Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

China's Man-On-the-Side Attack on GitHub

netresec.com

Post reply on HN
Print view View original

51–60 of 323 posts

Re: China's Man-On-the-Side Attack on GitHub

#51

Post by carboncopy »

grandalf wrote: post #19
jewbacca wrote: post #4

Earlier quoted context omitted.

https://github.com/cn-nytimes/ and https://github.com/greatfire/ host information about and software for circumventing the Chinese government's internet censorship systems -- which, among many other things, blocks access to, eg, Google, and The New York Times. Apparently they (the Chinese government) are not willing to entirely block Github traffic in the same way (presumably as an important tool for their software i…

> information about and software for circumventing the Chinese government's internet censorship systems -- which, among many other things, blocks access to, eg, Google, and The New York Times. The actual impact of the attack was to have thousands of news outlets and discussion forum sites mention and link to the github repos that offer circumvention. Further, by attacking Github, it's guaranteed that many of the most…

I'm not sure why you are being downvoted; I think differing opinions are the heart of HN.

> so-called "official secrets" requiring security clearance granted by party members

It appears that you're not from the U.S. or another Western-aligned country, security clearances aren't granted to or by the dominant political parties, but are an artifact of government and military/defense industry bureaucracy.

Re: China's Man-On-the-Side Attack on GitHub

#53

Post by JohnTHaller »

taternuts wrote: post #49

Does baidu have any say in this at all? Were they hacked to include this script or they just passively allowed it?

The Great Firewall of China can be used to "weaponize" any website passing through it. So, it can be used to inject a malicious script on Baidu delivered to non-Chinese IPs (as we see here) or Chinese IPs. It can also be used to inject a malicious script into Google AdSense for Chinese IPs as well as China has control of a digital certificate provider accepted by all major browsers and operating systems. One they have issued SSL certificates that can be used to impersonate Google et al this year.

The bottom line is that, much like the matrix, everything within China is still part of that system and can be weaponized by the Chinese government. So, be sure you never have anything from within Chinese IP address space loaded by your web pages or apps.

Re: China's Man-On-the-Side Attack on GitHub

#54

Post by fragmede »

taternuts wrote: post #49

Does baidu have any say in this at all? Were they hacked to include this script or they just passively allowed it?

Various sources are reporting that Baidu says they haven't been hacked, but I'm having trouble finding their source.

eg, Ars - http://arstechnica.com/security/2015/03/github-battles-large...

Re: China's Man-On-the-Side Attack on GitHub

#55

Post by carboncopy »

chernevik wrote: post #44
jjcc wrote: post #35

Most people might not know what kind of organization GreatFire really is because too much context is missing. I only discovered recently it's not so simple. There have been a lot of talks about the behavior of GreatFire for quite for a while but most of the talks are in Chinese. There are some in English though, to give everybody a glimpse here is an example: https://github.com/greatfire/wiki/issues/1 I have an impre…

I'm sorry, what? Yes, it looks like Github has been pulled into a fight not entirely related to their initial mission. But that's how principle flows, you never know when the free flow of information will turn into a larger fight. I very much hope that they, and whatever networking partners they're working with, see this through. Because it's bullying bullshit by the Chinese government, trying to make people shut up…

I disagree that part of the mission of a for-profit organization includes responding to costly censorship measures from another country's government.

Github would lose significant respect by folding, but unless they're ultimately fighting the U.S. Government's censorship, they don't have a claim in this fight.

> that's how principle flows, you never know when the free flow of information will turn into a larger fight.

Sure, whenever chernevik claims you need to enter a fight, you need to take it ;)

Re: China's Man-On-the-Side Attack on GitHub

#56

Post by rsuelzer »

jfoutz wrote: post #41
jauer wrote: post #27

Earlier quoted context omitted.

At this point do they really have a option besides continue until Github caves because of mounting costs? Admitting whoops, unauthorized sneaky hackers co-opted our national packet mangling infrastructure would be a LOT of egg on their face.

That's a big freaking gamble. How effective does Github's mitigation need to be to make the costs tolerable? They're already using a full 1% of the traffic to ddos, they can only double that 7 times. Really, at this point Github could probably put together a really nice blacklist of baidu users outside of china, and whitelist those that actually use the service. I can think of a couple of cute ways to accelerate the…

Side question, does GitHub run ruby on rails? If so, I'm pretty impressed.

Re: China's Man-On-the-Side Attack on GitHub

#57

Post by JohnTHaller »

Since the question of "why" and "how" is coming up again, here's a quick summary I posted on reddit:

From a few different analysis on HN and elsewhere... Baidu has an analytics product and an ads product, much like Google Analytics and Google AdSense, which are used on all kinds of websites via Javascript. China has set the Great Firewall of China to modify some of Baidu's assets so that any non-Chinese IP gets a modified version of the Baidu analytics and ad code. The modification causes every web browser visiting a Chinese site using a Baidu analytics/ad product to load files from the greatfire and cn-nytimes projects on github (both of which are designed to circumvent Chinese government censorship) once every 2 seconds. The effect is that people all over the world outside of China are unwilling participants in a DDoS against github.

github has responded by taking both projects offline and replacing their content with a simple Javascript alert that shows a "WARNING: malicious javascript detected on this domain" messagebox. This causes the folks visiting baidu-infected sites to see the alert and know something is wrong with the website (hopefully not visiting it again). It also prevents the malicious Javascript from executing in a loop and reloading the site every 2 seconds.

One takeaway is that you should always have a backup of your code and resources outside a single central site like github. Another is that you should never ever have any webpage configured to load any resources from a server hosted within China IP address space as it is vulnerable to this sort of attack by the Chinese government.

Re: China's Man-On-the-Side Attack on GitHub

#58

Post by DSMan195276 »

jjcc wrote: post #35

Most people might not know what kind of organization GreatFire really is because too much context is missing. I only discovered recently it's not so simple. There have been a lot of talks about the behavior of GreatFire for quite for a while but most of the talks are in Chinese. There are some in English though, to give everybody a glimpse here is an example: https://github.com/greatfire/wiki/issues/1 I have an impre…

I donno, perhaps we're just reading the page differently (And of course, all the context that's in Chinese is lost on us), but I don't really see how GreatFire is using Github in a way that's not intended, as Github is used for lots of non-code repos and AFAIK that's never even been considered an issue. I think saying that they're trying to 'weaponize' github is arguable, but regardless the idea of putting the information they have on somewhere like Github, where making copies and distributing it is extremely easy makes a lot of sense from their standpoint. In addition, Github is nice and popular, meaning lots of people will see. Wikileaks did/does similar things, like posting torrents to large encrypted masses of data on places like Facebook, where lots of people will see it. When you consider they're trying to fight censorship, their actions make sense.

Re: China's Man-On-the-Side Attack on GitHub

#59

Post by dlgeek »

samlambert wrote: post #40
djent wrote: post #26

DDOS seems to be impacting me intermittently here in Rhode Island https://imgur.com/pW59MG3

Hi Djent, Would you mind sending an email to support@github.com with details on what you were doing when that happened? Thanks

It's happening for me constantly - just clicking the link from the discussion - I get a (very) slow page load, then the unicorn page. I'm assuming it's a timeout on the backend.

Re: China's Man-On-the-Side Attack on GitHub

#60

Post by carboncopy »

karcass wrote: post #45
j42 wrote: post #23

Earlier quoted context omitted.

Actually, someone here (who I cannot remember) said quite eloquently yesterday that our biggest export--and "influence" on the world--is culture. For the first time I realized that pissing people off may, in fact be the objective as the other reply stated. China and Russia are both (quite unique) examples of countries with an unfathomable degree of control over their citizens. It can be hard to grasp occasionally, co…

> the entire reality they see and what they believe to be true is heavily distorted--in that, it is defined by the vision of the oligarchy and information is carefully controlled to produce a desired set of beliefs. That's pretty much how I feel about the Fox-watching population of the US.

> That's pretty much how I feel about the Fox-watching population of the US.

I used to think the same thing, and to some degree I think it holds truth. But after spending lots of time with my right-wing family, I think it's a bit more nuanced than that. Most avid Fox News watchers I've met fail to embrace the entire world-view or vision promoted on the channel, and share maybe 60-70% of the opinions elicited toward viewers. I know, it's just one data point, but I don't have a study handy.

Post reply on HN