, the media couldn't wait to label it a "terrorist act" by North Korea. I just now searched Google News for "github terrorism".…
Is terrorism the correct word for the US government infiltrating, manipulating and subverting technology and services all over the world? Is spreading fear about being monitored by a seemingly lawless entity terrorism?
While this is a very interesting read (learned a thing or two), the author's conclusion is a bit suspect. Using my custom http-traceroute, I've proven that the man-in-the-middle machine attacking GitHub is located on or near the Great Firewall of China. Although suspicious, it seems one would need to know a lot more about China Unicom and their infrastructure to say this conclusively.
I apologize because I have not had time to really looking into this closely, but I think you are correct that the author's conclusions need to be reviewed. He repeatedly says that it is a man in the middle attack, but the link he points to says it is a man on the side attack. This is a very different beast: a man on the side attack does not rewrite packets, but rather uses it's position on the backbone to send replac…
edit: above may be imprecise. I went back and read the original more closely. they note that if they artificially drop an injected packet, it doesn't get resent (and hence the conclusion that it's man on the side), but they don't mention whether they get the original packets or not. If something is blocking the original baidu packets, it would have to be in the middle, not just on the side.