Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pin-pointing China's attack against GitHub

blog.erratasec.com

Post reply on HN
Print view View original

81–90 of 144 posts

Re: Pin-pointing China's attack against GitHub

#81

Post by imron »

Ashwinning wrote: post #16

"blocking GitHub is not really a viable option" he said. Tell that to the world's craziest democracy - India, which banned GitHub, Vimeo, Pastebin and a bunch of others in December last year. Some bans were lifted later. Source : http://www.zdnet.com/article/india-blocks-32-websites-includ...

Agree with this. Anyone who thinks blocking GitHub is not really a viable option has never been on the other side of the GFW.

The Chinese government will happily block any site they want to and they have little/no regard for the popularity or usefulness of the site in question, and often they will block popular foreign sites to help copycat local versions thrive.

Off the top of my head they block Facebook, Twitter and Youtube entirely and Wikipedia selectively (used to be permanently also). I can tell you they don't care about blocking GitHub.

The also have the ability to dynamically block sites based on page content rather than just entire domains, so it would be perfectly feasible for them to block just the project pages and not the entirety of GitHub.

Re: Pin-pointing China's attack against GitHub

#82

Post by stefantalpalaru »

simula67 wrote: post #52
jacquesm wrote: post #40

Earlier quoted context omitted.

> Do people really think they are that stupid ? That's not really a defence. They could easily be that stupid, bureaucracies tend to do extremely stupid stuff when looked at from the outside but every cog on the inside thinks that its action makes perfect sense. > This Github DDoS has got to be the work of someone trying to frame the Chinese government. Evidence? > Has anyone considered that angle ? Sure, but so far…

> bureaucracies tend to do extremely stupid stuff when looked at from the outside but every cog on the inside thinks that its action makes perfect sense. If this is Chinese doing, the likely ones responsible are the Chinese Intelligence, not their bureaucracy. > Evidence? Occam's Razor. I find it hard to believe that a society with sufficient level of sophistication to obtain $9 trillion GDP[1] would 'accidentally' g…

Occam's Razor is unscientific. Unless you know of any proof that given 2 or more possible explanations for a phenomenon the simplest one is always closer to the truth.

Re: Pin-pointing China's attack against GitHub

#83

Post by JonnieCache »

hyperpape wrote: post #80
JonnieCache wrote: post #47

Earlier quoted context omitted.

>But is "terrorism" even the correct word for this? Don't use that word. It's barely even a word any more, its become one of those weaponized magic symbols used for mind control. See also "freedom", "globalization", "sharing", "choice" and so on. Instead, you can just use words like "murder", "destruction of infrastructure" and the like.

Makes sense, once you can come up with a single word to refer to targeting civilians with violence to try to effect political change. That's what "terrorism" meant and that's what it means, even if our news media and government have decided that it can only ever be applied to Muslims.

The problem is, there's no well defined way to tell which version of the word someone's using. That's the point. So best to just not use it.

(Obviously you do need to use it sometimes, in an academic context for example. It's a tricky one.)

Re: Pin-pointing China's attack against GitHub

#84

Post by Karunamon »

1stop wrote: post #38
methou wrote: post #25

Earlier quoted context omitted.

> It seems to me that we have officially entered the era of a weaponized internet. Couldn't agree more. And GFW is indeed a WMD that must be stopped.

... I can't tell if this is sarcasm or serious. But seriously... What "Mass destruction" can the GFW cause? ... Like Amazon/Azure/Rackspace are WMDs under your current definition?

I think the attack has proven that the government via the GFW can take down any web service they choose. There's not much infrastructure out there than can repel firepower of that magnitude.

Maybe not "destruction" in the permanent sense, but given the damage that a DDOS can do (financially, at least), it would make sense to treat one as an attack on infrastructure.

Re: Pin-pointing China's attack against GitHub

#85

Post by nicpottier »

brudgers wrote: post #77
jacquesm wrote: post #73

Earlier quoted context omitted.

That's the odd thing, they could jam it instantly if they so chose to. The GFWs primary purpose is to limit access to certain urls from within China. Now of course those repos are intended to circumvent that but once someone has them they are out of reach of the GFW. So blocking those urls at the GFW would seem to be all that's really needed. Tools like these should be accessible from as many places as possible.

Diplomatic logic suggests Github is serving as an object lesson: 1. 中华人民共和国 has laws. 2. 中华人民共和国 is well connected to the internet. 3. 中华人民共和国 can project its interests around the world easily in rather nasty ways. 4. 中华人民共和国 can project its interests from within its borders. 5. 中华人民共和国 has an interest in controlling commerce within its borders. I believe this is an act of foreign policy, not domestic. It's not about…

The mechanics of the attack are entirely within the realm of sanctioned internet behavior

Not sure what you mean by "sanctioned" here. Technically possible? Yes. But also abusing and perverting the most important medium of our age.

The internet largely works BECAUSE of trust and cooperation and BECAUSE actors chose to not fuck with each other. If China truly is behind this I have half a mind to just cut them entirely out, except in a way that is exactly what they want and figuring out how to maintain the positive effects of said internet on democracy and free speech is worth the trouble.

Re: Pin-pointing China's attack against GitHub

#86

Post by peterwwillis »

> While many explanations are possible, such as hackers breaking into these machines, the overwhelmingly most likely suspect for the source of the GitHub attacks is the Chinese government.

Correlating the circumstantial facts that China has a giant firewall, the content being blocked is getting around China's firewall, and an attack came from somewhere deep in one of China's largest backbone providers, does not make an 'extreme likelihood'; it makes a weak correlation. Likelihood requires reviewing known outcomes to determine a likely result. What other known evidence of specifically these three behaviors by the Chinese government are you basing this conclusion on?

> This is important evidence for our government.

You've taken a massive leap in logic from a machine inside China manipulating global traffic to attack servers in the US, to conclude that it is more likely to have been the Government than anyone else. This is exactly the same as saying any attack originating from the US which appears to be related to US interests must be from the US government. If this was the basis for how we concluded all investigations into illegal actions, anyone who 'looked like' they did it would be found guilty, sans evidence. That may be how other nations' justice system works, but not ours.

Furthermore, in no way is either Github or Baidu's analytics considered 'key US Internet infrastructure'. I mean, Git is even a decentralized system - people can still get work done if it's down!

This is not evidence of the Chinese government's complicity, and pretending it is creates a dangerous logical fallacy that could improperly shape public opinion.

Re: Pin-pointing China's attack against GitHub

#87

Post by snowwolf »

baconschizer wrote: post #64

Is this April fool joke? Or are you guys really taking this whole Chinese government theory seriously? If you were leading a 1.6bn populated country how much you would care about a programmer's code site? To give all those conspiracy theorists a clear picture, what really happened is merely the scale of problem you have never worked on or dreamed to be working on outside China. This happened year ago when a Chinese s…

I made a similar comment elsewhere in the thread, but lets assume it's not the Chinese government and it's something accidentally deployed or a hack by some unknown entity.

Why is the code still running a week later? It doesn't take that long to find the offending server/s code and remove it. Especially as it is making the Chinese government look bad, there would be added incentive to fix this pretty quickly.

Re: Pin-pointing China's attack against GitHub

#88

Post by jonalmeida »

a3n wrote: post #78
Daishiman wrote: post #18

Earlier quoted context omitted.

If GitHub were down for two days that's a metric shitload of projects that can't get deployed. There's a significant number of software projects with dependencies on Github-hosted stuff.

If github were down for two days, you're probably right, those projects can't be deployed. But if github were down for two months, the nature of git suggests that deployment for those many individual projects would shift either to the originators' infrastructure, or some other aggregating service.

This is true but very limited as well. GitHub isn't used for just git now, it's also an issue tracker, a wiki (yes, those are repos as well, but you don't usually have them sync'd), Github-only services (e.g. Travis), package managers (e.g. Cocoapods and Crates).

There is a lot riding on GitHub that developers use. Hell, even closed-source companies sometimes use empty GitHub repos so they can use Issues for openly available tracking.

Re: Pin-pointing China's attack against GitHub

#89

Post by smilekzs »

maxerickson wrote: post #45
simonh wrote: post #20

Earlier quoted context omitted.

This analysis doesn't just prove the attack orriginated in China, it shows that it takes place immediately inside the first Chinese network the connection reaches on it's way into China. The second piece of analysis shows that this is the same network layer in which the network blocking performed by the Great Firewall occurs. So the great firewall and this attack are both being implemented at the same point in the ne…

I think an interesting question is how likely it is that some of the great firewall is compromised. (It could be by some party outside of China, or by some group inside of the Chinese government that does not have an official mandate to use it for things like the Github attack)

Extremely unlikely. GFW is, ironically, considered "critical infrastructure" and is closely monitored.

Re: Pin-pointing China's attack against GitHub

#90

Post by smilekzs »

maxerickson wrote: post #45
simonh wrote: post #20

Earlier quoted context omitted.

This analysis doesn't just prove the attack orriginated in China, it shows that it takes place immediately inside the first Chinese network the connection reaches on it's way into China. The second piece of analysis shows that this is the same network layer in which the network blocking performed by the Great Firewall occurs. So the great firewall and this attack are both being implemented at the same point in the ne…

I think an interesting question is how likely it is that some of the great firewall is compromised. (It could be by some party outside of China, or by some group inside of the Chinese government that does not have an official mandate to use it for things like the Github attack)

Extremely unlikely. GFW is, ironically, considered "critical infrastructure" and is closely monitored.
Post reply on HN