15 ms·

I still don't really get it. What's the actual goal behind the attack? When the Chinese government decides to block a website, I can at least understand their m

by mraison 12y ago

I still don't really get it. What's the actual goal behind the attack? When the Chinese government decides to block a website, I can at least understand their motivations, as bad as they may be. But DDOSing Github just seems to be pissing the whole world off for a few hours without any actual long term consequences.

meritt 12y ago
They're probably demonstrating that the Chinese government can leverage nearly the entire Chinese internet userbase to DDOS anyone they want, at any time, and the easiest protection mechanism is to block Chinese IPs. Which is exactly want they want.
- girvo 12y ago
  > leverage nearly the entire Chinese internet userbase Well, not just Chinese users. Anyone who was accessing a site that used Baidu's analytics, regardless of where they came from. Things like this remind me why I like Piwik so much.
- igammarays 12y ago
  Except this particular attack is not coming from Chinese IPs, rather from visitors of Chinese websites from outside China.
  - rtpg 12y ago
    right, which is why unfortunately github couldn't counter by piping in some anti-china propaganda or something. As a sidenote though, VPN users are probably also affected.
    - rst 12y ago
      Maybe they could -- it might not be a wise move, particularly given the political tensions which obviously exist already, and it would certainly be inflammatory, but it may well be technically possible. Github serves HTML over HTTPS, which means that if they started putting a few well-chosen words in Chinese in every HTML page served to China, the only thing the government could easily do about it would be to block github from Chinese users entirely -- which they've already tried once, and didn't keep up, presumably because cutting off github for more than a few days poses problems for their own domestic software sector.
    - grrowl 12y ago
      Chinese VPN users are absolutely affected, and in fast this puts more pressure on Chinese-used VPN services, and to a lesser extent the users, too.
- jfoutz 12y ago
  Damn! I just realized, github is getting a full 1% of baidu's traffic. I wonder if they're getting the search terms. I bet they're getting cookies. The ultimate mitigation might be google paying to show the results instead of baidu. Or just showing their own ads.
  - jonny_eh 12y ago
    Github wouldn't get baidu's cookies since they're different domains.
    - eloisant 12y ago
      They could if they put code to read cookies in JS and send them home in the JS included in people's pages.
      - jonny_eh 12y ago
        Good point, all the more reason page authors should use httpOnly cookies: https://www.owasp.org/index.php/HttpOnly https://www.owasp.org/index.php/HttpOnly
igammarays 12y ago
Who said this would only be for a few hours? DDOSing Github drives up their hosting costs massively, creating a financial incentive to comply with China's demands. Aside from that, it's just Eastern politics, which works by a whole lot of bullying and childish tactics when they don't get their way. Not to say that it doesn't happen in Western politics, just much more subtly. And it doesn't seem so bad since we're the good guys.
- dmfdmf 12y ago
  > And it doesn't seem so bad since we're the good guys. Post-Snowden, check your premises.
  - carboncopy 12y ago
    > And it doesn't seem so bad since we're the good guys. I'm pretty sure that was meant to be tongue-in-cheek. > Post-Snowden, check your premises. What premise are you making? That the United States conducts espionage?
    - lazaroclapp 12y ago
      You know that post down there somewhere in this thread that says that having classified state secrets is the same as having widespread political censorship? That's the kind of gulf between saying the U.S. "conducts espionage" and the fact that it also conducts mass surveillance of billions of people ;) But I am with you on the broader point, "we're the good guys" was probably meant sarcastically, since very few people outside of Fox news commentators would say it un-ironically about the U.S. (or any country as a whole, really).
  - deleted 12y ago
    [deleted]
j42 12y ago
Actually, someone here (who I cannot remember) said quite eloquently yesterday that our biggest export--and "influence" on the world--is culture. For the first time I realized that pissing people off may, in fact be the objective as the other reply stated. China and Russia are both (quite unique) examples of countries with an unfathomable degree of control over their citizens. It can be hard to grasp occasionally, coming from a western mindset but for the vast majority within said countries, the entire reality they see and what they believe to be true is heavily distorted--in that, it is defined by the vision of the oligarchy and information is carefully controlled to produce a desired set of beliefs. North Korea is an extreme caricature of this pattern. Technology is naturally subversive to this as it lets people interact directly with other cultures and ideologies which may provide contrasting philosophies and--terrifyingly--the opportunity for free thought. Restrict access to technology and you'll have a revolution. Instead, you become the "troll," or the "problem," and quietly become isolated from large areas of the network, all while reducing the amount of information you have to sift through before passing it along to the populace, in the name of security. And while the effect on actual traffic may be minimal, it does make for a very cold perception which generally makes cross-cultural integration unlikely. How many western consumer-technology companies do you see integrating with Asia-based API's/demand, compared to other industry, let alone academics?
- karcass 12y ago
  > the entire reality they see and what they believe to be true is heavily distorted--in that, it is defined by the vision of the oligarchy and information is carefully controlled to produce a desired set of beliefs. That's pretty much how I feel about the Fox-watching population of the US.
  - carboncopy 12y ago
    > That's pretty much how I feel about the Fox-watching population of the US. I used to think the same thing, and to some degree I think it holds truth. But after spending lots of time with my right-wing family, I think it's a bit more nuanced than that. Most avid Fox News watchers I've met fail to embrace the entire world-view or vision promoted on the channel, and share maybe 60-70% of the opinions elicited toward viewers. I know, it's just one data point, but I don't have a study handy.
jfoutz 12y ago
It seems completely bizarre. At least the government has the wisdom to not publicly take credit for it. It looks really bad when one of the most powerful nations on earth, over a billion strong, can't stop a little 300 person operation. Github is smart and talented, and i'm sure that bandwidth cost is horrible. But they are up against an organization 7 orders of magnitude larger, and seem to be holding up just fine. I kinda hope China comes out and says, whoops, unauthorized sneaky hackers. Github's resilience makes them look like a joke.
- jauer 12y ago
  At this point do they really have a option besides continue until Github caves because of mounting costs? Admitting whoops, unauthorized sneaky hackers co-opted our national packet mangling infrastructure would be a LOT of egg on their face.
  - jfoutz 12y ago
    That's a big freaking gamble. How effective does Github's mitigation need to be to make the costs tolerable? They're already using a full 1% of the traffic to ddos, they can only double that 7 times. Really, at this point Github could probably put together a really nice blacklist of baidu users outside of china, and whitelist those that actually use the service. I can think of a couple of cute ways to accelerate the whitelisting. Banking on Github not finding a good enough solution seems really risky. Why not just ddos every time there's positive Github news? Ideally a half hour in advance of the event? China must know when MS is going to host some cool new project. China must know when the U.S. data service is going to host a cool new project. China must know when Github is going to announce a new feature. This approach is just super half assed.
    - rsuelzer 12y ago
      Side question, does GitHub run ruby on rails? If so, I'm pretty impressed.
      - 12y ago
DannyBee 12y ago
Interestingly, i believe these same projects used to get attacked on code.google.com as well
gbog 12y ago
I'm working in a 100% Chinese high-tech company, and asked my colleagues: they think it is just a test (that was my first impression too).
- methou 12y ago
  This means A LOT to the rest of the world. China in history always claims that they don't intervene with things of other country, but in these days, they shamelessly attacked an US company.
- GhotiFish 12y ago
  What do they think China is testing?
pjlegato 12y ago
I think you answered your own question.. > What's the actual goal behind the attack? > pissing the whole world off for a few hours
untog 12y ago
Both of the targets for their DDOS were projects to help you circumvent their firewall. If it happened to also bring down Github at the same time I doubt they cared too much.
annnnd 12y ago
Testing their DDoS "weapons" may also be a good reason. Of course, protection will also get better, so it's a double edged sword (for them).
muyuu 12y ago
It's hard to tell if this is a decision from high up in China's PRC ranks, or lower in the ranks, or even a false flag/experiment. It highlights how XSS attacks can target arbitrary sites extremely efficiently, just by finding a strong vector origin point to deface (like Baidu's foreign filter JS).
belorn 12y ago
I see many goals, but I find it most likely that this was the digital version of a weapon test. The arbitrary use of 1% and the simplicity of the attack seems perfect for demonstrating a capability. As a bonus, they get to send a message about circumventing, see the effectiveness, and test defenses against it. All without having to official claim credit for it.
misja111 12y ago
>> What's the actual goal behind the attack? The answer to that question is in the article: "As can be seen in the code, the two targeted URLs are github.com/greatfire and github.com/cn-nytimes, which are mirror sites for GreatFire.org and the Chinese New York Times. GreatFire and NYT both use GitHub to circumvent the online censorship performed by the Great Firewall of China (GFW)."

by mraison 12y ago

meritt 12y ago

They're probably demonstrating that the Chinese government can leverage nearly the entire Chinese internet userbase to DDOS anyone they want, at any time, and the easiest protection mechanism is to block Chinese IPs. Which is exactly want they want.

girvo 12y ago
> leverage nearly the entire Chinese internet userbase Well, not just Chinese users. Anyone who was accessing a site that used Baidu's analytics, regardless of where they came from. Things like this remind me why I like Piwik so much.
igammarays 12y ago
Except this particular attack is not coming from Chinese IPs, rather from visitors of Chinese websites from outside China.
- rtpg 12y ago
  right, which is why unfortunately github couldn't counter by piping in some anti-china propaganda or something. As a sidenote though, VPN users are probably also affected.
  - rst 12y ago
    Maybe they could -- it might not be a wise move, particularly given the political tensions which obviously exist already, and it would certainly be inflammatory, but it may well be technically possible. Github serves HTML over HTTPS, which means that if they started putting a few well-chosen words in Chinese in every HTML page served to China, the only thing the government could easily do about it would be to block github from Chinese users entirely -- which they've already tried once, and didn't keep up, presumably because cutting off github for more than a few days poses problems for their own domestic software sector.
  - grrowl 12y ago
    Chinese VPN users are absolutely affected, and in fast this puts more pressure on Chinese-used VPN services, and to a lesser extent the users, too.
jfoutz 12y ago
Damn! I just realized, github is getting a full 1% of baidu's traffic. I wonder if they're getting the search terms. I bet they're getting cookies. The ultimate mitigation might be google paying to show the results instead of baidu. Or just showing their own ads.
- jonny_eh 12y ago
  Github wouldn't get baidu's cookies since they're different domains.
  - eloisant 12y ago
    They could if they put code to read cookies in JS and send them home in the JS included in people's pages.
    - jonny_eh 12y ago
      Good point, all the more reason page authors should use httpOnly cookies: https://www.owasp.org/index.php/HttpOnly https://www.owasp.org/index.php/HttpOnly

igammarays 12y ago

Who said this would only be for a few hours? DDOSing Github drives up their hosting costs massively, creating a financial incentive to comply with China's demands. Aside from that, it's just Eastern politics, which works by a whole lot of bullying and childish tactics when they don't get their way. Not to say that it doesn't happen in Western politics, just much more subtly. And it doesn't seem so bad since we're the good guys.

dmfdmf 12y ago
> And it doesn't seem so bad since we're the good guys. Post-Snowden, check your premises.
- carboncopy 12y ago
  > And it doesn't seem so bad since we're the good guys. I'm pretty sure that was meant to be tongue-in-cheek. > Post-Snowden, check your premises. What premise are you making? That the United States conducts espionage?
  - lazaroclapp 12y ago
    You know that post down there somewhere in this thread that says that having classified state secrets is the same as having widespread political censorship? That's the kind of gulf between saying the U.S. "conducts espionage" and the fact that it also conducts mass surveillance of billions of people ;) But I am with you on the broader point, "we're the good guys" was probably meant sarcastically, since very few people outside of Fox news commentators would say it un-ironically about the U.S. (or any country as a whole, really).
- deleted 12y ago
  [deleted]

j42 12y ago

Actually, someone here (who I cannot remember) said quite eloquently yesterday that our biggest export--and "influence" on the world--is culture. For the first time I realized that pissing people off may, in fact be the objective as the other reply stated. China and Russia are both (quite unique) examples of countries with an unfathomable degree of control over their citizens. It can be hard to grasp occasionally, coming from a western mindset but for the vast majority within said countries, the entire reality they see and what they believe to be true is heavily distorted--in that, it is defined by the vision of the oligarchy and information is carefully controlled to produce a desired set of beliefs. North Korea is an extreme caricature of this pattern. Technology is naturally subversive to this as it lets people interact directly with other cultures and ideologies which may provide contrasting philosophies and--terrifyingly--the opportunity for free thought. Restrict access to technology and you'll have a revolution. Instead, you become the "troll," or the "problem," and quietly become isolated from large areas of the network, all while reducing the amount of information you have to sift through before passing it along to the populace, in the name of security. And while the effect on actual traffic may be minimal, it does make for a very cold perception which generally makes cross-cultural integration unlikely. How many western consumer-technology companies do you see integrating with Asia-based API's/demand, compared to other industry, let alone academics?

karcass 12y ago
> the entire reality they see and what they believe to be true is heavily distorted--in that, it is defined by the vision of the oligarchy and information is carefully controlled to produce a desired set of beliefs. That's pretty much how I feel about the Fox-watching population of the US.
- carboncopy 12y ago
  > That's pretty much how I feel about the Fox-watching population of the US. I used to think the same thing, and to some degree I think it holds truth. But after spending lots of time with my right-wing family, I think it's a bit more nuanced than that. Most avid Fox News watchers I've met fail to embrace the entire world-view or vision promoted on the channel, and share maybe 60-70% of the opinions elicited toward viewers. I know, it's just one data point, but I don't have a study handy.

jfoutz 12y ago

It seems completely bizarre. At least the government has the wisdom to not publicly take credit for it. It looks really bad when one of the most powerful nations on earth, over a billion strong, can't stop a little 300 person operation. Github is smart and talented, and i'm sure that bandwidth cost is horrible. But they are up against an organization 7 orders of magnitude larger, and seem to be holding up just fine. I kinda hope China comes out and says, whoops, unauthorized sneaky hackers. Github's resilience makes them look like a joke.

jauer 12y ago
At this point do they really have a option besides continue until Github caves because of mounting costs? Admitting whoops, unauthorized sneaky hackers co-opted our national packet mangling infrastructure would be a LOT of egg on their face.
- jfoutz 12y ago
  That's a big freaking gamble. How effective does Github's mitigation need to be to make the costs tolerable? They're already using a full 1% of the traffic to ddos, they can only double that 7 times. Really, at this point Github could probably put together a really nice blacklist of baidu users outside of china, and whitelist those that actually use the service. I can think of a couple of cute ways to accelerate the whitelisting. Banking on Github not finding a good enough solution seems really risky. Why not just ddos every time there's positive Github news? Ideally a half hour in advance of the event? China must know when MS is going to host some cool new project. China must know when the U.S. data service is going to host a cool new project. China must know when Github is going to announce a new feature. This approach is just super half assed.
  - rsuelzer 12y ago
    Side question, does GitHub run ruby on rails? If so, I'm pretty impressed.
    - 12y ago

DannyBee 12y ago

Interestingly, i believe these same projects used to get attacked on code.google.com as well

gbog 12y ago

I'm working in a 100% Chinese high-tech company, and asked my colleagues: they think it is just a test (that was my first impression too).

methou 12y ago
This means A LOT to the rest of the world. China in history always claims that they don't intervene with things of other country, but in these days, they shamelessly attacked an US company.
GhotiFish 12y ago
What do they think China is testing?

pjlegato 12y ago

I think you answered your own question.. > What's the actual goal behind the attack? > pissing the whole world off for a few hours

untog 12y ago

Both of the targets for their DDOS were projects to help you circumvent their firewall. If it happened to also bring down Github at the same time I doubt they cared too much.

annnnd 12y ago

Testing their DDoS "weapons" may also be a good reason. Of course, protection will also get better, so it's a double edged sword (for them).

muyuu 12y ago

It's hard to tell if this is a decision from high up in China's PRC ranks, or lower in the ranks, or even a false flag/experiment. It highlights how XSS attacks can target arbitrary sites extremely efficiently, just by finding a strong vector origin point to deface (like Baidu's foreign filter JS).

belorn 12y ago

I see many goals, but I find it most likely that this was the digital version of a weapon test. The arbitrary use of 1% and the simplicity of the attack seems perfect for demonstrating a capability. As a bonus, they get to send a message about circumventing, see the effectiveness, and test defenses against it. All without having to official claim credit for it.

misja111 12y ago

>> What's the actual goal behind the attack? The answer to that question is in the article: "As can be seen in the code, the two targeted URLs are github.com/greatfire and github.com/cn-nytimes, which are mirror sites for GreatFire.org and the Chinese New York Times. GreatFire and NYT both use GitHub to circumvent the online censorship performed by the Great Firewall of China (GFW)."