5 ms·

I have a question with the method, hypothetically, if I am the attacker, I know the ttls of each packets tha tis passing through, right? So when I get a packet

by methou 12y ago

I have a question with the method, hypothetically, if I am the attacker, I know the ttls of each packets tha tis passing through, right? So when I get a packet with ttl so small that won't survive long enough to reach the target, instead of altering, I just leave it along. So the probe will never know where I am in the route.

jacquesm 12y ago
But upstream providers within the TTL range will. And during a DDoS like this you can bet that everybody in the chain that is on the good side is in constant communication.
- brudgers 12y ago
  A sufficiently sophisticated man in the middle can be anywhere between origin and destination and have arbitrary distribution. Proving that a particular node is responsible for a particular alteration requires using a trusted trust computer to send packets into the great wall on their first hop. The experiment in the article required trusted trust of packets destined for the great wall passing through US infrastructure. That this infrastructure can generally be considered neutral is no guarantee that it was in this case. Any router or switch can use arbitrary tables and conditional logic on any packet. The purpose of the experiment was prosecuting a particular suspect not arm's length analysis.
  - jacquesm 12y ago
    So that experiment would need to be repeated in a distributed manner from as many points of origin as possible. A friend of mine runs a honeypot service that uses servers all around the planet, someone like him would be in a good position to run analysis like this.
    - brudgers 12y ago
      Logically, sufficient distribution of testing doesn't negate sufficient distribution of evil demons. Practically, if the evil demon has state actor level resources, it is more likely to have sufficient distribution than an ordinary commercial or private interest. On the other hand, I don't think it's really necessary to prove with technology that the 中國人民解放軍 is behind this. Diplomatic logic is sufficient. The behavior is simply an internet equivalent to jamming the Voice of America.[1] Github is broadcasting. The 中华人民共和国 has a sovereign's policies regarding broadcasting. The 中國人民解放軍 executes those policies. Github operates with a business model that ignores sovereigns at its own peril. Calling one sovereign for aid when dealing with another sovereign also carries peril. Allowing political content in an online community always comes with the risk of trolling and flamewars. A hands off editorial policy only means Github hasn't made a tough decision about what the Github community is not. Decision day can only be put off so long. [1]: http://en.wikipedia.org/wiki/Voice_of_America http://en.wikipedia.org/wiki/Voice_of_America
      - jacquesm 12y ago
        That's the odd thing, they could jam it instantly if they so chose to. The GFWs primary purpose is to limit access to certain urls from within China. Now of course those repos are intended to circumvent that but once someone has them they are out of reach of the GFW. So blocking those urls at the GFW would seem to be all that's really needed. Tools like these should be accessible from as many places as possible.
        brudgers 12y ago
        Diplomatic logic suggests Github is serving as an object lesson: 1. 中华人民共和国 has laws. 2. 中华人民共和国 is well connected to the internet. 3. 中华人民共和国 can project its interests around the world easily in rather nasty ways. 4. 中华人民共和国 can project its interests from within its borders. 5. 中华人民共和国 has an interest in controlling commerce within its borders. I believe this is an act of foreign policy, not domestic. It's not about unplugging citizens from the internet. It is about achieving some parity with other state level actors in regard to what is and isn't allowed on the internet. 中华人民共和国 's interests are orthogonal to those of the US and UK. It is not so much interested in the internet as an organ of a surveillance state or as an alternative source of foreign intelligence in lieu of boots on the ground. The mechanics of the attack are entirely within the realm of sanctioned internet behavior: visiting a site places javascript in the browser without explicit approval of the end user. The javascript may do something not in the user's interest. The javascript may generate unnecessary internet traffic. The purposes for which the javascript does so are solely the purposes of the site injecting it. The great wall comes with terms and conditions.

by methou 12y ago

jacquesm 12y ago

But upstream providers within the TTL range will. And during a DDoS like this you can bet that everybody in the chain that is on the good side is in constant communication.

brudgers 12y ago
A sufficiently sophisticated man in the middle can be anywhere between origin and destination and have arbitrary distribution. Proving that a particular node is responsible for a particular alteration requires using a trusted trust computer to send packets into the great wall on their first hop. The experiment in the article required trusted trust of packets destined for the great wall passing through US infrastructure. That this infrastructure can generally be considered neutral is no guarantee that it was in this case. Any router or switch can use arbitrary tables and conditional logic on any packet. The purpose of the experiment was prosecuting a particular suspect not arm's length analysis.
- jacquesm 12y ago
  So that experiment would need to be repeated in a distributed manner from as many points of origin as possible. A friend of mine runs a honeypot service that uses servers all around the planet, someone like him would be in a good position to run analysis like this.
  - brudgers 12y ago
    Logically, sufficient distribution of testing doesn't negate sufficient distribution of evil demons. Practically, if the evil demon has state actor level resources, it is more likely to have sufficient distribution than an ordinary commercial or private interest. On the other hand, I don't think it's really necessary to prove with technology that the 中國人民解放軍 is behind this. Diplomatic logic is sufficient. The behavior is simply an internet equivalent to jamming the Voice of America.[1] Github is broadcasting. The 中华人民共和国 has a sovereign's policies regarding broadcasting. The 中國人民解放軍 executes those policies. Github operates with a business model that ignores sovereigns at its own peril. Calling one sovereign for aid when dealing with another sovereign also carries peril. Allowing political content in an online community always comes with the risk of trolling and flamewars. A hands off editorial policy only means Github hasn't made a tough decision about what the Github community is not. Decision day can only be put off so long. [1]: http://en.wikipedia.org/wiki/Voice_of_America http://en.wikipedia.org/wiki/Voice_of_America
    - jacquesm 12y ago
      That's the odd thing, they could jam it instantly if they so chose to. The GFWs primary purpose is to limit access to certain urls from within China. Now of course those repos are intended to circumvent that but once someone has them they are out of reach of the GFW. So blocking those urls at the GFW would seem to be all that's really needed. Tools like these should be accessible from as many places as possible.
      - brudgers 12y ago
        Diplomatic logic suggests Github is serving as an object lesson: 1. 中华人民共和国 has laws. 2. 中华人民共和国 is well connected to the internet. 3. 中华人民共和国 can project its interests around the world easily in rather nasty ways. 4. 中华人民共和国 can project its interests from within its borders. 5. 中华人民共和国 has an interest in controlling commerce within its borders. I believe this is an act of foreign policy, not domestic. It's not about unplugging citizens from the internet. It is about achieving some parity with other state level actors in regard to what is and isn't allowed on the internet. 中华人民共和国 's interests are orthogonal to those of the US and UK. It is not so much interested in the internet as an organ of a surveillance state or as an alternative source of foreign intelligence in lieu of boots on the ground. The mechanics of the attack are entirely within the realm of sanctioned internet behavior: visiting a site places javascript in the browser without explicit approval of the end user. The javascript may do something not in the user's interest. The javascript may generate unnecessary internet traffic. The purposes for which the javascript does so are solely the purposes of the site injecting it. The great wall comes with terms and conditions.