China's Man-On-the-Side Attack on GitHub • Hacker News Board

Re: China's Man-On-the-Side Attack on GitHub

#31

Post by e79 » Tue, Mar 31, 2015, 3:42 AM UTC

I wonder how GitHub mitigated the attack so successfully. I can't find any baidu scripts using the injected code anymore (in fact the original tracking scripts on baidu's own domain return nothing), and GitHub is now serving the two repos that were originally targeted.

What happened? Whatever it is, I'm glad they were able to mitigate the attacks.

Re: China's Man-On-the-Side Attack on GitHub

#32

Post by dmfdmf » Tue, Mar 31, 2015, 3:45 AM UTC

_xnmw wrote: post #15

mraison wrote: post #10

I still don't really get it. What's the actual goal behind the attack? When the Chinese government decides to block a website, I can at least understand their motivations, as bad as they may be. But DDOSing Github just seems to be pissing the whole world off for a few hours without any actual long term consequences.

Who said this would only be for a few hours? DDOSing Github drives up their hosting costs massively, creating a financial incentive to comply with China's demands. Aside from that, it's just Eastern politics, which works by a whole lot of bullying and childish tactics when they don't get their way. Not to say that it doesn't happen in Western politics, just much more subtly. And it doesn't seem so bad since we're the…

> And it doesn't seem so bad since we're the good guys.

Post-Snowden, check your premises.

Re: China's Man-On-the-Side Attack on GitHub

#33

Post by Rogerh91 » Tue, Mar 31, 2015, 3:46 AM UTC

Github should have a huge call-to-action banner for every China-based web visitor that leads to this article translated into Mandarin.

Xi Jinping Millionaire Relations Reveal Fortunes of Elite

http://www.bloomberg.com/news/articles/2012-06-29/xi-jinping...

Maybe add a Trollface gif while they're at it.

Re: China's Man-On-the-Side Attack on GitHub

#34

Post by est » Tue, Mar 31, 2015, 3:46 AM UTC

Well, that's a good analysis article and a good promotion for CapLoader.

Wireshark indeed can do better on Gantt charts and graphs

Re: China's Man-On-the-Side Attack on GitHub

#35

Post by jjcc » Tue, Mar 31, 2015, 3:48 AM UTC

Most people might not know what kind of organization GreatFire really is because too much context is missing. I only discovered recently it's not so simple. There have been a lot of talks about the behavior of GreatFire for quite for a while but most of the talks are in Chinese. There are some in English though, to give everybody a glimpse here is an example: https://github.com/greatfire/wiki/issues/1

I have an impression is GreatFire tried to weaponize all the users of github. They succeeded.

I don't like the GFW either. But I think I'm very likely to be downvoted because the context of this incident is quite complicated. It's not easy to tell the truth especially when it's against most people's belief.

Re: China's Man-On-the-Side Attack on GitHub

#36

Post by clippit » Tue, Mar 31, 2015, 3:48 AM UTC

e79 wrote: post #31

I wonder how GitHub mitigated the attack so successfully. I can't find any baidu scripts using the injected code anymore (in fact the original tracking scripts on baidu's own domain return nothing), and GitHub is now serving the two repos that were originally targeted. What happened? Whatever it is, I'm glad they were able to mitigate the attacks.

The injection has been stopped and Baidu's script checks if there exists a referer.

Re: China's Man-On-the-Side Attack on GitHub

#37

Post by pilgrim689 » Tue, Mar 31, 2015, 3:49 AM UTC

This is a really well article outlining how the man-on-the-side attack on Baidu is carried out. The only flaw here is the logical leap that goes from "Baidu is being hijacked" to "Baidu is being hijacked by the Chinese government"

Re: China's Man-On-the-Side Attack on GitHub

#38

Post by riscy » Tue, Mar 31, 2015, 3:52 AM UTC

"Our analysis shows that only about 1% of the requests for the Baidu Analytics script are receiving the malicious javascript as response. So in 99% of the cases everything behaves just like normal."

The way I see it, this has been a diagnostic test by the Chinese government, ensuring they have the power to globally take down any website (or servers) they please.

Re: China's Man-On-the-Side Attack on GitHub

#39

Post by stingraycharles » Tue, Mar 31, 2015, 3:53 AM UTC

Rogerh91 wrote: post #33

Github should have a huge call-to-action banner for every China-based web visitor that leads to this article translated into Mandarin. Xi Jinping Millionaire Relations Reveal Fortunes of Elite http://www.bloomberg.com/news/articles/2012-06-29/xi-jinping... Maybe add a Trollface gif while they're at it.

... which is probably blocked for every China-based web visitor anyway.

Re: China's Man-On-the-Side Attack on GitHub

#40

Post by samlambert » Tue, Mar 31, 2015, 3:56 AM UTC

djent wrote: post #26

DDOS seems to be impacting me intermittently here in Rhode Island https://imgur.com/pW59MG3

Hi Djent,

Would you mind sending an email to support@github.com with details on what you were doing when that happened?

Thanks