4 ms·
>The method used to inject these packets on the wire makes this sort of analysis even harder to do this sort of analysis I was under the impression that this w
by nickodell 12y ago
>The method used to inject these packets on the wire makes this sort of analysis even harder to do this sort of analysis
I was under the impression that this was a man on the side attack, so they'd sent a bogus SYN-ACK back to you the moment that they saw a SYN. Theoretically, you should still only be dealing with one RTT.
>(and if there was concern, appropriate amounts of random delay and noise could be added).
I don't think China cares if it gets traced back to them.
- methou 12y ago> I don't think China cares if it gets traced back to them. No they don't, and when time arrives, they deny whatever the accusation is, and claims it's a defamation.
- flipp3r 12y agoThey already did this a couple days ago when someone asked them about it http://www.fmprc.gov.cn/mfa_eng/xwfw_665399/s2510_665401/2511_665403/t1250354.shtml http://www.fmprc.gov.cn/mfa_eng/xwfw_665399/s2510_665401/251... "On your second question, it is quite odd that every time a website in the US or any other country is under attack, there will be speculation that Chinese hackers are behind it."
- mirashii 12y agoThe man on the side they're performing, according to analysis, seems to be letting the initial SYN through to the original server, you get the SYN-ACK back from the actual Baidu server. Then after your ACK and HTTP GET, the other packets are injected. If they wanted to make the attack more subtle, messing with the timing to make it match the original SYN-ACK pair and keeping the right TTL values would make it much harder to detect. http://www.netresec.com/?month=2015-03&page=blog&post=china%27s-man-on-the-side-attack-on-github http://www.netresec.com/?month=2015-03&page=blog&post=china%...