Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Great Cannon has been deployed again

cybersecurity.att.com

Post reply on HN
Print view View original

291–300 of 470 posts

Re: The Great Cannon has been deployed again

#291

Post by lonelappde »

arcticbull wrote: post #287
ghostly_s wrote: post #275

Earlier quoted context omitted.

I don't quite understand the mechanism after reading the article. Is the attacker (presumably the PRC) MITM'ing these CDN resources at the infrastructure level? If they had exploits in place within these CDNs (presumably within the PRC's capabilities) HTTPS wouldn't help, no?

More than likely they placed a phone call to Baidu and told them exactly what to do. I doubt it's a technological MITM probably just a social one. A totalitarian state can do that.

The article says only HTTP traffic is affected. If they subverted Baidu at the server side ,https traffic would likely be affected equally.

Re: The Great Cannon has been deployed again

#292

Post by lonelappde »

TheRealPomax wrote: post #267
upofadown wrote: post #218

Browsers really have to be a lot more skeptical about the code they run. Running code should not be able to randomly attack any IP address on the internet. Code from non-TLS pages should not be able to run at all. Perhaps that should also apply to code loaded from 3rd party sites. Connecting to a web page should not be consent to allow the operators of that web page to make my computer/phone do whatever they want on…

This sounds like a knee-jerk reaction that doesn't take into consideration the ramifactions of the suggested policy. It won't stop DDoS attacks, because those exist _because the internet exists_ and unless you dismantle the very concept of interconnected "everyone can reach everyone" networking, all you're doing is locking down access to more and more people until only technical experts or the people with enough mone…

That requires allowing web servers to blacklist all browsers known to allow http and therefore ddos....which is equivalent to banning http code.

Re: The Great Cannon has been deployed again

#293

Post by lonelappde »

smabie wrote: post #274
jMyles wrote: post #263

Earlier quoted context omitted.

> Unfortunately there's a giant category of devices that can't serve TLS. Like pretty much every consumer router in existence that you connect to through a webpage. Come on now. Of course those devices can use TLS - they just can't do so in the capricious constraints imposed by the system of "certificate authorities". It's not a fundamental limitation of the technology. If we were using something like noise protocol,…

I'm not familiar with this problem, could someone explain? Thanks!

There is no problem. Routers can use a self signed cert.

Re: The Great Cannon has been deployed again

#294

Post by arminiusreturns »

f38zf5vdt wrote: post #116
blackearl wrote: post #66

Earlier quoted context omitted.

According to the article, the attacks are currently ineffective for a number of reasons, one being their js code is bugged. Imagine Gavrillo Princip's gun was prone to jamming consistently.

This... actually inspires very little confidence. The assassination of the archduke involved several assassins who each failed iteratively for ridiculous reasons on the motorcade route. Princip himself had decided to give up on the assassination, only to find out the cafe he had gone to ended up being directly on the motorcade path. The serendipity of his proximity was probably the only reason Ferdinand ended up dead…

In reality it was the setup of the triple entente by Edward VII that was most responsible for the WWs. The archduke may have been the match, but the triple entente was the detcord strung around Europe.

Re: The Great Cannon has been deployed again

#295

Post by wutbrodo »

_red wrote: post #192
chewbacha wrote: post #161

Earlier quoted context omitted.

I don't know who to attribute this to but I've heard a saying: "Countries that trade with each other don't make war with each other." As we isolate countries and disrupt trade we definitely are increasing the risk of conflict.

Yes, who cares about the forced labor camps and suicide nets around factories. I want my cheap plastic consumer devices!!

> suicide nets around factories

Foxconn's suicide rate is lower than China's, along with all 50 US states. They just employ a gargantuan amount of people (400k). I don't know much about the working conditions there, so I don't have a position, but it doesn't look like there's evidence to suggest that the working conditions have anything to do with the fact that some of their employees committed suicide.

To put it another way, there's roughly as much evidence of this as there is that working in a factory in Nigeria causes sickle cell anemia.

Re: The Great Cannon has been deployed again

#296

Post by lonelappde »

Despegar wrote: post #262
saagarjha wrote: post #226

Earlier quoted context omitted.

> Running code should not be able to randomly attack any IP address on the internet. How would you prevent this? What constitutes an "attack", and how would you make sure you're not interfering with non-malicious use cases?

JavaScript was a mistake

This is a network protocol flaw not a language flaw

Re: The Great Cannon has been deployed again

#297

Post by DyslexicAtheist »

lonelappde wrote: post #291
arcticbull wrote: post #287

Earlier quoted context omitted.

More than likely they placed a phone call to Baidu and told them exactly what to do. I doubt it's a technological MITM probably just a social one. A totalitarian state can do that.

The article says only HTTP traffic is affected. If they subverted Baidu at the server side ,https traffic would likely be affected equally.

I understood it so that if things escalate what would stop them from simply serving malware from Baidu. If CN sees these actors as an attack on their freedom and autonomy to shape internal policy then they could easily justify this (at least to themselves).

Re: The Great Cannon has been deployed again

#299

Post by ehsankia »

upofadown wrote: post #218

Browsers really have to be a lot more skeptical about the code they run. Running code should not be able to randomly attack any IP address on the internet. Code from non-TLS pages should not be able to run at all. Perhaps that should also apply to code loaded from 3rd party sites. Connecting to a web page should not be consent to allow the operators of that web page to make my computer/phone do whatever they want on…

Each individual user isn't doing that much, just loading an asset from another site, which is fairly inconspicuous. It's when billions of users start doing it that it becomes a problem (the first D in DDoS), but any individual person isn't doing anything out of the ordinary.

Re: The Great Cannon has been deployed again

#300

Post by jiofih »

DyslexicAtheist wrote: post #254

This should be mitigated by browser vendors by integrating HTTPSEverywhere as a core functionality of the browser that needs to be explicitly turned off (instead of the current state of affairs where we have a tiny minority on the web who are familiar with installing security add-ons). Visiting a HTTP site should come with a scary warning. I understand this throws old sites under the bus, but there could be other sol…

I fail to see how this attack has anything to do with http? The scripts can be served over https no problem, it’s the host that is compromised. Maybe you’re thinking of sub-resource integrity attributes?
Post reply on HN