Slashdot Mirror
Github DDoS Attack As Seen By Google
New submitter opensec writes: Last month GitHub was hit by a massive DDoS attack originating from China. On this occasion the public discovered that the NSA was not the only one with a QUANTUM-like capability. China has its own "Great Cannon" that can inject malicious JavaScript inside HTTP traffic. That weapon was used in the GitHub attack. People using Baidu services were unwitting participants in the denial of service, their bandwidth used to flood the website. But such a massive subversion of the Internet could not evade Google's watchful eye. Niels Provos, engineer at Google, tells us how it happened. Showing that such attacks cannot be made covertly, Provos hopes that the public shaming will act as a deterrent.
Teh G!
I'll love seeing how that works out. Their people are locked behind their firewall and don't get to see any criticism the government doesn't want them to see. Hell you can't even get politicians here shamed if the media doesn't do a full bore dog pile.
I sometimes work in some shared office space. I'm there to work on my PhD thesis, but a lot of the other people there are Ruby on Rails hipsters. The stereotypes about these people are true. They do wear fedoras, they do speak negatively of women, they are very opinionated, and pretty much none of them have any formal education (a number of them are even high school dropouts). Anyway, you wouldn't believe how angry these people got when this GitHub DDoS nonsense broke. They were actually screaming and yelling about it. Some of them were probably close to foaming at the mouth with anger, they were so displeased. I started to realize that Git and GitHub aren't just tools to these people. Git and GitHub have replaced religion for these folks. Maybe they don't worship Jesus or Allah, but they do worship Git and GitHub. It was kind of unnerving to see how seriously they take Git and GitHub, and it was disturbing to see how much anger this DDoS crap brought out in them.
Nothing escapes the watchful eye of Sauron.
You can't shame the (mainland) Chinese government on this one. They were fairly overt about it by using their own govt search engine to do it. It's a scarcely veiled threat to anyone who might want to mess with them, like doing an atomic bomb test or running your aircraft carriers around in sensitive regions. I'm sure they welcome the extra publicity.
>Will China get the message ?
What message? The one it has been getting forever, the one that says "we know it's you, but we're never going to do anything about it because we rely on you for cheap everything"?
Github is really not very good. We could probably do with it being crushed for awhile to allow competitors to rise. This would increase the ecosystem for dev tools and be very beneficial overall as github has become the basket with all eggs in it.
Cyber attacks by China are easy to fix; give them exactly what they want and cut them off the Internet. Problem solved.
The website operators have little ability stop these attacks but those controlling the Internet infrastructure between the attacker and victim absolutely do. Once the attacker is identified there should be procedures to quickly block the attack. If that means taking an entire country off the Internet to encourage them to stop the attack and not do it again in the future that is perfectly reasonable action.
Niels Provos - when not fighting [cyber]crime, he's forging a mean sword: https://www.youtube.com/user/m...
1% APY, No fees, Online Bank https://captl1.co/2uIErYq Don't let your $$$ sit in a no-interest acct.
I see what you did there.
-Rick
"Most people in the U.S. wouldn't know they live in a tyrannical state if it walked up and grabbed their junk." - MyFirs
How about democratic nations around the world sign a treaty not to pull this kind of shit. In that treaty, they also agree to block network backbone access for 30 days to bad actor nations to bitch slap them into not doing it either. China needs the internet, filtered or not, a lot more than the rest of the world needs them to have it. If they want to act like a gradeschool bully on the web, maybe it is time we kicked them off the playground for a month. Let their economy spiral down the toilet and see if they are willing to pull this crap again. The internet is integral to everything from business email, VOIP phone connections to financial transactions. To use it as a weapon is to poison the well and countries that do this, especially without provocation or justification, don't deserve the benefits of the internet. Even N Korea suffered when they lost their backbone connection after the whole Sony attack, and they rely on the internet a lot less than China's growing economy.
It's not much of a stretch for any computer science student or IT workers to even be able to grasp the howtos of doing this. The only way to scale this up is to sit on a nexus point for any comms.
So why wouldn't anyone just do this. It's simple - commerce. Barring targetted insertions, ( hello anonymity ), any large use of this would result in sanctions of some sort. Which is why as everyone else shows off their grandstanding canons, this does not bode well for economies that depend on both.
... instead of the shitty ad-filled blog
http://googleonlinesecurity.bl...
A little bit of finesse and you can cause a massive loss of face. That will get a chinaman's attention.
Prove anything by multiplying Huge Number times Tiny Number
Sure, the US needs enemies but this is not the case of faking enemy action. This attack was easily traced to Chines devices which were injecting Javascript into HTML files, resulting in a massive DDOS. The servers performing this were part of the Chinese version of Google, which returned contaminated cache pages to queries.
Call me a skeptic, but I don't think the injections were limited to the cache servers Google names. I think this was done at a lower level to achieve the scale. The reason for the attack is somewhat of a mystery as well. China can just block Github, they don't need to DDOS.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
Shaming "western" governments/agencies doesn't have any effect at all, why would anyone think thank shaming Chinese would be any different?
This is why every website should be on HTTPS.
No more Javascript injection by the network.
New things are always on the horizon
Really,
As the saying goes, a thief is going to steal if he really wants to.... public shaming, if not for a logic result (e.g. child porn) will backfire and usually makes situations worse: person develop a tolerance for it.
If technology is so advanced, why do Americans need cyber security bills to ensure companies share information?
Like your propaganda over theirs. We should hook up some time.