5 ms·

This should be mitigated by browser vendors by integrating HTTPSEverywhere as a core functionality of the browser that needs to be explicitly turned off (instea

This should be mitigated by browser vendors by integrating HTTPSEverywhere as a core functionality of the browser that needs to be explicitly turned off (instead of the current state of affairs where we have a tiny minority on the web who are familiar with installing security add-ons). Visiting a HTTP site should come with a scary warning. I understand this throws old sites under the bus, but there could be other solutions here such as restricting 3d party resources as a second layer defense once the user clicks through the first warning to access the HTTP content. and in case I'm totally wrong, what mitigations are feasible? More trade war such as by compelling ISP's to null-route Chinese businesses like Baidu.com as a form of sanction?

ghostly_s 7y ago
I don't quite understand the mechanism after reading the article. Is the attacker (presumably the PRC) MITM'ing these CDN resources at the infrastructure level? If they had exploits in place within these CDNs (presumably within the PRC's capabilities) HTTPS wouldn't help, no?
- arcticbull 7y ago
  More than likely they placed a phone call to Baidu and told them exactly what to do. I doubt it's a technological MITM probably just a social one. A totalitarian state can do that.
  - DyslexicAtheist 7y ago
    that's why probably null routing at ISP level is more likely. the time it takes to adapt to new defenses is much less than what it takes to come to an agreement in cabforum. When things escalate nobody will push vendors to agree on new security features when a blunt instrument like legislation is cheaper. If things escalate they'll just sinkhole all traffic going in and out of China.
  - lonelappde 7y ago
    The article says only HTTP traffic is affected. If they subverted Baidu at the server side ,https traffic would likely be affected equally.
    - DyslexicAtheist 7y ago
      I understood it so that if things escalate what would stop them from simply serving malware from Baidu. If CN sees these actors as an attack on their freedom and autonomy to shape internal policy then they could easily justify this (at least to themselves).
DyslexicAtheist 7y ago
just for good measure: sudo echo -e "\n\n# Null route the Great Cannon:\n0.0.0.0 baidu.com\n0.0.0.0 qihucdn.com\n" | tee /etc/hosts ... but I know I'm only fooling myself.
- nothrabannosir 7y ago
  (I strongly recommend tee -a :) as well as putting the sudo before the tee).
  - DyslexicAtheist 7y ago
    :) thanks (I admit didn't test it because I use `python3 ./updateHostsFile.py` to take care of /etc/hosts)
  - iotku 7y ago
    Notable reason (for those unfamiliar) is that tee will overwrite the file unless given the -a argument which will append the input to the end of the file.
JoshTriplett 7y ago
> Visiting a HTTP site should come with a scary warning Browsers are already moving to explicitly label HTTP sites as "not secure"
jiofih 7y ago
I fail to see how this attack has anything to do with http? The scripts can be served over https no problem, it’s the host that is compromised. Maybe you’re thinking of sub-resource integrity attributes?
- RL_Quine 7y ago
  The cannon is injected into HTTP resources.
  - onesmallcoin 7y ago
    In most javascript sandboxes if you request a domain from an site you are restricted by the same content policy. This makes it harder to do things like make requests to sites for example that don't use https when your on one that does use it. https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy https://developer.mozilla.org/en-US/docs/Web/Security/Same-o...
- nihonium 7y ago
  It's injecting the malicious script into the source of http pages. With httpS, this is not possible unless you also change the root certificate of the computer.
- Ruthalas 7y ago
  From the article : "Mitigations These attacks would not be successful if the following resources were served over HTTPS instead of HTTP: http://push.zhanzhang.baidu.com/push.js; http://push.zhanzhang.baidu.com/push.js; orhttp://js.passport.qihucdn.com/11.0.1.js http://js.passport.qihucdn.com/11.0.1.js You may want to consider blocking these URLs when not sent over HTTPS."
randyrand 7y ago
I think China's government requires websites to give them their private keys. HTTPS is useless then.
- throw0101a 7y ago
  Not with (perfect) forward security: > In cryptography, forward secrecy (FS), also known as perfect forward secrecy (PFS), is a feature of specific key agreement protocols that gives assurances that session keys will not be compromised even if the private key of the server is compromised.[1] Forward secrecy protects past sessions against future compromises of secret keys.[2][3][3] * https://en.wikipedia.org/wiki/Forward_secrecy https://en.wikipedia.org/wiki/Forward_secrecy There's still the risk of MITM identity spoofing of course.
  - oconnor663 7y ago
    Forward secrecy only helps you if the server private key is comprised in the future. If it's compromised already, and an active attacker can modify traffic between you and the server, forward secrecy doesn't help. Ultimately, if an attacker has all your keys and controls all your traffic, there's nothing left that distinguishes the attacker from you. No security is possible in that scenario.
- turk73 7y ago
  I suspect my company is MITM-ing SSL, so China is here Jack.
- gruez 7y ago
  And what do you think happens to sites caught serving malware? They get put on safebrowsing blacklists. That problem solves itself.
  - giggles_giggles 7y ago
    If the Chinese government wants to man in the middle traffic to foreign sites they can just force PC vendors to install a CCP controlled CA root on systems and make it illegal and/or very difficult to remove it. Shit, they can require vendors include a hardware backdoor, especially since so much of that hardware is produced domestically. Then they can view the traffic even going to and from foreign sites who would not comply with an order to share private keys and no safe browsing blacklist (like that would be accessible from inside the regime anyway) will help you.
CharlesColeman 7y ago
> This should be mitigated by browser vendors by integrating HTTPSEverywhere as a core functionality of the browser that needs to be explicitly turned off (instead of the current state of affairs where we have a tiny minority on the web who are familiar with installing security add-ons). We're talking about China, so that's probably not going to work: Chinese users are using Chinese browsers [1] to access Chinese websites. I don't think Chinese browser-makers and website operators are going to take action against their government like that. [1] https://www.fastcompany.com/3058432/the-top-3-web-browsers-in-china-leave-users-vulnerable-report-says https://www.fastcompany.com/3058432/the-top-3-web-browsers-i...
- DyslexicAtheist 7y ago
  sure. but that would still limit the attack to only come from within CN (and possibly users outside with a CN browser) and not from every potential user who has Safari/Mozilla/Chrome. It would mitigate attacks from inside China against outside entities, which for somebody not based in China is all I want.
- gruez 7y ago
  That's fine. If the Chinese government wants to commandeer their own citizen's resources to DDoS other people, that's on them. They could very well also direct their state controlled ISPs to do the same. Doing either would be obviously be attributed to them and would be cause for them to be de-peered - solving the problem.
- mlyle 7y ago
  The concern here is people using Chinese websites abroad. The Great Cannon rewrites javascript for a subset of remote users visiting Chinese sites, causing the users' browsers to participate in a DDoS against a target.
LeftHandPath 7y ago
I recently (4 or 5 months ago) joined an online community of aircraft owners and pilots that is primarily focused around a single brand of aircraft (although it's not an official site of, property of, that brand nor is it endorsed by that brand). When I signed up, they emailed me to welcome me to the site (they actually require manual authorization of users by an admin, which is... refreshing, but uncommon). The email ended by stating that if I lost my password, they could "recover it" and send it back to me. I raised a thread about it in one of their off-topic sections, and got harassed - "How secure do you need your browsing to be?" (And hey, I mean, I was asking them to do more work) But it stands out that most of the public doesn't know, and doesn't care to know. Even a site that's populated by people with net worths and/or incomes that average in the six-to-seven figure range, that they probably signed up for with the same email address and password that they use for their bank and brokerage accounts. HTTP should come with a warning. Furthermore, it would be fan-fucking-tastic if there was some generalizable way to (automatically) audit a website's security practice. Like, a crawler that just runs standard OWASP-style attack-vector checks, and sends an email to the site's owners when one succeeds. And then put that data into a database and warn users (with a browser plugin) when they are creating credentials for sites with bad security.
- brentonator 7y ago
  I'd recommend using an OpenID Connect provider to authenticate if you're concerned about their practices but it's just as easy to improperly implement auth even with mainstream libraries to help you connect something like Auth.0 to your app. e.g. Don't assume the email address is owned by the person making the claim. You can sign up for an account with an email and if it's not verified or the verification is mis-clicked or phished into being clicked the original account owner would never know the difference. Still, at least with OpenID Connect you know your password isn't sitting in plain text.
  - unilynx 7y ago
    Are there any sites that accept OpenID but that you still suspect of poor password/auth practices?
- 7y ago
flattone 7y ago
surprised the relevant powerful/time tested and highly technical participants at whichever appropriate layer of networking aren't just forcing https only. #studentquestion
gruez 7y ago
>and in case I'm totally wrong, what mitigations are feasible? More trade war such as by compelling ISP's to null-route Chinese businesses like Baidu.com as a form of sanction? A slightly less broad measure that's just as effective would be to block unencrypted http traffic from entering China. Want to get unblocked? Get letsencrypt. A even better (but slightly greyhat) route would be to inject HSTS headers with the maximum expiry date. This will cause any visitor's browsers to get "infected" with an unskippable warning, forcing them to upgrade no matter what.
DyslexicAtheist 7y ago
for anyone interested, Brian Krebs did an excellent article[1] on The Great Cannon after the Citizen Labs incident. > [Nicholas] Weaver said the attacks from the Great Cannon don’t succeed when people are browsing Chinese sites with a Web address that begins with "https://" https://", meaning that regular Internet users can limit their exposure to these attacks by insisting that all Internet communications are routed over "https" versus unencrypted "http://" http://" connections in their browsers. A number of third-party browser plug-ins — such as https-everywhere — can help people accomplish this goal. > But Bill Marczak, a research fellow with Citizen Lab, said relying on an always-on encryption strategy is not a foolproof counter to this attack, because plug-ins like https-everywhere will still serve regular unencrypted content when Web sites refuse to or don’t offer the same content over an encrypted connection. What’s more, many Web sites draw content from a variety of sources online, meaning that the Great Cannon attack could succeed merely by drawing on resources provided by online ad networks that serve ads on a variety of Web sites from a dizzying array of sources. [1] https://krebsonsecurity.com/2015/04/dont-be-fodder-for-chinas-great-cannon/ https://krebsonsecurity.com/2015/04/dont-be-fodder-for-china...
inimino 7y ago
I posted a top-level comment[1], but basically HTTPS-only, aside from throwing old sites under the bus, would not have helped. [1] https://news.ycombinator.com/item?id=21726617 https://news.ycombinator.com/item?id=21726617 > and in case I'm totally wrong, what mitigations are feasible? More trade war such as by compelling ISP's to null-route Chinese businesses like Baidu.com as a form of sanction? Probably something like this, but I'm afraid of where that would lead.

ghostly_s 7y ago

I don't quite understand the mechanism after reading the article. Is the attacker (presumably the PRC) MITM'ing these CDN resources at the infrastructure level? If they had exploits in place within these CDNs (presumably within the PRC's capabilities) HTTPS wouldn't help, no?

arcticbull 7y ago
More than likely they placed a phone call to Baidu and told them exactly what to do. I doubt it's a technological MITM probably just a social one. A totalitarian state can do that.
- DyslexicAtheist 7y ago
  that's why probably null routing at ISP level is more likely. the time it takes to adapt to new defenses is much less than what it takes to come to an agreement in cabforum. When things escalate nobody will push vendors to agree on new security features when a blunt instrument like legislation is cheaper. If things escalate they'll just sinkhole all traffic going in and out of China.
- lonelappde 7y ago
  The article says only HTTP traffic is affected. If they subverted Baidu at the server side ,https traffic would likely be affected equally.
  - DyslexicAtheist 7y ago
    I understood it so that if things escalate what would stop them from simply serving malware from Baidu. If CN sees these actors as an attack on their freedom and autonomy to shape internal policy then they could easily justify this (at least to themselves).

DyslexicAtheist 7y ago

just for good measure: sudo echo -e "\n\n# Null route the Great Cannon:\n0.0.0.0 baidu.com\n0.0.0.0 qihucdn.com\n" | tee /etc/hosts ... but I know I'm only fooling myself.

nothrabannosir 7y ago
(I strongly recommend tee -a :) as well as putting the sudo before the tee).
- DyslexicAtheist 7y ago
  :) thanks (I admit didn't test it because I use `python3 ./updateHostsFile.py` to take care of /etc/hosts)
- iotku 7y ago
  Notable reason (for those unfamiliar) is that tee will overwrite the file unless given the -a argument which will append the input to the end of the file.

JoshTriplett 7y ago

> Visiting a HTTP site should come with a scary warning Browsers are already moving to explicitly label HTTP sites as "not secure"

jiofih 7y ago

I fail to see how this attack has anything to do with http? The scripts can be served over https no problem, it’s the host that is compromised. Maybe you’re thinking of sub-resource integrity attributes?

RL_Quine 7y ago
The cannon is injected into HTTP resources.
- onesmallcoin 7y ago
  In most javascript sandboxes if you request a domain from an site you are restricted by the same content policy. This makes it harder to do things like make requests to sites for example that don't use https when your on one that does use it. https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy https://developer.mozilla.org/en-US/docs/Web/Security/Same-o...
nihonium 7y ago
It's injecting the malicious script into the source of http pages. With httpS, this is not possible unless you also change the root certificate of the computer.
Ruthalas 7y ago
From the article : "Mitigations These attacks would not be successful if the following resources were served over HTTPS instead of HTTP: http://push.zhanzhang.baidu.com/push.js; http://push.zhanzhang.baidu.com/push.js; orhttp://js.passport.qihucdn.com/11.0.1.js http://js.passport.qihucdn.com/11.0.1.js You may want to consider blocking these URLs when not sent over HTTPS."

randyrand 7y ago

I think China's government requires websites to give them their private keys. HTTPS is useless then.

throw0101a 7y ago
Not with (perfect) forward security: > In cryptography, forward secrecy (FS), also known as perfect forward secrecy (PFS), is a feature of specific key agreement protocols that gives assurances that session keys will not be compromised even if the private key of the server is compromised.[1] Forward secrecy protects past sessions against future compromises of secret keys.[2][3][3] * https://en.wikipedia.org/wiki/Forward_secrecy https://en.wikipedia.org/wiki/Forward_secrecy There's still the risk of MITM identity spoofing of course.
- oconnor663 7y ago
  Forward secrecy only helps you if the server private key is comprised in the future. If it's compromised already, and an active attacker can modify traffic between you and the server, forward secrecy doesn't help. Ultimately, if an attacker has all your keys and controls all your traffic, there's nothing left that distinguishes the attacker from you. No security is possible in that scenario.
turk73 7y ago
I suspect my company is MITM-ing SSL, so China is here Jack.
gruez 7y ago
And what do you think happens to sites caught serving malware? They get put on safebrowsing blacklists. That problem solves itself.
- giggles_giggles 7y ago
  If the Chinese government wants to man in the middle traffic to foreign sites they can just force PC vendors to install a CCP controlled CA root on systems and make it illegal and/or very difficult to remove it. Shit, they can require vendors include a hardware backdoor, especially since so much of that hardware is produced domestically. Then they can view the traffic even going to and from foreign sites who would not comply with an order to share private keys and no safe browsing blacklist (like that would be accessible from inside the regime anyway) will help you.

CharlesColeman 7y ago

> This should be mitigated by browser vendors by integrating HTTPSEverywhere as a core functionality of the browser that needs to be explicitly turned off (instead of the current state of affairs where we have a tiny minority on the web who are familiar with installing security add-ons). We're talking about China, so that's probably not going to work: Chinese users are using Chinese browsers [1] to access Chinese websites. I don't think Chinese browser-makers and website operators are going to take action against their government like that. [1] https://www.fastcompany.com/3058432/the-top-3-web-browsers-in-china-leave-users-vulnerable-report-says https://www.fastcompany.com/3058432/the-top-3-web-browsers-i...

DyslexicAtheist 7y ago
sure. but that would still limit the attack to only come from within CN (and possibly users outside with a CN browser) and not from every potential user who has Safari/Mozilla/Chrome. It would mitigate attacks from inside China against outside entities, which for somebody not based in China is all I want.
gruez 7y ago
That's fine. If the Chinese government wants to commandeer their own citizen's resources to DDoS other people, that's on them. They could very well also direct their state controlled ISPs to do the same. Doing either would be obviously be attributed to them and would be cause for them to be de-peered - solving the problem.
mlyle 7y ago
The concern here is people using Chinese websites abroad. The Great Cannon rewrites javascript for a subset of remote users visiting Chinese sites, causing the users' browsers to participate in a DDoS against a target.

LeftHandPath 7y ago

I recently (4 or 5 months ago) joined an online community of aircraft owners and pilots that is primarily focused around a single brand of aircraft (although it's not an official site of, property of, that brand nor is it endorsed by that brand). When I signed up, they emailed me to welcome me to the site (they actually require manual authorization of users by an admin, which is... refreshing, but uncommon). The email ended by stating that if I lost my password, they could "recover it" and send it back to me. I raised a thread about it in one of their off-topic sections, and got harassed - "How secure do you need your browsing to be?" (And hey, I mean, I was asking them to do more work) But it stands out that most of the public doesn't know, and doesn't care to know. Even a site that's populated by people with net worths and/or incomes that average in the six-to-seven figure range, that they probably signed up for with the same email address and password that they use for their bank and brokerage accounts. HTTP should come with a warning. Furthermore, it would be fan-fucking-tastic if there was some generalizable way to (automatically) audit a website's security practice. Like, a crawler that just runs standard OWASP-style attack-vector checks, and sends an email to the site's owners when one succeeds. And then put that data into a database and warn users (with a browser plugin) when they are creating credentials for sites with bad security.

brentonator 7y ago
I'd recommend using an OpenID Connect provider to authenticate if you're concerned about their practices but it's just as easy to improperly implement auth even with mainstream libraries to help you connect something like Auth.0 to your app. e.g. Don't assume the email address is owned by the person making the claim. You can sign up for an account with an email and if it's not verified or the verification is mis-clicked or phished into being clicked the original account owner would never know the difference. Still, at least with OpenID Connect you know your password isn't sitting in plain text.
- unilynx 7y ago
  Are there any sites that accept OpenID but that you still suspect of poor password/auth practices?
7y ago

flattone 7y ago

surprised the relevant powerful/time tested and highly technical participants at whichever appropriate layer of networking aren't just forcing https only. #studentquestion

gruez 7y ago

>and in case I'm totally wrong, what mitigations are feasible? More trade war such as by compelling ISP's to null-route Chinese businesses like Baidu.com as a form of sanction? A slightly less broad measure that's just as effective would be to block unencrypted http traffic from entering China. Want to get unblocked? Get letsencrypt. A even better (but slightly greyhat) route would be to inject HSTS headers with the maximum expiry date. This will cause any visitor's browsers to get "infected" with an unskippable warning, forcing them to upgrade no matter what.

DyslexicAtheist 7y ago

for anyone interested, Brian Krebs did an excellent article[1] on The Great Cannon after the Citizen Labs incident. > [Nicholas] Weaver said the attacks from the Great Cannon don’t succeed when people are browsing Chinese sites with a Web address that begins with "https://" https://", meaning that regular Internet users can limit their exposure to these attacks by insisting that all Internet communications are routed over "https" versus unencrypted "http://" http://" connections in their browsers. A number of third-party browser plug-ins — such as https-everywhere — can help people accomplish this goal. > But Bill Marczak, a research fellow with Citizen Lab, said relying on an always-on encryption strategy is not a foolproof counter to this attack, because plug-ins like https-everywhere will still serve regular unencrypted content when Web sites refuse to or don’t offer the same content over an encrypted connection. What’s more, many Web sites draw content from a variety of sources online, meaning that the Great Cannon attack could succeed merely by drawing on resources provided by online ad networks that serve ads on a variety of Web sites from a dizzying array of sources. [1] https://krebsonsecurity.com/2015/04/dont-be-fodder-for-chinas-great-cannon/ https://krebsonsecurity.com/2015/04/dont-be-fodder-for-china...

inimino 7y ago

I posted a top-level comment[1], but basically HTTPS-only, aside from throwing old sites under the bus, would not have helped. [1] https://news.ycombinator.com/item?id=21726617 https://news.ycombinator.com/item?id=21726617 > and in case I'm totally wrong, what mitigations are feasible? More trade war such as by compelling ISP's to null-route Chinese businesses like Baidu.com as a form of sanction? Probably something like this, but I'm afraid of where that would lead.