Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub under ongoing DDoS attack

status.github.com

Post reply on HN
Print view View original

231–240 of 352 posts

Re: GitHub under ongoing DDoS attack

#231

Post by Buge »

blibble wrote: post #147
mike_hearn wrote: post #57

Earlier quoted context omitted.

SYN Flood is already mitigated a long time ago with SYN cookies. The rest ..... well, it's basically just packets. I see this latest development as good news. The Javascript MITM trick was very clever because forcing github to render and serve a page is a lot more resource consuming than just firing packets at servers that ignore them (like a UDP or SYN flood). The latter can saturate network links until the sources…

synflooding is not mitigated by syncookies. the attacker can encode information inside the packets in exactly the same way as the server, meaning they don't have to maintain any state, see: http://insecure.org/stf/tcpdos/outpost24-sect-sockstress.ppt (slide 18 onwards)

That's not a syn flood though. A syn flood is purely syns. So there is no need for the attacker to encode information if they are just doing a syn flood.

Re: GitHub under ongoing DDoS attack

#232

Post by danpalmer »

gbog wrote: post #153

Hi, foreigner working in Chinese high tech company here. I wonder a bit, on which ground is this attack attributed to Chinese gov? It looks a bit unlikely to me. China has some cyber military but they are more likely to be pragmatic and choose wisely their targets. There's a bunch of script kiddies but they would choose also something else. However it seems possible that many servers hosted in China are not secured a…

> China has some cyber military...

China has approximately 2 million people in its 'cyber army'. Not all of them are going to be experts, but sheer volume makes them probably the most effective 'cyber army' out there.

Re: GitHub under ongoing DDoS attack

#233

Post by snowwrestler »

golergka wrote: post #104

Can Github ask for US Government help with it, since it's an attack by [presumably] foreign sovereign entity? It's paying taxes in US, right — so it may expect some kind of protection, isn't this what taxes are about?

I would be shocked if the Feds were not helping GitHub in some capacity, and I would also be shocked if either GitHub or the Feds talked about that.

Re: GitHub under ongoing DDoS attack

#234

Post by weberc2 »

Qantourisc wrote: post #226
mckoss wrote: post #130

Earlier quoted context omitted.

"Bully" is rather too weak a label for the perpetrator. This attack is criminal. If carried out by a sovereign nation, perhaps an act of war. We don't allow foreign raiding parties to enter our country to loot private businesses. Neither should we treat this attack as a simple act of "bullying". GitHub should get the full support of federal law enforcement, if not the military.

We should never take up arms for a thread that has no human casualties, especially when there are alternatives. If your neighbour enter your home uninvited, because the door is not locked, the first thing you do is ask nicely not to do that. The next thing you do is lock the door. You don't start shooting at them first ...

This wouldn't be the first time China has hacked US-based organizations.

Re: GitHub under ongoing DDoS attack

#235

Post by aliakhtar »

rsuelzer wrote: post #172

From looking at the Javascript injection code ( http://www.theregister.co.uk/2015/03/27/github_under_fire_fr... ) it seems like the quality of the script is pretty amateur. They inject jQuery not once, but twice, and only use jQuery to make a simple XHR request. Perhaps they are worried about one instance of jQuery being taken down or made unavailable to them, but they really don't need jQuery at all for something th…

They might be using jquery because it abstracts away the quirks of different browsers (I seem to remember that old versions of firefox and IE had different APIs for making XHR requests).

Re: GitHub under ongoing DDoS attack

#236

Post by MichaelGG »

ramigb wrote: post #173

Each time i hear about DDoS attacks i wonder why we don't have serious effective mitigation strategies even though there are brilliant computer scientists out there who always come up with very smart solutions, this is a genuine question and not a rhetorical one.

Most of it comes down to shoving 10X traffic down a 1X pipe. You can write smart fast software, but if your wires are saturated...

There is one common problem, and that is that the major transit carriers/ISPs allow you to spoof your source IP. That allows some attacks to be done easier than otherwise. But that's more of a special case and doesn't matter when there is hijacking going on like in this attack.

Blocking attacks at the source is probably not a solution either, since you'd have to have a distributed way of getting filtering rules out to every ISP.

Re: GitHub under ongoing DDoS attack

#237

Post by LiweiZ »

seanmcdirmid wrote: post #49
jacquesm wrote: post #32

Earlier quoted context omitted.

> the government wants to cut us off from the rest of the world, that would make them happy Chinas ability to manufacture and sell hinges critically on internet connectivity. Of all the sanctions that would be effective I think an internet blockade is one of the more practical and effective ones.

I don't think they would be too concerned about an internet blockade, it would work to their advantage EVEN if it would hurt the economy and make a lot of the people's lives harder. That they could blame the "imperialist westerners" for this means that they can easily deflect any dissent outwards (as often happens in hard times...e.g. see the most recent anti-Japanese protests). Let's just please not go there.

Highly same-minded swarm at this size is very dangerous. The controller is using it for its own purpose. The best strategy might be waiting for the swarm loosing it's basic power supply and falling apart. But this would affect the world economy as well, especially after 2007.

Re: GitHub under ongoing DDoS attack

#238

Post by TazeTSchnitzel »

aliakhtar wrote: post #235
rsuelzer wrote: post #172

From looking at the Javascript injection code ( http://www.theregister.co.uk/2015/03/27/github_under_fire_fr... ) it seems like the quality of the script is pretty amateur. They inject jQuery not once, but twice, and only use jQuery to make a simple XHR request. Perhaps they are worried about one instance of jQuery being taken down or made unavailable to them, but they really don't need jQuery at all for something th…

They might be using jquery because it abstracts away the quirks of different browsers (I seem to remember that old versions of firefox and IE had different APIs for making XHR requests).

But in this case there are no meaningful browser differences:

  var tag = document.createElement('script');
  tag.src = 'https://github.com/greatfire/';
  document.body.appendChild(tag);
This works on any browser. Even IE6.

Re: GitHub under ongoing DDoS attack

#239

Post by TazeTSchnitzel »

rsuelzer wrote: post #172

From looking at the Javascript injection code ( http://www.theregister.co.uk/2015/03/27/github_under_fire_fr... ) it seems like the quality of the script is pretty amateur. They inject jQuery not once, but twice, and only use jQuery to make a simple XHR request. Perhaps they are worried about one instance of jQuery being taken down or made unavailable to them, but they really don't need jQuery at all for something th…

It's not even an XHR request. It's a JSONP-style insert--into-the-body "request".

The fact they used jQuery to do this is incredibly amateurish. Especially since they didn't seem to realise they could do the same trick with without creating an XSS vector.

Post reply on HN