12 ms·

Pin-pointing China's attack against GitHub

305 points by zmanian 12y ago

finnn 12y ago
That's cool, I didn't know how traceroutes work. Is he planning on releasing the http traceroute tool?
- cleverjake 12y ago
  you should comment there to ask them
- itistoday2 12y ago
  Here ya go: https://github.com/robertdavidgraham/masscan https://github.com/robertdavidgraham/masscan @collinrm I just took masscan, changed the HTTP request, then tweeked the code to generate a small TTL. Source: https://twitter.com/ErrataRob/status/583433175302479872 https://twitter.com/ErrataRob/status/583433175302479872
  - blacksmith_tb 12y ago
    On OSX, it's available via Homebrew, brew install masscan
zombination 12y ago
This is important evidence for our government. It'll be interesting to see how they respond to these attacks -- attacks by a nation state against key United States Internet infrastructure. It seems a bit of a stretch to say that Github is "key US Internet infrastructure"...
- yeskia 12y ago
  Isn't GitHub hosted on AWS, which as a platform is pretty significant.
  - klaustopher 12y ago
    GitHub used to be hosted on EngineYard in the beginning, but later moved to bare metal servers at RackSpace: https://github.com/blog/493-github-is-moving-to-rackspace https://github.com/blog/493-github-is-moving-to-rackspace
- andyfleming 12y ago
  I don't know that it is "key US Internet infrastructure", but it's important to a lot of developers and companies. Thankfully GitHub handled the attack pretty well. Disclaimer: I'm not sure what actual usage stats are like for GitHub.
- Daishiman 12y ago
  If GitHub were down for two days that's a metric shitload of projects that can't get deployed. There's a significant number of software projects with dependencies on Github-hosted stuff.
  - a3n 12y ago
    If github were down for two days, you're probably right, those projects can't be deployed. But if github were down for two months, the nature of git suggests that deployment for those many individual projects would shift either to the originators' infrastructure, or some other aggregating service.
    - jonalmeida 12y ago
      This is true but very limited as well. GitHub isn't used for just git now, it's also an issue tracker, a wiki (yes, those are repos as well, but you don't usually have them sync'd), Github-only services (e.g. Travis), package managers (e.g. Cocoapods and Crates). There is a lot riding on GitHub that developers use. Hell, even closed-source companies sometimes use empty GitHub repos so they can use Issues for openly available tracking.
mfkp 12y ago
While this is a very interesting read (learned a thing or two), the author's conclusion is a bit suspect. Using my custom http-traceroute, I've proven that the man-in-the-middle machine attacking GitHub is located on or near the Great Firewall of China. Although suspicious, it seems one would need to know a lot more about China Unicom and their infrastructure to say this conclusively.
- deleted 12y ago
  [deleted]
- mikekchar 12y ago
  I apologize because I have not had time to really looking into this closely, but I think you are correct that the author's conclusions need to be reviewed. He repeatedly says that it is a man in the middle attack, but the link he points to says it is a man on the side attack. This is a very different beast: a man on the side attack does not rewrite packets, but rather uses it's position on the backbone to send replacement packets that will arrive before the real ones do. Also, the referenced link states that these packets are being sent on only 1% of responses. So if this is the case a traceroute is probably not going to find the issue. The offending node does not have to respond at all -- especially if it sends the bogus packets by a different route. Again, I have not looked at this in detail yet and probably won't have time for a few days. I would welcome a discussion on this point.
  - makomk 12y ago
    Because it's a man on the side attack, it sends its attack packets when it sees the original request. He's taking advantage of this by lowering the TTL so that the request never actually reaches the destination server and only the system doing the attack is able to respond.
  - tedunangst 12y ago
    The man in the middle attack was injecting javascript to recruit unwitting man on the side attackers against github. github was not being MITM'd, but its "attackers" were. edit: above may be imprecise. I went back and read the original more closely. they note that if they artificially drop an injected packet, it doesn't get resent (and hence the conclusion that it's man on the side), but they don't mention whether they get the original packets or not. If something is blocking the original baidu packets, it would have to be in the middle, not just on the side.
whoopdedo 12y ago
To say that the "Chinese government" is involved I think understates the situation. We know as fact that their army has invested considerable time and money in a cyberwarfare unit. And that the company that operates the Firewall is a military contractor. When Sony was hacked a few months ago, the media couldn't wait to label it a "terrorist act" by North Korea. I just now searched Google News for "github terrorism". 1. http://www.itpro.co.uk/security/24319/github-falls-victim-to-possible-chinese-cyber-attack http://www.itpro.co.uk/security/24319/github-falls-victim-to... 2. https://grahamcluley.com/2015/03/github-ddos-attack/ https://grahamcluley.com/2015/03/github-ddos-attack/ That's all, even though the evidence appears more clear that the Chinese government is involved. Whereas North Korea's responsibility was in doubt. The silence speaks volumes. But is "terrorism" even the correct word for this? When Saddam invaded Kuwait, was that a terrorist act? Consider this quote written by a Chinese military analyst 30 years ago: those who take part in information war are not all soldiers. Anybody who understands computers may become a "fighter" on the network. Think tanks composed of non-governmental experts may take part in decision-making; rapid mobilization will not just be directed to young people; information- related industries and domains will be the first to be mobilized and enter the war.. (From http://fmso.leavenworth.army.mil/documents/chinarma.htm http://fmso.leavenworth.army.mil/documents/chinarma.htm) However, the Chinese may respond by claiming this was a preemptive defense. That GreatFire.com was designed to weaken their security and they were justified in taking action to protect the sovereignty of their computers. Haven't western nations done the same when they were threatened by terrorism or nuclear arms? It seems to me that we have officially entered the era of a weaponized internet.
- methou 12y ago
  > It seems to me that we have officially entered the era of a weaponized internet. Couldn't agree more. And GFW is indeed a WMD that must be stopped.
  - 1stop 12y ago
    ... I can't tell if this is sarcasm or serious. But seriously... What "Mass destruction" can the GFW cause? ... Like Amazon/Azure/Rackspace are WMDs under your current definition?
phelmig 12y ago
That the server is located in China doesn't proof anything.
- simonh 12y ago
  This analysis doesn't just prove the attack orriginated in China, it shows that it takes place immediately inside the first Chinese network the connection reaches on it's way into China. The second piece of analysis shows that this is the same network layer in which the network blocking performed by the Great Firewall occurs. So the great firewall and this attack are both being implemented at the same point in the network infrastructure.
  - maxerickson 12y ago
    I think an interesting question is how likely it is that some of the great firewall is compromised. (It could be by some party outside of China, or by some group inside of the Chinese government that does not have an official mandate to use it for things like the Github attack)
    - smilekzs 12y ago
      Extremely unlikely. GFW is, ironically, considered "critical infrastructure" and is closely monitored.
      - dragonwriter 12y ago
        Ironically? How is it ironic that a centerpiece of the he Chinese Government's control and monitoring of information is considered critical infrastructure and closely monitored by the Chinese Government?
        smilekzs 12y ago
        I was saying "ironic" as this article classifies GitHub as important infrastructure. But anyway I totally agree with you.
dexcs 12y ago
Is there a statement from github what they think who did the ddos?
- kiliankoe 12y ago
  No and there probably won't be. Them publicly saying they were being attacked by the Chinese government would put them on some seriously questionable legal ground. They definitely went the right route by not saying anything.
  - stevenh 12y ago
    Which laws would they be violating by announcing they were attacked by China?
    - ptaipale 12y ago
      A number of Chinese laws, or executive orders or whatever, actually might be violated.
nickodell 12y ago
When TPB was pretending to be in North Korea, someone proved that they weren't, [1] because of how quickly they responded to a ping. Could someone narrow down the physical location of the firewall similarly? [1]: https://rdns.im/the-pirate-bay-north-korean-hosting-no-its-fake-p2 https://rdns.im/the-pirate-bay-north-korean-hosting-no-its-f...
- mirashii 12y ago
  You can really only use a method like this to say where a server is not (it can't be halfway around the world because the speed of light limits it), but this is assuming you're communicating directly with the server. The method used to inject these packets on the wire makes this sort of analysis even harder to do this sort of analysis (and if there was concern, appropriate amounts of random delay and noise could be added).
  - nickodell 12y ago
    >The method used to inject these packets on the wire makes this sort of analysis even harder to do this sort of analysis I was under the impression that this was a man on the side attack, so they'd sent a bogus SYN-ACK back to you the moment that they saw a SYN. Theoretically, you should still only be dealing with one RTT. >(and if there was concern, appropriate amounts of random delay and noise could be added). I don't think China cares if it gets traced back to them.
    - methou 12y ago
      > I don't think China cares if it gets traced back to them. No they don't, and when time arrives, they deny whatever the accusation is, and claims it's a defamation.
      - flipp3r 12y ago
        They already did this a couple days ago when someone asked them about it http://www.fmprc.gov.cn/mfa_eng/xwfw_665399/s2510_665401/2511_665403/t1250354.shtml http://www.fmprc.gov.cn/mfa_eng/xwfw_665399/s2510_665401/251... "On your second question, it is quite odd that every time a website in the US or any other country is under attack, there will be speculation that Chinese hackers are behind it."
Ashwinning 12y ago
"blocking GitHub is not really a viable option" he said. Tell that to the world's craziest democracy - India, which banned GitHub, Vimeo, Pastebin and a bunch of others in December last year. Some bans were lifted later. Source : http://www.zdnet.com/article/india-blocks-32-websites-including-github-internet-archive-pastebin-vimeo/ http://www.zdnet.com/article/india-blocks-32-websites-includ...
- ptaipale 12y ago
  I think that action was somewhat different in nature, though. It's an instance of Vogon-type bureaucracy that sends blocking orders to Internet service providers without an understanding of the issues. I presume the Indian government is not actively trying to shut down VPNs that people use to access this kind of resources. In short, I believe the Chinese government knows what it is doing, while the Indian government does not.
  - enupten 12y ago
    "Vogon-type": that's mind-bogglingly accurate!
    - ptaipale 12y ago
      By the way, in my career of 25 years of professional software development, I've only once delivered something that was certified to be bug-free. That was when the company transferred our work, and the test servers, to India. We shipped the machines, and to send them, they had to be packed on pallets. The pallets were wooden. For Indian customs bureaucracy, I had to arrange a paper called phytosanitary certificate, which states that the wood has no bugs.
- dimmuborgir 12y ago
  Only Gist was blocked, not Github. It was a knee-jerk reaction to a court order after ISIS made a series of threats and some Indians were found to be in contact with the ISIS. All those sites were unblocked soon after.
- 12y ago
eaxitect 12y ago
I don't agree with author's conclusion, having a server in a chinese ISP does not mean it's orchestrated by chinese gov. Also, I don't suppose MITM attack organizers have no clue about how TTL works.
- orf 12y ago
  They didn't have a clue about $.ajax with a 'script' data type did they?
  - eaxitect 12y ago
    So they should be chinese gov, right?
methou 12y ago
I have a question with the method, hypothetically, if I am the attacker, I know the ttls of each packets tha tis passing through, right? So when I get a packet with ttl so small that won't survive long enough to reach the target, instead of altering, I just leave it along. So the probe will never know where I am in the route.
- jacquesm 12y ago
  But upstream providers within the TTL range will. And during a DDoS like this you can bet that everybody in the chain that is on the good side is in constant communication.
  - brudgers 12y ago
    A sufficiently sophisticated man in the middle can be anywhere between origin and destination and have arbitrary distribution. Proving that a particular node is responsible for a particular alteration requires using a trusted trust computer to send packets into the great wall on their first hop. The experiment in the article required trusted trust of packets destined for the great wall passing through US infrastructure. That this infrastructure can generally be considered neutral is no guarantee that it was in this case. Any router or switch can use arbitrary tables and conditional logic on any packet. The purpose of the experiment was prosecuting a particular suspect not arm's length analysis.
    - jacquesm 12y ago
      So that experiment would need to be repeated in a distributed manner from as many points of origin as possible. A friend of mine runs a honeypot service that uses servers all around the planet, someone like him would be in a good position to run analysis like this.
      - brudgers 12y ago
        Logically, sufficient distribution of testing doesn't negate sufficient distribution of evil demons. Practically, if the evil demon has state actor level resources, it is more likely to have sufficient distribution than an ordinary commercial or private interest. On the other hand, I don't think it's really necessary to prove with technology that the 中國人民解放軍 is behind this. Diplomatic logic is sufficient. The behavior is simply an internet equivalent to jamming the Voice of America.[1] Github is broadcasting. The 中华人民共和国 has a sovereign's policies regarding broadcasting. The 中國人民解放軍 executes those policies. Github operates with a business model that ignores sovereigns at its own peril. Calling one sovereign for aid when dealing with another sovereign also carries peril. Allowing political content in an online community always comes with the risk of trolling and flamewars. A hands off editorial policy only means Github hasn't made a tough decision about what the Github community is not. Decision day can only be put off so long. [1]: http://en.wikipedia.org/wiki/Voice_of_America http://en.wikipedia.org/wiki/Voice_of_America
simula67 12y ago
China is the second most powerful country in the world. Do people really think they are that stupid ? They are not going to attack an American company using infrastructure that anyone can track back to them. This Github DDoS has got to be the work of someone trying to frame the Chinese government. Has anyone considered that angle ?
- prawn 12y ago
  What's going to happen if they are known to be the attackers but can issue denials? No one is going to pull them up on it.
- stefantalpalaru 12y ago
  Take a look at this brand new executive order authorizing economical and financial sanctions against global "cyber threats": https://www.whitehouse.gov/blog/2015/04/01/our-latest-tool-combat-cyber-attacks-what-you-need-know https://www.whitehouse.gov/blog/2015/04/01/our-latest-tool-c... This GitHub business looks more and more like a false flag operation.
  - jacquesm 12y ago
    How does 'economical and financial sanctions' equate to 'Whitehouse gives order to start false flag operation against github'? The more that comes out and the more silence there is from the Chinese government the less it looks like a false flag operation. Usually the victim of a false flag operation (China in this case, not github) would be very adamant about its non-involvement and would work very hard to expose the originator.
    - stefantalpalaru 12y ago
      Yes, just like if Glenn Beck really did not rape and murder a young girl in 1990 he would be very adamant about his non-involvement and would work very hard to expose the actual culprit: http://en.wikipedia.org/wiki/Beck_v._Eiland-Hall http://en.wikipedia.org/wiki/Beck_v._Eiland-Hall
jokoon 12y ago
In the end, I wonder if the purpose of the great firewall is not for China to defend itself against foreign cyber attacks or because "free internet" might not benefit China currently. I'm sure computers are now mainstream enough that it would matter for any country to put cyber warfare as a key strategy. The US and the west dominate through open trade and easy communications and free speech. Maybe that makes China vulnerable, and they're trying to defend themselves economically. You can accuse China all you want, but if you're an american, it's harder to listen to those accusations.
- brudgers 12y ago
  The US spent more than 50 years protecting its residents from Cuban sugar and Cuban cigars and sunburns on Cuba's beaches. Such are the absurdities of powerful sovereigns.
brudgers 12y ago
The article is titled: Pin-pointing China's attack against GitHub
baconschizer 12y ago
Is this April fool joke? Or are you guys really taking this whole Chinese government theory seriously? If you were leading a 1.6bn populated country how much you would care about a programmer's code site? To give all those conspiracy theorists a clear picture, what really happened is merely the scale of problem you have never worked on or dreamed to be working on outside China. This happened year ago when a Chinese state funded train ticket booking website accidentally deployed to production with a opensourced Javascript vendor file still linked to github. And first day that site went live, 30 billion visitors tried to secure a ticket for coming Chinese New Year, when took down github for a good while. Yes it was a DDOS attack from China, by train ticket buyers. Last November, Chinese online c2c marketplace TaoBao.com, saw 16.7bn transactions in one day, with more than 1 billion CNY settled in a minute. If any of the web dev responsible for even a small promotion page left a link of cool jquery plugin from GitHub, you could have written another holy crap evil government attack post here.
- snowwolf 12y ago
  I made a similar comment elsewhere in the thread, but lets assume it's not the Chinese government and it's something accidentally deployed or a hack by some unknown entity. Why is the code still running a week later? It doesn't take that long to find the offending server/s code and remove it. Especially as it is making the Chinese government look bad, there would be added incentive to fix this pretty quickly.
  - weberc2 12y ago
    If it was an "accident" that made the Chinese government look bad, we would be hearing about the "unrelated" murder of magistrates by now.
peterwwillis 12y ago
> While many explanations are possible, such as hackers breaking into these machines, the overwhelmingly most likely suspect for the source of the GitHub attacks is the Chinese government. Correlating the circumstantial facts that China has a giant firewall, the content being blocked is getting around China's firewall, and an attack came from somewhere deep in one of China's largest backbone providers, does not make an 'extreme likelihood'; it makes a weak correlation. Likelihood requires reviewing known outcomes to determine a likely result. What other known evidence of specifically these three behaviors by the Chinese government are you basing this conclusion on? > This is important evidence for our government. You've taken a massive leap in logic from a machine inside China manipulating global traffic to attack servers in the US, to conclude that it is more likely to have been the Government than anyone else. This is exactly the same as saying any attack originating from the US which appears to be related to US interests must be from the US government. If this was the basis for how we concluded all investigations into illegal actions, anyone who 'looked like' they did it would be found guilty, sans evidence. That may be how other nations' justice system works, but not ours. Furthermore, in no way is either Github or Baidu's analytics considered 'key US Internet infrastructure'. I mean, Git is even a decentralized system - people can still get work done if it's down! This is not evidence of the Chinese government's complicity, and pretending it is creates a dangerous logical fallacy that could improperly shape public opinion.
moe 12y ago
This mouth-breathing Bullshit really needs to stop. the overwhelmingly most likely suspect for the source of the GitHub attacks is the Chinese government. Why would the "Chinese government" carry out an open attack against an american company for absolutely no potential gain at all? Do you really think they are stupid enough to believe such an attack could remove these two software packages from the internet?
- wnevets 12y ago
  What is the diplomatic downside for china exactly? If China can occupy & claim other countries territory in the face of international pressure without a problem, what makes you think a convert op to DDoS github is out of the question?
  - moe 12y ago
    what makes you think a convert op to DDoS github is out of the question? The fact that this attack doesn't pass even a most cursory risk/reward analysis. Anyone with the technical smarts to carry it out must be well aware that there is zero upside potential for China. The targeted projects are not gonna disappear, github is not gonna disappear. All possible outcomes are negative; The targeted projects get extra media attention (Streisand effect), the "Cyberwar" narrative in the west is fueled (cf. this HN thread), in the worst case there could even be a minor diplomatic quarrel with the US. What do they have to win here?
    - wnevets 12y ago
      I see several wins for china, the first one is showing off the offensive power of their "great firewall". Not everyone has the ability to withstand such an attack, the chilling effect is real.
      - moe 12y ago
        What chilling effect? Github is up and running after all. Both targeted projects are online: https://github.com/greatfire https://github.com/cn-nytimes Looks like if you want to mess with China then all you have to do is put your material on Github. You think that is the lesson China wanted to teach the world?
BhavdeepSethi 12y ago
I don't get it. Why doesn't GFW just block those github pages in particular? A lot of people can fork these repos but they won't be anywhere popular to the current pages.
- shaftoe 12y ago
  HTTPS. They can't tell what URL a user is requesting.
  - y0ghur7_xxx 12y ago
    > HTTPS. They can't tell what URL a user is requesting. I am sure they have a private key of some of the CAs shipped with major browsers lying around somewhere...
    - fabulist 12y ago
      I believe the chinese government actually operates a CA. But it isn't worth it to them to expend such a valuable asset on an operation like that.
cschramm 12y ago
There's absolutely no proof in this. The fact that a request with a TTL smaller than 12 does not trigger a response does not mean the responder is the host after 12 hops. Assuming none of the previous hosts misbehaves (they could be increasing or at least not decreasing the TTL) you can only conclude that it is none of the later hosts, but it can still be any of the previous ones. That leaves you with Comcast AND China Unicom hosts and, considering that the replies you see in the traceroute results can easily be spoofed, it can be any third party as well. Possible scenarios include (I don't say they are more likely): 1. Comcast is producing the responses, but only does so if the request TTL is large enough to make you blame China Unicom. 2. China Unicom hands the packets over to a third party after just a few hops in their backbone. The third-party sends ICMP Time exceeded messages looking like they are from other China Unicom hosts to make you blame China Unicom. Conclusion: This is either an obvious attack from within the China Unicom backbone OR a more sophisticated attack where the attacker wants to a) hide his identity and b) blame China Unicom for it (I can't think of a scenario where b) would be a by-product and not on purpose). Just saying. The sentences in the post that include the words "prove" and "proven" are simply wrong.

305 points by zmanian 12y ago

finnn 12y ago

That's cool, I didn't know how traceroutes work. Is he planning on releasing the http traceroute tool?

cleverjake 12y ago
you should comment there to ask them
itistoday2 12y ago
Here ya go: https://github.com/robertdavidgraham/masscan https://github.com/robertdavidgraham/masscan @collinrm I just took masscan, changed the HTTP request, then tweeked the code to generate a small TTL. Source: https://twitter.com/ErrataRob/status/583433175302479872 https://twitter.com/ErrataRob/status/583433175302479872
- blacksmith_tb 12y ago
  On OSX, it's available via Homebrew, brew install masscan

zombination 12y ago

This is important evidence for our government. It'll be interesting to see how they respond to these attacks -- attacks by a nation state against key United States Internet infrastructure. It seems a bit of a stretch to say that Github is "key US Internet infrastructure"...

yeskia 12y ago
Isn't GitHub hosted on AWS, which as a platform is pretty significant.
- klaustopher 12y ago
  GitHub used to be hosted on EngineYard in the beginning, but later moved to bare metal servers at RackSpace: https://github.com/blog/493-github-is-moving-to-rackspace https://github.com/blog/493-github-is-moving-to-rackspace
andyfleming 12y ago
I don't know that it is "key US Internet infrastructure", but it's important to a lot of developers and companies. Thankfully GitHub handled the attack pretty well. Disclaimer: I'm not sure what actual usage stats are like for GitHub.
Daishiman 12y ago
If GitHub were down for two days that's a metric shitload of projects that can't get deployed. There's a significant number of software projects with dependencies on Github-hosted stuff.
- a3n 12y ago
  If github were down for two days, you're probably right, those projects can't be deployed. But if github were down for two months, the nature of git suggests that deployment for those many individual projects would shift either to the originators' infrastructure, or some other aggregating service.
  - jonalmeida 12y ago
    This is true but very limited as well. GitHub isn't used for just git now, it's also an issue tracker, a wiki (yes, those are repos as well, but you don't usually have them sync'd), Github-only services (e.g. Travis), package managers (e.g. Cocoapods and Crates). There is a lot riding on GitHub that developers use. Hell, even closed-source companies sometimes use empty GitHub repos so they can use Issues for openly available tracking.

mfkp 12y ago

While this is a very interesting read (learned a thing or two), the author's conclusion is a bit suspect. Using my custom http-traceroute, I've proven that the man-in-the-middle machine attacking GitHub is located on or near the Great Firewall of China. Although suspicious, it seems one would need to know a lot more about China Unicom and their infrastructure to say this conclusively.

deleted 12y ago
[deleted]
mikekchar 12y ago
I apologize because I have not had time to really looking into this closely, but I think you are correct that the author's conclusions need to be reviewed. He repeatedly says that it is a man in the middle attack, but the link he points to says it is a man on the side attack. This is a very different beast: a man on the side attack does not rewrite packets, but rather uses it's position on the backbone to send replacement packets that will arrive before the real ones do. Also, the referenced link states that these packets are being sent on only 1% of responses. So if this is the case a traceroute is probably not going to find the issue. The offending node does not have to respond at all -- especially if it sends the bogus packets by a different route. Again, I have not looked at this in detail yet and probably won't have time for a few days. I would welcome a discussion on this point.
- makomk 12y ago
  Because it's a man on the side attack, it sends its attack packets when it sees the original request. He's taking advantage of this by lowering the TTL so that the request never actually reaches the destination server and only the system doing the attack is able to respond.
- tedunangst 12y ago
  The man in the middle attack was injecting javascript to recruit unwitting man on the side attackers against github. github was not being MITM'd, but its "attackers" were. edit: above may be imprecise. I went back and read the original more closely. they note that if they artificially drop an injected packet, it doesn't get resent (and hence the conclusion that it's man on the side), but they don't mention whether they get the original packets or not. If something is blocking the original baidu packets, it would have to be in the middle, not just on the side.

whoopdedo 12y ago

To say that the "Chinese government" is involved I think understates the situation. We know as fact that their army has invested considerable time and money in a cyberwarfare unit. And that the company that operates the Firewall is a military contractor. When Sony was hacked a few months ago, the media couldn't wait to label it a "terrorist act" by North Korea. I just now searched Google News for "github terrorism". 1. http://www.itpro.co.uk/security/24319/github-falls-victim-to-possible-chinese-cyber-attack http://www.itpro.co.uk/security/24319/github-falls-victim-to... 2. https://grahamcluley.com/2015/03/github-ddos-attack/ https://grahamcluley.com/2015/03/github-ddos-attack/ That's all, even though the evidence appears more clear that the Chinese government is involved. Whereas North Korea's responsibility was in doubt. The silence speaks volumes. But is "terrorism" even the correct word for this? When Saddam invaded Kuwait, was that a terrorist act? Consider this quote written by a Chinese military analyst 30 years ago: those who take part in information war are not all soldiers. Anybody who understands computers may become a "fighter" on the network. Think tanks composed of non-governmental experts may take part in decision-making; rapid mobilization will not just be directed to young people; information- related industries and domains will be the first to be mobilized and enter the war.. (From http://fmso.leavenworth.army.mil/documents/chinarma.htm http://fmso.leavenworth.army.mil/documents/chinarma.htm) However, the Chinese may respond by claiming this was a preemptive defense. That GreatFire.com was designed to weaken their security and they were justified in taking action to protect the sovereignty of their computers. Haven't western nations done the same when they were threatened by terrorism or nuclear arms? It seems to me that we have officially entered the era of a weaponized internet.

methou 12y ago
> It seems to me that we have officially entered the era of a weaponized internet. Couldn't agree more. And GFW is indeed a WMD that must be stopped.
- 1stop 12y ago
  ... I can't tell if this is sarcasm or serious. But seriously... What "Mass destruction" can the GFW cause? ... Like Amazon/Azure/Rackspace are WMDs under your current definition?

phelmig 12y ago

That the server is located in China doesn't proof anything.

simonh 12y ago
This analysis doesn't just prove the attack orriginated in China, it shows that it takes place immediately inside the first Chinese network the connection reaches on it's way into China. The second piece of analysis shows that this is the same network layer in which the network blocking performed by the Great Firewall occurs. So the great firewall and this attack are both being implemented at the same point in the network infrastructure.
- maxerickson 12y ago
  I think an interesting question is how likely it is that some of the great firewall is compromised. (It could be by some party outside of China, or by some group inside of the Chinese government that does not have an official mandate to use it for things like the Github attack)
  - smilekzs 12y ago
    Extremely unlikely. GFW is, ironically, considered "critical infrastructure" and is closely monitored.
    - dragonwriter 12y ago
      Ironically? How is it ironic that a centerpiece of the he Chinese Government's control and monitoring of information is considered critical infrastructure and closely monitored by the Chinese Government?
      - smilekzs 12y ago
        I was saying "ironic" as this article classifies GitHub as important infrastructure. But anyway I totally agree with you.

dexcs 12y ago

Is there a statement from github what they think who did the ddos?

kiliankoe 12y ago
No and there probably won't be. Them publicly saying they were being attacked by the Chinese government would put them on some seriously questionable legal ground. They definitely went the right route by not saying anything.
- stevenh 12y ago
  Which laws would they be violating by announcing they were attacked by China?
  - ptaipale 12y ago
    A number of Chinese laws, or executive orders or whatever, actually might be violated.

nickodell 12y ago

When TPB was pretending to be in North Korea, someone proved that they weren't, [1] because of how quickly they responded to a ping. Could someone narrow down the physical location of the firewall similarly? [1]: https://rdns.im/the-pirate-bay-north-korean-hosting-no-its-fake-p2 https://rdns.im/the-pirate-bay-north-korean-hosting-no-its-f...

mirashii 12y ago
You can really only use a method like this to say where a server is not (it can't be halfway around the world because the speed of light limits it), but this is assuming you're communicating directly with the server. The method used to inject these packets on the wire makes this sort of analysis even harder to do this sort of analysis (and if there was concern, appropriate amounts of random delay and noise could be added).
- nickodell 12y ago
  >The method used to inject these packets on the wire makes this sort of analysis even harder to do this sort of analysis I was under the impression that this was a man on the side attack, so they'd sent a bogus SYN-ACK back to you the moment that they saw a SYN. Theoretically, you should still only be dealing with one RTT. >(and if there was concern, appropriate amounts of random delay and noise could be added). I don't think China cares if it gets traced back to them.
  - methou 12y ago
    > I don't think China cares if it gets traced back to them. No they don't, and when time arrives, they deny whatever the accusation is, and claims it's a defamation.
    - flipp3r 12y ago
      They already did this a couple days ago when someone asked them about it http://www.fmprc.gov.cn/mfa_eng/xwfw_665399/s2510_665401/2511_665403/t1250354.shtml http://www.fmprc.gov.cn/mfa_eng/xwfw_665399/s2510_665401/251... "On your second question, it is quite odd that every time a website in the US or any other country is under attack, there will be speculation that Chinese hackers are behind it."

Ashwinning 12y ago

"blocking GitHub is not really a viable option" he said. Tell that to the world's craziest democracy - India, which banned GitHub, Vimeo, Pastebin and a bunch of others in December last year. Some bans were lifted later. Source : http://www.zdnet.com/article/india-blocks-32-websites-including-github-internet-archive-pastebin-vimeo/ http://www.zdnet.com/article/india-blocks-32-websites-includ...

ptaipale 12y ago
I think that action was somewhat different in nature, though. It's an instance of Vogon-type bureaucracy that sends blocking orders to Internet service providers without an understanding of the issues. I presume the Indian government is not actively trying to shut down VPNs that people use to access this kind of resources. In short, I believe the Chinese government knows what it is doing, while the Indian government does not.
- enupten 12y ago
  "Vogon-type": that's mind-bogglingly accurate!
  - ptaipale 12y ago
    By the way, in my career of 25 years of professional software development, I've only once delivered something that was certified to be bug-free. That was when the company transferred our work, and the test servers, to India. We shipped the machines, and to send them, they had to be packed on pallets. The pallets were wooden. For Indian customs bureaucracy, I had to arrange a paper called phytosanitary certificate, which states that the wood has no bugs.
dimmuborgir 12y ago
Only Gist was blocked, not Github. It was a knee-jerk reaction to a court order after ISIS made a series of threats and some Indians were found to be in contact with the ISIS. All those sites were unblocked soon after.
12y ago

eaxitect 12y ago

I don't agree with author's conclusion, having a server in a chinese ISP does not mean it's orchestrated by chinese gov. Also, I don't suppose MITM attack organizers have no clue about how TTL works.

orf 12y ago
They didn't have a clue about $.ajax with a 'script' data type did they?
- eaxitect 12y ago
  So they should be chinese gov, right?

methou 12y ago

I have a question with the method, hypothetically, if I am the attacker, I know the ttls of each packets tha tis passing through, right? So when I get a packet with ttl so small that won't survive long enough to reach the target, instead of altering, I just leave it along. So the probe will never know where I am in the route.

jacquesm 12y ago
But upstream providers within the TTL range will. And during a DDoS like this you can bet that everybody in the chain that is on the good side is in constant communication.
- brudgers 12y ago
  A sufficiently sophisticated man in the middle can be anywhere between origin and destination and have arbitrary distribution. Proving that a particular node is responsible for a particular alteration requires using a trusted trust computer to send packets into the great wall on their first hop. The experiment in the article required trusted trust of packets destined for the great wall passing through US infrastructure. That this infrastructure can generally be considered neutral is no guarantee that it was in this case. Any router or switch can use arbitrary tables and conditional logic on any packet. The purpose of the experiment was prosecuting a particular suspect not arm's length analysis.
  - jacquesm 12y ago
    So that experiment would need to be repeated in a distributed manner from as many points of origin as possible. A friend of mine runs a honeypot service that uses servers all around the planet, someone like him would be in a good position to run analysis like this.
    - brudgers 12y ago
      Logically, sufficient distribution of testing doesn't negate sufficient distribution of evil demons. Practically, if the evil demon has state actor level resources, it is more likely to have sufficient distribution than an ordinary commercial or private interest. On the other hand, I don't think it's really necessary to prove with technology that the 中國人民解放軍 is behind this. Diplomatic logic is sufficient. The behavior is simply an internet equivalent to jamming the Voice of America.[1] Github is broadcasting. The 中华人民共和国 has a sovereign's policies regarding broadcasting. The 中國人民解放軍 executes those policies. Github operates with a business model that ignores sovereigns at its own peril. Calling one sovereign for aid when dealing with another sovereign also carries peril. Allowing political content in an online community always comes with the risk of trolling and flamewars. A hands off editorial policy only means Github hasn't made a tough decision about what the Github community is not. Decision day can only be put off so long. [1]: http://en.wikipedia.org/wiki/Voice_of_America http://en.wikipedia.org/wiki/Voice_of_America

simula67 12y ago

China is the second most powerful country in the world. Do people really think they are that stupid ? They are not going to attack an American company using infrastructure that anyone can track back to them. This Github DDoS has got to be the work of someone trying to frame the Chinese government. Has anyone considered that angle ?

prawn 12y ago
What's going to happen if they are known to be the attackers but can issue denials? No one is going to pull them up on it.
stefantalpalaru 12y ago
Take a look at this brand new executive order authorizing economical and financial sanctions against global "cyber threats": https://www.whitehouse.gov/blog/2015/04/01/our-latest-tool-combat-cyber-attacks-what-you-need-know https://www.whitehouse.gov/blog/2015/04/01/our-latest-tool-c... This GitHub business looks more and more like a false flag operation.
- jacquesm 12y ago
  How does 'economical and financial sanctions' equate to 'Whitehouse gives order to start false flag operation against github'? The more that comes out and the more silence there is from the Chinese government the less it looks like a false flag operation. Usually the victim of a false flag operation (China in this case, not github) would be very adamant about its non-involvement and would work very hard to expose the originator.
  - stefantalpalaru 12y ago
    Yes, just like if Glenn Beck really did not rape and murder a young girl in 1990 he would be very adamant about his non-involvement and would work very hard to expose the actual culprit: http://en.wikipedia.org/wiki/Beck_v._Eiland-Hall http://en.wikipedia.org/wiki/Beck_v._Eiland-Hall

jokoon 12y ago

In the end, I wonder if the purpose of the great firewall is not for China to defend itself against foreign cyber attacks or because "free internet" might not benefit China currently. I'm sure computers are now mainstream enough that it would matter for any country to put cyber warfare as a key strategy. The US and the west dominate through open trade and easy communications and free speech. Maybe that makes China vulnerable, and they're trying to defend themselves economically. You can accuse China all you want, but if you're an american, it's harder to listen to those accusations.

brudgers 12y ago
The US spent more than 50 years protecting its residents from Cuban sugar and Cuban cigars and sunburns on Cuba's beaches. Such are the absurdities of powerful sovereigns.

brudgers 12y ago

The article is titled: Pin-pointing China's attack against GitHub

baconschizer 12y ago

Is this April fool joke? Or are you guys really taking this whole Chinese government theory seriously? If you were leading a 1.6bn populated country how much you would care about a programmer's code site? To give all those conspiracy theorists a clear picture, what really happened is merely the scale of problem you have never worked on or dreamed to be working on outside China. This happened year ago when a Chinese state funded train ticket booking website accidentally deployed to production with a opensourced Javascript vendor file still linked to github. And first day that site went live, 30 billion visitors tried to secure a ticket for coming Chinese New Year, when took down github for a good while. Yes it was a DDOS attack from China, by train ticket buyers. Last November, Chinese online c2c marketplace TaoBao.com, saw 16.7bn transactions in one day, with more than 1 billion CNY settled in a minute. If any of the web dev responsible for even a small promotion page left a link of cool jquery plugin from GitHub, you could have written another holy crap evil government attack post here.

snowwolf 12y ago
I made a similar comment elsewhere in the thread, but lets assume it's not the Chinese government and it's something accidentally deployed or a hack by some unknown entity. Why is the code still running a week later? It doesn't take that long to find the offending server/s code and remove it. Especially as it is making the Chinese government look bad, there would be added incentive to fix this pretty quickly.
- weberc2 12y ago
  If it was an "accident" that made the Chinese government look bad, we would be hearing about the "unrelated" murder of magistrates by now.

peterwwillis 12y ago

> While many explanations are possible, such as hackers breaking into these machines, the overwhelmingly most likely suspect for the source of the GitHub attacks is the Chinese government. Correlating the circumstantial facts that China has a giant firewall, the content being blocked is getting around China's firewall, and an attack came from somewhere deep in one of China's largest backbone providers, does not make an 'extreme likelihood'; it makes a weak correlation. Likelihood requires reviewing known outcomes to determine a likely result. What other known evidence of specifically these three behaviors by the Chinese government are you basing this conclusion on? > This is important evidence for our government. You've taken a massive leap in logic from a machine inside China manipulating global traffic to attack servers in the US, to conclude that it is more likely to have been the Government than anyone else. This is exactly the same as saying any attack originating from the US which appears to be related to US interests must be from the US government. If this was the basis for how we concluded all investigations into illegal actions, anyone who 'looked like' they did it would be found guilty, sans evidence. That may be how other nations' justice system works, but not ours. Furthermore, in no way is either Github or Baidu's analytics considered 'key US Internet infrastructure'. I mean, Git is even a decentralized system - people can still get work done if it's down! This is not evidence of the Chinese government's complicity, and pretending it is creates a dangerous logical fallacy that could improperly shape public opinion.

moe 12y ago

This mouth-breathing Bullshit really needs to stop. the overwhelmingly most likely suspect for the source of the GitHub attacks is the Chinese government. Why would the "Chinese government" carry out an open attack against an american company for absolutely no potential gain at all? Do you really think they are stupid enough to believe such an attack could remove these two software packages from the internet?

wnevets 12y ago
What is the diplomatic downside for china exactly? If China can occupy & claim other countries territory in the face of international pressure without a problem, what makes you think a convert op to DDoS github is out of the question?
- moe 12y ago
  what makes you think a convert op to DDoS github is out of the question? The fact that this attack doesn't pass even a most cursory risk/reward analysis. Anyone with the technical smarts to carry it out must be well aware that there is zero upside potential for China. The targeted projects are not gonna disappear, github is not gonna disappear. All possible outcomes are negative; The targeted projects get extra media attention (Streisand effect), the "Cyberwar" narrative in the west is fueled (cf. this HN thread), in the worst case there could even be a minor diplomatic quarrel with the US. What do they have to win here?
  - wnevets 12y ago
    I see several wins for china, the first one is showing off the offensive power of their "great firewall". Not everyone has the ability to withstand such an attack, the chilling effect is real.
    - moe 12y ago
      What chilling effect? Github is up and running after all. Both targeted projects are online: https://github.com/greatfire https://github.com/cn-nytimes Looks like if you want to mess with China then all you have to do is put your material on Github. You think that is the lesson China wanted to teach the world?

BhavdeepSethi 12y ago

I don't get it. Why doesn't GFW just block those github pages in particular? A lot of people can fork these repos but they won't be anywhere popular to the current pages.

shaftoe 12y ago
HTTPS. They can't tell what URL a user is requesting.
- y0ghur7_xxx 12y ago
  > HTTPS. They can't tell what URL a user is requesting. I am sure they have a private key of some of the CAs shipped with major browsers lying around somewhere...
  - fabulist 12y ago
    I believe the chinese government actually operates a CA. But it isn't worth it to them to expend such a valuable asset on an operation like that.

cschramm 12y ago

There's absolutely no proof in this. The fact that a request with a TTL smaller than 12 does not trigger a response does not mean the responder is the host after 12 hops. Assuming none of the previous hosts misbehaves (they could be increasing or at least not decreasing the TTL) you can only conclude that it is none of the later hosts, but it can still be any of the previous ones. That leaves you with Comcast AND China Unicom hosts and, considering that the replies you see in the traceroute results can easily be spoofed, it can be any third party as well. Possible scenarios include (I don't say they are more likely): 1. Comcast is producing the responses, but only does so if the request TTL is large enough to make you blame China Unicom. 2. China Unicom hands the packets over to a third party after just a few hops in their backbone. The third-party sends ICMP Time exceeded messages looking like they are from other China Unicom hosts to make you blame China Unicom. Conclusion: This is either an obvious attack from within the China Unicom backbone OR a more sophisticated attack where the attacker wants to a) hide his identity and b) blame China Unicom for it (I can't think of a scenario where b) would be a by-product and not on purpose). Just saying. The sentences in the post that include the words "prove" and "proven" are simply wrong.