Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

China's Man-On-the-Side Attack on GitHub

netresec.com

Post reply on HN
Print view View original

301–310 of 323 posts

Re: China's Man-On-the-Side Attack on GitHub

#301

Post by madez »

jmngomes wrote: post #273
codesuela wrote: post #271

Earlier quoted context omitted.

> As can be seen in the code, the two targeted URLs are github.com/greatfire and github.com/cn-nytimes, which are mirror sites for GreatFire.org and the Chinese New York Times. GreatFire and NYT both use GitHub to circumvent the online censorship performed by the Great Firewall of China (GFW).

I read that. Can someone shed some light over the motivation of the attacks?

Defending against an DoS-attack costs money. People try to spend as few money as possible.

So, the theory is that the attacker wants github to take the repos down by making it costly to not do so.

Re: China's Man-On-the-Side Attack on GitHub

#303

Post by comex »

jordanilchev wrote: post #299
comex wrote: post #283

Earlier quoted context omitted.

In this case, the problem with any kind of technical workaround on the server side is that Baidu is under the jurisdiction of the government implementing the DDoS and is thus unlikely to be able to actively work to defeat it. If another country tried to do the same... well, that's what HTTPS is for.

HTTPS is not secure when we talk about China it is false sense of security! Last case 7days ago: http://www.theregister.co.uk/2015/03/24/google_ssl_cnnic/

That's fairly off topic - I mentioned that HTTPS is somewhat irrelevant here since Baidu is located in China, and anyway a forged certificate could not be used in a mass attack like this one since the issuing CA would come to the attention of browser vendors rather quickly. For the record, hopefully Google's upcoming Certificate Transparency feature in Chrome will help address the general issue, although who knows what kind of adoption it will have in practice.

Re: China's Man-On-the-Side Attack on GitHub

#304

Post by acveilleux »

paraboul wrote: post #229
nailer wrote: post #224

Earlier quoted context omitted.

> Another is that you should never ever have any webpage configured to load any resources from a server hosted within China IP address space as it is vulnerable to this sort of attack by the Chinese government. Yep. Baidu are a NASDAQ listed company, while they may not be the malicious actor here, they still have a responsibility to ensure their networks are not used to attack others - which they don't seem to be tak…

Baidu network is not used. The response is altered as the trafic goes out of China. The only thing they can do is hosting http://hm.baidu.com in another country.

They probably should use a global, non-chinese CDN to avoid this. That and HSTS and HTTPS to pin certs.

Re: China's Man-On-the-Side Attack on GitHub

#305

Post by blar »

rmchugh wrote: post #207
valgaze wrote: post #125

Earlier quoted context omitted.

From the Sony pictures incident to the attack on that satirical magazine in Paris to this, it's getting pretty tiresome having to deal with authoritarian types who believe they should dictate what other people can say or access. For those curious, see below for a write up of the malicious javascript (uses a simple ajax call & random number timer): http://insight-labs.org/?p=1682 document.write(" http://libs.baidu.com…

Loading all of jQuery seems a little bit excessive when the only thing they're using is the $.ajax function. http://youmightnotneedjquery.com/#request

It's excessive if your goal is _solely_ to execute a repeating AJAX request. But, if I'm understanding the attack correctly, this script is injected _in place of_ jQuery requested from Baidu's CDN. If you want the affected sites to appear normal, so the users whose browsers you are highjacking will contribute to the DDOS for the longest possible period, then you want to ensure that jQuery does indeed load.

The OP further clarifies why jQuery is injected _twice_: seems the injection is occurring only for 1% of requests. So it appears the code is looking to see if it has triggered the injection itself, and fires another request if needed.

Re: China's Man-On-the-Side Attack on GitHub

#306

Post by mariojv »

liugiul wrote: post #288

So, fuck that. The Chinese gov are bullies, but now they're treading on my lawn (or the lawn where I host my things, and all other things of interest/importance). What can I do? I already block ad tracking code in my browser with µblock. Can I send an email to some English-speaking representative of the communist party telling them to fuck off, and that I'll make sure to chose things not Made in China from now on?

Ghostery blocks most analytics trackers: https://www.ghostery.com/en/

Google Analytics is blocked with that, I'd imagine Baidu Analytics would be blocked too. You can configure it to block / not block individual pieces.

Re: China's Man-On-the-Side Attack on GitHub

#307

Post by abalone »

peteretep wrote: post #197
abalone wrote: post #116

Earlier quoted context omitted.

The difference between the U.S. and China/Russia is that the people in China/Russia know the media is controlled by the powers that be. Here, our press is also "defined by the vision of the oligarchy and information is carefully controlled to produce a desired set of beliefs." We just believe that it's free. See: http://en.wikipedia.org/wiki/Manufacturing_Consent

No, the difference is that in the west you can access Russia Today ( http://www.rt.com ) and China Daily ( http://www.chinadaily.com.cn/en/ ), state-owned propaganda channels who delight in publishing anything that would make the U.S. look bad, and in China you can't access the NYT which helped break the Snowden stuff. The Guardian is owned by a trust who have legal obligations based on fair and balanced reporting, a…

The Snowden/NSA stuff doesn't fall outside of oligarchical perspectives. Tons of Silicon Valley companies for example, some of the most valuable in the world, are super anti domestic spying.

The U.S. media system vigorously debates stuff that falls within the elite spectrum of opinion. But on issues that fall outside of that it is quite propagandistic. In fact that vigorous debate masks the ultimate bias of it. For example, major media is usually very nationalistic about U.S. wars. There may be some debate about how costly they are (to us) but rarely over their morality. That's why you can hold up Snowden as an example, but not the U.S. wars in the Middle East.

Re: China's Man-On-the-Side Attack on GitHub

#308

Post by IndianAstronaut »

gnufied wrote: post #228
JohnTHaller wrote: post #57

Since the question of "why" and "how" is coming up again, here's a quick summary I posted on reddit: From a few different analysis on HN and elsewhere... Baidu has an analytics product and an ads product, much like Google Analytics and Google AdSense, which are used on all kinds of websites via Javascript. China has set the Great Firewall of China to modify some of Baidu's assets so that any non-Chinese IP gets a mod…

Wondering if Github has reported this to law enforcement agencies and knowing origin of attack - how will FBI etc proceed? Will we get a statement from administration itself on the lines of Sony hacking or trade relations are too big to endanger?

I have my doubts about the technical competency within the presidential administration(healthcare.gov for example). Such huge attacks would not take place if we had any effective retaliation and protection capacity.

Re: China's Man-On-the-Side Attack on GitHub

#309

Post by simonh »

colordrops wrote: post #293
simonh wrote: post #181

Earlier quoted context omitted.

If you want to publish your own newspaper, you can. Nobody will stop you. Start your own online video news service, weblog or nes site - nobody will stop you. Post whatever you like to Reddit, or any other discussion platform. In China and Russia you cannot do these things. Published mdeia are strictly monitored and censored. The state employs thousands of astroturfers to flood social media with pro-government messag…

I won't argue with you that China is far more repressive and less free than the US, because you are correct in that assertion. I only state that the US is far more _manipulative_.

The U.S. media has nothing on Russian state television, they are quite consciously part of the government propaganda machine. They don't hesitate to use material like photoshopped 'satelite pictures' of Ukrainian fighter jets shooting down that Malaysian airliner and present it as validated evidence. They have presented 'proof' that American soldiers are fighting in the Ukrainian army, and debate outrageous conspiracy theories straight faced. Fox News has absolutely nothing on those guys.

Re: China's Man-On-the-Side Attack on GitHub

#310

Post by cbsmith »

encoderer wrote: post #281
cbsmith wrote: post #196

Earlier quoted context omitted.

That's a fair point... Still, this is a read-based DoS. It should be fairly easy to mitigate with a CDN...

Putting a dynamic app like Github behind a CDN with page-caching just does not work. Sure they could freeze those projects and serve what is now essentially static HTML, but in day-to-day operations you're left using CDN products that let you serve static parts separately from dynamic parts, which is probably of dubious benefit during a DoS attack.

Github has got a bit of a read mostly situation. If read requests where funneled so that there was only one per URL per edge node at any given point in time (which edge side includes effectively gives you), it would make for pretty easy to manage load for Github.
Post reply on HN