4 ms·

How would a non-government entity achieve this?

• riffraff 7y ago
  pwn a couple ad servers and service the poisoned js. It doesn't seem something that a dedicated malicious hacker group couldn't do.
  • rndgermandude 7y ago
    Except that's not what's happening here, unless your claim is they compromised baidu and Qihoo 360 and both don't care to fix it. baidu and Qihoo 360 are massive companies. Serving the stuff either means they are doing it deliberately (on behalf of the government), or an active MITM is doing it, which given the scale can only mean ISP and ergo (since this is China) government level. The active MITM seems plausible since a) only unencrypted http traffic gets injected (so far), and b) the Chinese government wouldn't want to put the onus on two of their most important internet companies alone.
    • JCharante 7y ago
      Baidu could be doing it only to http traffic to make people think it's the government... But I can't imagine that they would want to seem as if they're putting words in the government's mouth.