Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

China's Man-On-the-Side Attack on GitHub

netresec.com

Post reply on HN
Print view View original

281–290 of 323 posts

Re: China's Man-On-the-Side Attack on GitHub

#281

Post by encoderer »

cbsmith wrote: post #196
cxseven wrote: post #169

Earlier quoted context omitted.

This won't work because it's browsers outside of China that are being hijacked when browsing Baidu Analytics-using sites.

That's a fair point... Still, this is a read-based DoS. It should be fairly easy to mitigate with a CDN...

Putting a dynamic app like Github behind a CDN with page-caching just does not work. Sure they could freeze those projects and serve what is now essentially static HTML, but in day-to-day operations you're left using CDN products that let you serve static parts separately from dynamic parts, which is probably of dubious benefit during a DoS attack.

Re: China's Man-On-the-Side Attack on GitHub

#282

Post by [deleted] »

EC1 wrote: post #90
arasmussen wrote: post #85

> China's Man-on-the-Side Attack on GitHub > and can conclude that China is using their active and passive network infrastructure China is a country that has 1.35B people in it. I guarantee you that 99.9% of those people had nothing to do with this attack. Can we stop using "China" and be more specific? It feels like it's blaming innocent people and possibly an entire innocent country. Chinese attackers? The Chinese…

Nobody is sitting here equating the word "China" with the entirety of the Chinese people.

[deleted]

Re: China's Man-On-the-Side Attack on GitHub

#283

Post by comex »

ethbro wrote: post #274
belorn wrote: post #264

Earlier quoted context omitted.

The takeaway from this attack is the same as we got from the Snowden disclosure: Nations will abuse network services that is located on their borders. They will hack-tap-and-steal, modify, block, and use any method available to distribute malware. Any action is viable so long there is a target to attack which could produce political, economical or military advantages. I suspect we will reach a point where treaties ar…

I like to grab old books at yard sales, and found this an interesting read (Arms Control Disarmament And National Security, 1961, https://archive.org/details/armscontroldisar013124mbp ). It's a collection of essays by various authors on a variety of arms control subjects. Everyone sees nuclear / Cold War negotiations in hindsight, but in 1961 (and probably also ~1950) the logic is much more interesting, given that th…

In this case, the problem with any kind of technical workaround on the server side is that Baidu is under the jurisdiction of the government implementing the DDoS and is thus unlikely to be able to actively work to defeat it. If another country tried to do the same... well, that's what HTTPS is for.

Re: China's Man-On-the-Side Attack on GitHub

#284

Post by GhotiFish »

gbog wrote: post #67
mraison wrote: post #10

I still don't really get it. What's the actual goal behind the attack? When the Chinese government decides to block a website, I can at least understand their motivations, as bad as they may be. But DDOSing Github just seems to be pissing the whole world off for a few hours without any actual long term consequences.

I'm working in a 100% Chinese high-tech company, and asked my colleagues: they think it is just a test (that was my first impression too).

What do they think China is testing?

Re: China's Man-On-the-Side Attack on GitHub

#286

Post by rsync »

JohnTHaller wrote: post #57

Since the question of "why" and "how" is coming up again, here's a quick summary I posted on reddit: From a few different analysis on HN and elsewhere... Baidu has an analytics product and an ads product, much like Google Analytics and Google AdSense, which are used on all kinds of websites via Javascript. China has set the Great Firewall of China to modify some of Baidu's assets so that any non-Chinese IP gets a mod…

"One takeaway is that you should always have a backup of your code and resources outside a single central site like github."

  ssh user@rsync.net "git clone git://github.com/freebsd/freebsd.git freebsd"
Done and done.

Re: China's Man-On-the-Side Attack on GitHub

#287

Post by rufugee »

If Baidu served everything over https, would that effectively make this attack impossible unless the China GFW mitm'd the connections? I suppose that might add a significant server load to Baidu, but I wonder if we should just start accepting SSL as a cost of doing business on the internet.

Of course, that would require Baidu's cooperation, and I suppose they might now want to raise the ire of the Chinese government. Also, I suppose the government could just use their own heavily trafficked sites to do this, but that should isolate it somewhat to Chinese IP ranges.

Re: China's Man-On-the-Side Attack on GitHub

#288

Post by liugiul »

So, fuck that. The Chinese gov are bullies, but now they're treading on my lawn (or the lawn where I host my things, and all other things of interest/importance).

What can I do? I already block ad tracking code in my browser with µblock. Can I send an email to some English-speaking representative of the communist party telling them to fuck off, and that I'll make sure to chose things not Made in China from now on?

Re: China's Man-On-the-Side Attack on GitHub

#289

Post by MikeTV »

rufugee wrote: post #287

If Baidu served everything over https, would that effectively make this attack impossible unless the China GFW mitm'd the connections? I suppose that might add a significant server load to Baidu, but I wonder if we should just start accepting SSL as a cost of doing business on the internet. Of course, that would require Baidu's cooperation, and I suppose they might now want to raise the ire of the Chinese government.…

Since the requests for hm.js are taking place over HTTP, even if Baidu started responding with 301's to reconnect over SSL wouldn't the GFW be able to just intercept the initial insecure request and respond with its own version of hm.js?

Re: China's Man-On-the-Side Attack on GitHub

#290

Post by javert »

nitrogen wrote: post #134
javert wrote: post #109

Earlier quoted context omitted.

Except that we have free speech in this country, so Fox can be, and is, heavily and freely criticized freely all the time. And because we have free speech, there are multiple alternatives that act as checks and balances across our culture as a whole. In other words, comparing Fox to the media situation in China or Russia is just ridiculous and irresponsible.

In other words, comparing Fox to the media situation in China or Russia is just ridiculous and irresponsible. The point of "comparing" anything to anything else is to see how the things are alike, and how they differ, as in "compare and contrast." If such comparisons are to be verboten, even if by stigma and not by fiat, then we are giving up an essential tool of understanding.

Let's look up definitions of compare.

https://www.google.com/search?q=define%3Acompare&ie=utf-8&oe...

I'm using it in a valid way, and not in the way you suggest, and it's clear from context which meaning I am using.

Post reply on HN