14 ms·
Why Baidu Has Been Hijacked to Attack GitHub
- dtech 12y agoThis actually only says how GitHub was attacked, which was already clear this morning. It doesn't say why.
- phaza 12y agoThe JavaScript code instructs Visitors browsers to Request the Github Pages of Anti-censorship group Greatfire and the Chinese Language Edition of the New York Times . These groups turned to a developer source code control tool to host their information with the knowledge that China was unable to block Github because of the huge cost to its technology industry. Seems like these groups hosted content that the Chinese government didn't approve of, and tried to put it on github to avoid it being blocked. The Chinese government responded by DDoS-ing the two repositories to bend github itself into removing/blocking the content.
- aikah 12y ago> It appears to be an attempt to pressure Github, a non-news organization, to censor content that China objects to.
- nilbot 12y agoLet's just wait and see what Github's response would be...
- smcl 12y agoIs google translate from Chinese (Mandarin presumably) always this good? I'm pretty shocked by how coherent the resulting article is.
- zuck9 12y agoHumans can add custom translation for phrases in Google Translate.
- dheera 12y agoIn this case the original article is in English. https://iyouport.com/archives/25775 https://iyouport.com/archives/25775 Not sure why OP put it through Google Translate ...
- erjiang 12y agoGoogle Translate has actually mangled the (English) text a bit by going from English to English.
- RyanMcGreal 12y agoWell that's just embarrassing.
- TazeTSchnitzel 12y agoI think they did it to try and take advantage of Google's cache, and failed.
- dEnigma 12y agoI thought the same thing, but then I checked the "Original" because I just couldn't believe it (considering that German to English isn't even that good) and it turns out it's in English
- KMag 12y agoSide note: the written language that Beijing requires all school children to learn is usually called "Standard Written Chinese" even though it's based on the grammar of Mandarin. Depending on the differences in grammar between the local dialect and Mandarin, it's more or less difficult to learn the standard written grammar. We usually don't say "written Mandarin", but less formal writing using the grammar of one of the other dialects would usually be called "Written Cantonese". etc. My manager speaks a dialect that's pronounced differently, but has a grammar close to Mandarin. The majority of people here in Hong Kong speak Cantonese, which is grammatically more different and uses a lot more slang and references to popular culture. I'm told that growing up here, leaving at age 15, and coming back at 25 makes it very difficult to follow daily conversations and read certain types of publications for the first few months because of the amount of slang used and how rapidly Cantonese changes.
- roylez 12y agoIf I understand correctly, there is almost no way to stop this attack because it uses client side JavaScript code. If Baidu doesn't remove this malicious js from its http response, github will continue to suffer.
- Pirate-of-SV 12y agoBaidu is not doing anything wrong. The HTTP requests/responses are hijacked. Baidu could make a switch to only support HTTPS though. That would require a more elaborate attack.
- louis-paul 12y agoGitHub just needed to add code in their application to return a very simple snippet of Javascript on the /greatfire route, instead of trying to process the whole request and generate content for users. Since it's very lightweight, they are probably able to handle hundreds of thousands requests per second if it's implemented properly.
- RA_Fisher 12y agoAssuming this is the Chinese government, what's their end game here? They must believe that GitHub will bow to their will and remove Greatfire or block it from China. Permanently? That seems incredibly naive. Also, have they not considered the Streisand effect? Also, assuming they see Baidu as effectively a state asset, why poison that brand for such a temporary gain? It doesn't make sense.
- michaelt 12y agoThey must believe that GitHub will bow to their will [...] That seems incredibly naive. Plenty of technology companies would. Of course, they would call it "complying with local laws in all countries in which we operate". The only way to find out if Github is such a company is a few months of successful attacks.
- RA_Fisher 12y agoThat's true. I remember being incredibly disappointed in Google when they agreed to censor search results for China. Here's to hoping that GitHub is willing to stand up to this bully.
- warfangle 12y agoCensor but supply notice that they were censoring. And when China hacked into gmail, they left the country rather than continue to comply with their laws.
- dopamean 12y agoI would be less inclined to oblige in the face of threats and actual attacks. Especially when done so publicly. I imagine companies like Facebook we quicker to oblige through actual negotiation and some sort of "business diplomacy."
- Lawtonfogle 12y ago>Of course, they would call it "complying with local laws in all countries in which we operate". If 'I was following orders.' isn't an excuse when you are in the military where disobeying orders can get you jailed if not killed, then no one should accept such reasoning when the pentalty is merely being unable to do business in an area.
- TazeTSchnitzel 12y agoHmm, I wonder if this could backfire. If it's an <iframe>, couldn't GitHub insert code that framebusts? If it's some other mechanism, couldn't they block by referrer? If it's CORS, couldn't GitHub deny CORS requests? If it's a <script> tag, couldn't GitHub do some nasty XSS? Edit: ooh, take a look at the more detailed look from insight-labs: http://insight-labs.org/?p=1682 http://insight-labs.org/?p=1682 It's XMLHttpRequest ($.ajax), but with dataType: "script". Looking at the jQuery docs (http://api.jquery.com/jquery.ajax/ http://api.jquery.com/jquery.ajax/): "script": Evaluates the response as JavaScript and returns it as plain text. Disables caching by appending a query string parameter, "_=[TIMESTAMP]", to the URL unless the cache option is set to true. Note: This will turn POSTs into GETs for remote-domain requests. Oh dear. If GitHub can detect this, GitHub can basically XSS all sites using Baidu's analytics. Edit 2: Oh, the insight-labs article says the attack has stopped.
- Pirate-of-SV 12y agoThat's exactly what they did! At the moment of this writing they are sending back: alert("WARNING: malicious javascript detected on this domain") when you're trying to reach: https://github.com/greatfire/ https://github.com/greatfire/ or https://github.com/cn-nytimes/ https://github.com/cn-nytimes/ That's why other people have started to notice it (as the article describes). Timeline of the attack looks something like this: 1. The Chinese firewall hijacks requests to http://hm.baidu.com/h.js http://hm.baidu.com/h.js and sends back a script that attacks GH instead. 2. Github notices that a huge amount of people are trying to reach https://github.com/greatfire/ https://github.com/greatfire/ and https://github.com/cn-nytimes/ https://github.com/cn-nytimes/ 3. GH figures out what's happening and starts replying with the alert javascript snippet. 4. Users are now getting noticed by the alert every time their browser runs the hijacked javascript. 5. The person that wrote this article writes this article after investigating what the alert message is about.
- TazeTSchnitzel 12y agoOh, I see, gotcha.
- Fuxy 12y ago
- TazeTSchnitzel 12y agoDoes anyone have a mirror of the original article? "Error establishing a database connection" Edit: Google cached it here: http://webcache.googleusercontent.com/search?q=cache:CeVJaTqfuZkJ:https://iyouport.com/archives/25775+&cd=1&hl=en&ct=clnk http://webcache.googleusercontent.com/search?q=cache:CeVJaTq... Edit 2: Here's an archive.today of Google's cache: https://archive.today/KtgpS https://archive.today/KtgpS
- dang 12y agoThanks. Since your second link works while http://translate.google.ca/translate?hl=en&sl=zh-CN&u=https://iyouport.com/archives/25775&prev=search http://translate.google.ca/translate?hl=en&sl=zh-CN&u=https:... doesn't, and neither is an original source anyhow, we've swapped the URLs.
- cvuletich 12y agoHeh, we DDoS'ed the article about the DDoS.
- grandalf 12y agoThis is a very clever attack. I wonder if the same attack can be used on other sites or if it exploits something about Github. Github's data is difficult to cache and many pages load piecemeal using turbolinks which itself creates lots of un-cacheable requests (cacheable only until someone pushes a new commit). So it would appear to be next to impossible to stop a distributed attack.
- TazeTSchnitzel 12y ago> I wonder if the same attack can be used on other sites or if it exploits something about Github. It doesn't exploit anything GitHub-specific! The way it's done is applicable to any site. The reason is that it uses the <script> loophole around the Same Origin Policy (<script> can be loaded cross-domain, thanks Eich...). They basically just inject this every two seconds: <script src="http://github.com/greatfire/"></script> The browser will request that page expecting a script. And it'll get HTML, but that's not valid JS and just ignore it, but the DDOS is successful. However, this also makes all sites with the malicious JS vulnerable to an XSS attack by GitHub, like GitHub is currently doing. If you visit that URL, you get this: alert("WARNING: malicious javascript detected on this domain") Though I think the same trick could be done with, say, <img> or <style>, and those wouldn't allow XSS (though <style> could fuck with the page, certainly). Sloppy coding, Chinese Government employee...
- jfroma 12y agoI was wondering if you can prevent this by looking at the "Accept" header in the request but it seems accept is "/" for scripts. I'd expect the browsers rather to send "application/javascript". Then the answer from my server will be 400 because I don't have a javascript representation of this url.
- TazeTSchnitzel 12y agoWell, you're still spammed with requests.
- 12y ago
- akx 12y agoI think GitHub should have added a more descriptive error message (since they control it thanks to how the attack vector works). alert( "The site you are visiting contains malicious JavaScript.\n" + "Your computer is currently being used to attack Github.com." ) or something...
- arcatek 12y agoAnd let's add some taunt in it: "[...] Github.com, and more specifically the tools allowing to easily bypass the chinese government censorship." I wonder what would happen with such a message.
- Rezo 12y agoThe only thing the average web user would take away from such a popup is that github.com is annoying or spying on them, and then proceed to bombard github with messages to knock it off (reminds me of when a blog temporarily became the #1 search term for "facebook login", oh the hate that blog received for "breaking my Facebooks")
- TazeTSchnitzel 12y agoThe average web user has no idea GitHub is behind the popup. You need to be a web expert and look at the Network tab to know this.
- Rezo 12y agoOP suggested adding "github.com" to the popup's message. That would be a Bad Idea.
- TazeTSchnitzel 12y agoOh, right, silly me for not reading the context.
- deleted 12y ago[deleted]
- weberc2 12y agoI'm bored of Chinese hackers attacking Western companies... Let's mix it up a bit and hear about some Western hackers attacking Chinese organizations.
- pbhjpbhj 12y ago>"Requests to Baidu’s content data network are being intercepted and sending back some javascript code instead of the original requested file. The javascript code instructs visitors browsers to request the Github pages of anti-censorship group Greatfire andthe Chinese language edition of the New York Times." I must be misunderstanding - is there a salient piece of info missing? It makes no sense for the Chinese government to attempt to foil censor bypassing by sending all users of Baidu a link to a project on GitHub that enable censor bypassing. As an outcome is to inform all affected Baidu users of bypass tools and a non-government controlled newspaper this looks more likely to be a rogue element to me. It doesn't even look like what I'd call DDoS - sending genuine users to your site who might be interested in your product, isn't that an unpaid affiliate scheme?!?
- TazeTSchnitzel 12y agoThe attack is fairly simple: The Great Firewall intercepts requests to Baidu's CDN from outside China, specifically HTTP requests for Baidu's analytics scripts. Users from outside China who visit web properties that use Baidu's analytics get malicious JS that injects <script> tags every two seconds to spam github.com with requests. Nobody would notice that attack, except GitHub cottoned onto this and replaced the github pages with JS that spawns a little alert() popup.
- whoopdedo 12y agoSo it was the firewall itself acting as a MITM? That puts the blame strictly on the Chinese government. And specifically the military that controls the firewall. Sounds to me like an act of aggression by a state army against a non-combatant on foreign soil. What if a helicopter with a red star on it flew into California in the middle of the night and set fire to Github's offices? What's the difference?
- chengsun 12y agoThis was worded misleadingly. This is indeed a DDoS: code has been injected to load the Github pages in the background using XHR without the user's knowledge. The host page itself is not redirected (or visibly affected in any way[1]). Furthermore, only people outside of China are affected by this -- Chinese citizens don't have this code injected. [1]: Actually there is a mistake in the injected code that causes the result of the XHR request to be interpreted as JavaScript, and then executed. Hence GitHub has tried to mitigate the attack by replying 'alert("WARNING: malicious javascript detected on this domain")' to notify the user that this is happening.
- dujiulun2006 12y agoChinese govt is telling the world with this attack that: (1) GFW can interfere with incoming traffic. (2) GFW can f* with people all around the world. (3) You can't block a Chinese cyber attack simply by cutting off Chinese users. (4) The Chinese govt is a d*head.
- cryptophreak 12y agoYou can use swear words on the Internet.
- panzagl 12y agoYou can also not use them.
- virmundi 12y agoAnd apparently you can partially use them.
- dujiulun2006 12y agoLOL. I even used them wrong. I put in single line-breaks and three asterisks. Guess it's a markdown editor? ;)
- iopq 12y agoHe clearly used them.
- johansch 12y agoSo the logical solution is to block all of China and anyone who also doesn't block all of China. And so on...
- superobserver 12y agoThat sums it up. Oh, and they're a danger to the internet itself.
- 12y ago
- Dorian-Marie 12y agoThey seem to push the DDoS from multiple fronts, for instance this repo has 100k random numbers commits: https://github.com/greatfire/z https://github.com/greatfire/z
- TazeTSchnitzel 12y agoI don't think that's DDoS. It's probably the authors of the project frequently changing it to evade Chinese censorship.
- yincrash 12y agoAt what point will the US stop tolerating Chinese attacks on US companies?
- TazeTSchnitzel 12y agoWhat do you mean by "stop tolerating"? Declare war?
- yincrash 12y agoThere are other diplomatic avenues besides declaring war.
- TazeTSchnitzel 12y agoWhat, sanctions? The US is totally reliant on China for manufacturing. You'd grind the West, and China, to a halt.
- shaftoe 12y agoSo we roll over to a bully?
- yincrash 12y agoWe can start with the US publicly blaming China for the attacks. Public consciousness does a lot by itself.
- yellowapple 12y agoOne can still use a hammer even if I break his kneecaps with it beforehand. China is just as reliant on the West as the West is reliant on China. The use of that as leverage doesn't have to be limited to one side of that equation.
- justaman 12y agoThings will become worse before they become better.
- 12y ago
- lehenbauer 12y agoThey could just mirror all the git repos minus what they find objectionable. github isn't immune to pressure. They would probably like to sell a lot of github enterprise and whatnot in China.
- borgia 12y agoThat's a fairly neat attack, to be fair to them. I don't see why Github, upon receiving these requests, wouldn't just do the same back to China and absolutely hammer some of their resources in return?
- rmc 12y agoProbably because the Chinese government has more ability to absorb these requests.
- Igglyboo 12y agoGithub generates no where near the amount of traffic that Baidu does.
- MikeTV 12y agoWhile Github is receiving a fair percentage of Baidu's traffic, though...
- borgia 12y ago>While Github is receiving a fair percentage of Baidu's traffic, though... Yeah that's my thinking on it. They're being handed traffic, or more correctly having it thrown at them maliciously, which they could in turn redirect back at some point in the Chinese infrastructure.
- frankchn 12y agoWho do they reflect the attack to though? Baidu? They might not even know this is happening (well they probably do now, but not sure what they can do). The GFW infrastructure itself certainly isn't publicly addressable.
- ElijahLynn 12y agoEverone keeps saying "Chinese Governement", this has no accountability. The actual person in charge is Ji Xinping. Start naming names people. https://www.google.com/search?q=xi%20jinping https://www.google.com/search?q=xi%20jinping
- ssunstruck 12y agoWitch hunting is a fun pastime, isn't it?
- Kiro 12y agoUhm, I wouldn't call outing the de facto ruler of China witch hunting.
- logfromblammo 12y agoHe's the de jure head of state. The de facto rulers of China are the "princeling" descendants of revolution-era party leaders (http://en.wikipedia.org/wiki/Princelings http://en.wikipedia.org/wiki/Princelings). He is certainly one of them, and perhaps the most influential, but he is certainly not powerful enough to be "the ruler".
- kinghajj 12y agoFrom what I've read about Chinese leadership, it's incorrect to label Xi as "in charge", at least if you mean in a dictatorial fashion. The CCP seems to run by the consensus of top party leaders. Xi certainly has more authority/sway than the rest, but I doubt he's making all of the decisions alone.
- yeukhon 12y agoLike every organization there is a need to maintain good relationship with others. This means you have to make compromise and make deal. This means people aren't always 100% in charge. You can choose to do things against the will of some powerful enemy, and you will face the consequence. So Xi can make all the decisions here. He can say "I want this to be done" and his officials will carry out. At this very moment, Xi is absolutely in charge of everything, especially given his popularity.
- LLWM 12y agoBecause they can't just seize the servers the way the US does.
- bstream 12y agoHere is the original article: https://thenanfang.com/why-baidu-was-hijacked-to-attack-github/ https://thenanfang.com/why-baidu-was-hijacked-to-attack-gith... (the one on iyouport links to this one)
- zhng 12y agoIs the best way to currently prevent this is via full ssl? Additionally, how can a site like Amazon.com run non-ssl protected pages and prevent mitm-ing? (e.g. http://www.amazon.com/dp/B00TYBBNAW/ http://www.amazon.com/dp/B00TYBBNAW/ doesn't redirect to https, but only when ordering, etc.)
- invisible 12y agoWhy wouldn't they make the pages in question serve window.top.location = "somewhere";?
- seanherron 12y agoVery interesting to look at the original content of https://github.com/greatfire/ https://github.com/greatfire/ and https://github.com/cn-nytimes https://github.com/cn-nytimes. One appears to be a collection of resources for proxying around the Great Firewall [1] and the other has a number of clones of the New York Times translated in Mandarin [2][3]. [1]: http://webcache.googleusercontent.com/search?q=cache:X_4LmyL2jBsJ:https://github.com/greatfire+&cd=1&hl=en&ct=clnk&gl=us http://webcache.googleusercontent.com/search?q=cache:X_4LmyL... [2]: https://github.com/cn-nytimes/mirrors https://github.com/cn-nytimes/mirrors [3]: https://dtl1al4e74u07.cloudfront.net/ https://dtl1al4e74u07.cloudfront.net/
- allochthon 12y agoI didn't realize until now that part of the NYT's strategy in having a Mandarin version may be due in part to it's being blocked in China -- a reply to China's censors, of sorts.
- eggnet 12y agoGitHub should cut China off from all services until the attack stops. It is clearly something the Chinese government doesn't want, or they'd just block GitHub in the Great Firewall themselves.
- r00fus 12y agoYou seem to think China (or the folks running the great firewall) would be unhappy losing GitHub. I don't think they'd care as long as those two repos were effectively invisible to users.
- logfromblammo 12y agoRedirect all visitors subjected to the GFC to one of those two repositories. China loses all of GitHub except the projects it hates the most.
- Sanddancer 12y agoThe childish part of me says to alter the redirect code to be a bit more...shocking. I think the attack would stop a lot more quickly if baidu users were subjected to, say, goatse or 2g1c.
- eggnet 12y agoI made a good case that they do care, which you didn't address, at all.
- echohtp 12y agoIts not lab grade testing, but there is the old standby https://dancesafe.org/ https://dancesafe.org/
- undefined0 12y agoThat's why websites should stop including javascript from third party sources. For my analytics, I use liveinternet.ru because it runs the javascript locally on my website but passes the browser information via an image embed. Liveinternet has no ability to execute malicious code and yet I can still use them as a fully functioning analytics.
- Sanddancer 12y agoHow much more difficult is using liveinternet.ru, out of curiosity? Google analytics got popular because all you had to do was paste a single line to the bottom of your site and google would handle the rest.
- undefined0 12y agoIt's just as easy, it's a small snippet of code you paste at the bottom of your site. However, the site doesn't have a pretty design like Google but that's why I prefer it - it's simple and works with NoScript.
- brador 12y agoWould it be possible to use this and the CSS link color hack as a way to see which users had visited those Github URLs? Could that be the real aim here?
- itsmrwave 12y agoIn hindsight, GitHub moving away from GitHub Pages from the github.com domain to github.io makes this whole situation less severe. Imagine all the GitHub-Pages-powered sites that would have been down at the moment. https://github.com/blog/1452-new-github-pages-domain-github-io https://github.com/blog/1452-new-github-pages-domain-github-... Obviously the link above might not work at the moment.
- itsmrwave 12y agoI think I spoke too soon ... latest update: "19:23 UTC The on-going DDoS attack now includes GitHub Pages. We are working to mitigate any service disruption." https://status.github.com/messages https://status.github.com/messages
- saurik 12y agoIt would be exceptionally epic if you didn't "speak too soon" but instead "gave them the idea" ;P.
- Animats 12y agoThe US government should prohibit US companies from complying with censorship demands from China. It already does something like that to prevent US companies from complying with the Arab League boycott of Israel.[1] [1] https://www.bis.doc.gov/index.php/enforcement/oac#whatsprohibited https://www.bis.doc.gov/index.php/enforcement/oac#whatsprohi...
- iso8859-1 12y agoWhy did GitHub not just put a Bitcoin miner or a BOINC client instead of the alert? The Chinese is not going to care about the warning anyway, it would be more educational to peg their CPU to 100% usage and make some spare change while you're at it.
- tthayer 12y agoThis DDoS is mainly punishing people who are using VPN to skirt The Great Firewall (and people who use GitHub). What is the point of 'punishing' people who aren't doing this on purpose?