4 ms·
One thing I don't understand: when you have the infrastructure to run the Great Firewall, why not simply generate the traffic yourself ? At this point you might
by Aissen 12y ago
One thing I don't understand: when you have the infrastructure to run the Great Firewall, why not simply generate the traffic yourself ? At this point you might just fake traffic from inside China with any kind of amplifiable no-state protocol.
Sure, the TCP/HTTP attack might be a bit more resource intensive, but it should be doable with the same capabilities provided by their DPI infrastructure, no ?
Edit: Last but not least, if we are sure that this attack is indeed coming from the GFW, then why Obama isn't calling Xi Jinping right now ?
- martinald 12y agoBecause non-chinese visitors (who aren't behind the Great Firewall) also get served this malicious javascript if they load up the code. It's not just Chinese visitors that visit these sites and therefore get the JS code.
- Aissen 12y agoOh, I had missed that ! I thought GFW was for clients, never thought it would apply on servers too.
- shawabawa3 12y ago> why not simply generate the traffic yourself ? Couldn't github simply null-route all chinese-origin traffic in that case? Currently the DDoS comes from everywhere except china
- Aissen 12y agoYeah, as I explained in reply to martinald, I had missed that. This is indeed a clever tactic. And very bad for Baidu's business, they must be outraged.
- adaml_623 12y agoThe point of this DDoS attack is to prevent people in China from accessing content on github. To null-route chinese-origin traffic would mean that the attackers win. (Obviously VPNs could be used to circumvent this null-route but they then become vulnerable to the same attack)
- shawabawa3 12y ago> The point of this DDoS attack is to prevent people in China from accessing content on github. To null-route chinese-origin traffic would mean that the attackers win. China already has the capability to block people in china accessing github (and I assume it does)
- cxseven 12y agoThe current attack injects two TCP packets containing javascript that makes a person's web browser perform endless requests to the two Github URLs that host the apparent targets. This is a huge amplification. Also, the attacker is hitting fewer than 1% of the Baidu Analytics requests, which might indicate that the attacker is overloaded. In that case they don't yet have unlimited access to Chinese bandwidth.