3 ms·
Baidu have not been hacked. Their servers reside inside the great firewall meaning any request from outside China has to traverse the GFW before arriving at Bai
by corford 12y ago
Baidu have not been hacked. Their servers reside inside the great firewall meaning any request from outside China has to traverse the GFW before arriving at Baidu's servers. During traversal of the GFW, the Chinese gov is modifying the Baidu server response with malicious javascript.
Baidu has no say in the matter. They could try and help Github by swapping to only serving their analytics scripts over HTTPS. Even then, this would only help once a large majority of existing websites that use Baidu analytics have updated their website code to point to the HTTPS URL. Until then the attack would probably still continue to work.
- johnbellone 12y agoIt sounds like to me despite Baidu not being involved they are being used as a vector of attack. It seems reasonable for anyone using Baidu to find an alternative for all of their services. After seeing that China is modifying responses how can we trust any request that goes past the GFW?
- kbart 12y ago"It seems reasonable for anyone using Baidu to find an alternative for all of their services." As always, majority of them simply don't care. Did many people stopped using Google after Snowden's leak on this side of GFW?
- corford 12y ago>After seeing that China is modifying responses how can we trust any request that goes past the GFW You can't unless it's an HTTPS request (and even then you may still want to be suspicious).
- csteinbe 12y agoFor HTTP connections, is there a current best practice that a javascript author can use to make sure that their code hasn't been modified by a MitM prior to execution on the browser?
- corford 12y agoUse HTTPS. That's it. With HTTP any part of a web page's code can be altered/replaced by a MitM attack. So any theoretical protection a javascript author put in place to try and detect a MitM attack could also easily be circumvented.