Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

China's Man-On-the-Side Attack on GitHub

netresec.com

Post reply on HN
Print view View original

251–260 of 323 posts

Re: China's Man-On-the-Side Attack on GitHub

#251

Post by fixermark »

downandout wrote: post #175
JohnTHaller wrote: post #57

Since the question of "why" and "how" is coming up again, here's a quick summary I posted on reddit: From a few different analysis on HN and elsewhere... Baidu has an analytics product and an ads product, much like Google Analytics and Google AdSense, which are used on all kinds of websites via Javascript. China has set the Great Firewall of China to modify some of Baidu's assets so that any non-Chinese IP gets a mod…

Since this is the technique they used, the browsers would have sent referring URLs as part of each request. When traffic begins to spike suspiciously, why not send a headless browser to each referrer, and if any code on the referrer results in automatic loading of the domain you're trying to protect, blacklist it. I'm guessing that the bulk of the requests were referred by a relatively small number of pages/domains,…

Unfortunately, the countermeasure for this sort of sniff already exists: the attacking referrer detects traffic from the victim's IP range and returns a sanitized copy of the content with the automatic loading logic removed. "Nothing to see here, officer."

It's a big programming task for a small processing task for a temporary payoff.

Re: China's Man-On-the-Side Attack on GitHub

#252

Post by downandout »

fixermark wrote: post #251
downandout wrote: post #175

Earlier quoted context omitted.

Since this is the technique they used, the browsers would have sent referring URLs as part of each request. When traffic begins to spike suspiciously, why not send a headless browser to each referrer, and if any code on the referrer results in automatic loading of the domain you're trying to protect, blacklist it. I'm guessing that the bulk of the requests were referred by a relatively small number of pages/domains,…

Unfortunately, the countermeasure for this sort of sniff already exists: the attacking referrer detects traffic from the victim's IP range and returns a sanitized copy of the content with the automatic loading logic removed. "Nothing to see here, officer." It's a big programming task for a small processing task for a temporary payoff.

There's nothing that says the headless requests would have to come from the victim's IP range. Any cloud service could be used. Also, since open source headless browsers already exist (phantomjs et al), it's a small programming task.

Re: China's Man-On-the-Side Attack on GitHub

#253

Post by muyuu »

mraison wrote: post #10

I still don't really get it. What's the actual goal behind the attack? When the Chinese government decides to block a website, I can at least understand their motivations, as bad as they may be. But DDOSing Github just seems to be pissing the whole world off for a few hours without any actual long term consequences.

It's hard to tell if this is a decision from high up in China's PRC ranks, or lower in the ranks, or even a false flag/experiment.

It highlights how XSS attacks can target arbitrary sites extremely efficiently, just by finding a strong vector origin point to deface (like Baidu's foreign filter JS).

Re: China's Man-On-the-Side Attack on GitHub

#254

Post by jader201 »

peterjmag wrote: post #239
JohnTHaller wrote: post #57

Since the question of "why" and "how" is coming up again, here's a quick summary I posted on reddit: From a few different analysis on HN and elsewhere... Baidu has an analytics product and an ads product, much like Google Analytics and Google AdSense, which are used on all kinds of websites via Javascript. China has set the Great Firewall of China to modify some of Baidu's assets so that any non-Chinese IP gets a mod…

Wouldn't it be awesome if GitHub somehow exposed issues / pull requests / etc as actual git repos for each project, like they do for wikis? Seems like that would mitigate much of the risk associated with centralized issue tracking. And yes, I'm aware that all the data is already accessible via their API, but that's not quite as easy to deal with as a simple "git clone". For now, perhaps something like https://backhub…

Yeah, I was thinking the same thing as your edit. Once GitHub makes it easier to become independent of them, then it... well, becomes easier to become independent of them.

Re: China's Man-On-the-Side Attack on GitHub

#255

Post by anon012012 »

im2w1l wrote: post #220
simonh wrote: post #181

Earlier quoted context omitted.

If you want to publish your own newspaper, you can. Nobody will stop you. Start your own online video news service, weblog or nes site - nobody will stop you. Post whatever you like to Reddit, or any other discussion platform. In China and Russia you cannot do these things. Published mdeia are strictly monitored and censored. The state employs thousands of astroturfers to flood social media with pro-government messag…

You can lose your job if you post too wrong views too much. EDIT: I don't understand the downvotes. It is both relevant (it refutes that you can "Post whatever you like to Reddit, or any other discussion platform." without punishment), and correct.

I think because it is more a consequence of human nature than governmental activity (though in some measure they're intertwined, and so it's hard to say objectively).

Re: China's Man-On-the-Side Attack on GitHub

#256

Post by facepalm »

UnoriginalGuy wrote: post #247
facepalm wrote: post #245

Earlier quoted context omitted.

I think you got it wrong. The Baidu analytics code is not on the pages that are on GitHub. It is all over the place, and the Great Firewall occasionally swaps it out for the malicious script. There is no malicious code on the GitHub pages.

You must have misread because they never said anything like what you're claiming they said here.

This is what they wrote:

In short, this is how this Man-on-the-Side attack is carried out:

An innocent user is browsing the internet from outside China.

One website the user visits loads a javascript from a server in China, for example the Badiu Analytics script that often is used by web admins to track visitor statistics (much like Google Analytics).

The web browser's request for the Baidu javascript is detected by the Chinese passive infrastructure as it enters China.

A fake response is sent out from within China instead of the actual Baidu Analytics script. This fake response is a malicious javascript that tells the user's browser to continuously reload two specific pages on GitHub.com.

Nowhere do they say that the script is only injected into the pages from GitHub.

Re: China's Man-On-the-Side Attack on GitHub

#257

Post by ithkuil »

nailer wrote: post #233
paraboul wrote: post #229

Earlier quoted context omitted.

Baidu network is not used. The response is altered as the trafic goes out of China. The only thing they can do is hosting http://hm.baidu.com in another country.

> The response is altered as the trafic goes out of China. By locating their network inside China, Baidu is allowing a malicious actor to leverage their network traffic - which indeed is a 'use' of Baidu's network. > The only thing they can do is hosting http://hm.baidu.com in another country. Most likely, yes. And until they do so, or come to another solution, their traffic should be blocked.

If their traffic gets blocked by other countries they could mitigate the revenue loss by having some capacity outside China and make sure that most accesses to their property coming from outside China goes to the servers hosted outside China (geo dns or anycast routing).

This would restore their analytics infrastructure functionality and avoid being exploited by their own government for such kinds of attack, while being justified as an infrastructure scalability concern (to avoid backslashes by the Chinese government).

Re: China's Man-On-the-Side Attack on GitHub

#258

Post by corford »

csteinbe wrote: post #235
corford wrote: post #154

Earlier quoted context omitted.

Baidu have not been hacked. Their servers reside inside the great firewall meaning any request from outside China has to traverse the GFW before arriving at Baidu's servers. During traversal of the GFW, the Chinese gov is modifying the Baidu server response with malicious javascript. Baidu has no say in the matter. They could try and help Github by swapping to only serving their analytics scripts over HTTPS. Even the…

For HTTP connections, is there a current best practice that a javascript author can use to make sure that their code hasn't been modified by a MitM prior to execution on the browser?

Use HTTPS. That's it. With HTTP any part of a web page's code can be altered/replaced by a MitM attack. So any theoretical protection a javascript author put in place to try and detect a MitM attack could also easily be circumvented.

Re: China's Man-On-the-Side Attack on GitHub

#259

Post by teamhappy »

nailer wrote: post #250
teamhappy wrote: post #240

Earlier quoted context omitted.

So what's the rule then? Block all packets coming out of countries with governments that do MITM attacks? Blame the companies for not locating their servers in other countries? Companies like GitHub? This is so hypocritical.

> So what's the rule then? Block all packets coming out of countries with governments that do MITM attacks? Block packets from any company that does not take reasonable steps to stop its network from being used to attack others. This has been networking rule for a long time. - We block open mail relays - we block hacked Windows XP machines - we should block a company who's in a hacked data center where their upstream…

I assumed you were talking about our governments when you said we. Who's stopping you from blocking whatever you want? Or from creating a public block list for that matter. You have to convince me to install it on my machines though. :P

Re: China's Man-On-the-Side Attack on GitHub

#260

Post by corford »

johnbellone wrote: post #188
corford wrote: post #154

Earlier quoted context omitted.

Baidu have not been hacked. Their servers reside inside the great firewall meaning any request from outside China has to traverse the GFW before arriving at Baidu's servers. During traversal of the GFW, the Chinese gov is modifying the Baidu server response with malicious javascript. Baidu has no say in the matter. They could try and help Github by swapping to only serving their analytics scripts over HTTPS. Even the…

It sounds like to me despite Baidu not being involved they are being used as a vector of attack. It seems reasonable for anyone using Baidu to find an alternative for all of their services. After seeing that China is modifying responses how can we trust any request that goes past the GFW?

>After seeing that China is modifying responses how can we trust any request that goes past the GFW

You can't unless it's an HTTPS request (and even then you may still want to be suspicious).

Post reply on HN