4 ms·

From looking at the Javascript injection code (http://www.theregister.co.uk/2015/03/27/github_under_fire_from_weaponized_great_firewall/ http://www.theregister.

From looking at the Javascript injection code (http://www.theregister.co.uk/2015/03/27/github_under_fire_from_weaponized_great_firewall/ http://www.theregister.co.uk/2015/03/27/github_under_fire_fr...) it seems like the quality of the script is pretty amateur. They inject jQuery not once, but twice, and only use jQuery to make a simple XHR request. Perhaps they are worried about one instance of jQuery being taken down or made unavailable to them, but they really don't need jQuery at all for something this simple.

jayhuang 12y ago
the jQuery is being injected from 2 different sources. The first being from a Baidu CDN, I suppose they anticipate some kind of attack on Baidu and included the 2nd one as fallback. As for jQuery being unnecessary for this job; agreed, but hey, it got the job done.
aliakhtar 12y ago
They might be using jquery because it abstracts away the quirks of different browsers (I seem to remember that old versions of firefox and IE had different APIs for making XHR requests).
- TazeTSchnitzel 12y ago
  But in this case there are no meaningful browser differences: var tag = document.createElement('script'); tag.src = 'https://github.com/greatfire/'; document.body.appendChild(tag); This works on any browser. Even IE6.
  - svckr 12y ago
    Which, ironically, is not so different from what they are doing to get jQuery in the first place.
  - aliakhtar 12y ago
    Ah, you're right. Then it really is stupid. I misunderstood what it was doing.
TazeTSchnitzel 12y ago
It's not even an XHR request. It's a JSONP-style insert-<script src="someurl"></script>-into-the-body "request". The fact they used jQuery to do this is incredibly amateurish. Especially since they didn't seem to realise they could do the same trick with <img> without creating an XSS vector.
- antihero 12y ago
  I think it is an XHR request, despite that not being the best option, as you later explain. As in, it includes the jQuery script and then does a `$.ajax()` call.
malchow 12y ago
I love that even PRC's DDoS attacks on U.S. technology resources invoke jQuery twice.
- rsuelzer 12y ago
  I think that it needs more jQuery. http://www.needsmorejquery.com/ http://www.needsmorejquery.com/

jayhuang 12y ago

the jQuery is being injected from 2 different sources. The first being from a Baidu CDN, I suppose they anticipate some kind of attack on Baidu and included the 2nd one as fallback. As for jQuery being unnecessary for this job; agreed, but hey, it got the job done.

aliakhtar 12y ago

They might be using jquery because it abstracts away the quirks of different browsers (I seem to remember that old versions of firefox and IE had different APIs for making XHR requests).

TazeTSchnitzel 12y ago
But in this case there are no meaningful browser differences: var tag = document.createElement('script'); tag.src = 'https://github.com/greatfire/'; document.body.appendChild(tag); This works on any browser. Even IE6.
- svckr 12y ago
  Which, ironically, is not so different from what they are doing to get jQuery in the first place.
- aliakhtar 12y ago
  Ah, you're right. Then it really is stupid. I misunderstood what it was doing.

TazeTSchnitzel 12y ago

It's not even an XHR request. It's a JSONP-style insert-<script src="someurl"></script>-into-the-body "request". The fact they used jQuery to do this is incredibly amateurish. Especially since they didn't seem to realise they could do the same trick with <img> without creating an XSS vector.

antihero 12y ago
I think it is an XHR request, despite that not being the best option, as you later explain. As in, it includes the jQuery script and then does a `$.ajax()` call.

malchow 12y ago

I love that even PRC's DDoS attacks on U.S. technology resources invoke jQuery twice.

rsuelzer 12y ago
I think that it needs more jQuery. http://www.needsmorejquery.com/ http://www.needsmorejquery.com/