8 ms·

> We remain puzzled as to why the GC’s operator chose to first employ its capabilities in such a publicly visible fashion. This is the most important question

by wsxcde 12y ago

> We remain puzzled as to why the GC’s operator chose to first employ its capabilities in such a publicly visible fashion. This is the most important question here. I think it's fair to assume this must've been a deliberate choice by the Chinese authorities to conduct such a visible attack. The alternative, that they didn't realize what they were getting into, that they thought Github would cave quickly, seems much to simplistic and naive. And whatever else you can say about the Chinese government, you can't accuse them of being naive. If you believe this was deliberate attack, it seems this is a parade demonstrating electronic warfare abilities. The message being sent seems to be, "don't mess with us, we can do everything you can do and possibly more."

vinceguidry 12y ago
It may not be as big and publicly visible as we think. Big would be targeting a stock exchange. Thinking at the nation-state level, Github is small potatoes. Who is going to know or care outside of the tech sector?
ddoolin 12y ago
Agreed. At only 1.75% of traffic, my guess is that they could pack a much bigger punch if they wanted to.
- moe 12y ago
  It's not something they could do very often. Every time they do such they risk having one of their most important commercial sites (Baidu, QQ, TaoBao) null-routed by the rest of the world. That's not exactly a long-term strategy.
  - stingraycharles 12y ago
    Honest question: why would China care if Baidu is null-routed by the rest of the world?
    - T-A 12y ago
      Because once it's nullrouted, it can no longer be used as a weapon. They only have so many cannons.
    - ithkuil 12y ago
      perhaps targeting ads to the large Chinese diaspora provides an effective way of redirecting some of the wealth accumulated abroad back into China.
    - mcintyre1994 12y ago
      The GitHub attack apparently targeted sites using Baidu analytics visited from outside China, so outside visitors are weaponisable too.
      - praptak 12y ago
        They are, as long as their ISPs don't block Baidu.
    - Terr_ 12y ago
      1. They lose the ability to use it as part of a similar attack in the future. They can't use the same trick too many times or it stops working, forcing them to work their way down a list of pawns. 2. It damages their relationship with Baidu and indirectly with other Chinese tech companies, in much the same way that NSA overreach affects US ones. There will be some internal political effects, depending on what stakeholders have political clout. 3. When external Chinese-speakers use Baidu, the government has some influence on what they do (or don't) see. If they are forced to other alternatives, the government loses a certain degree of information-control.
alex-g 12y ago
Maybe part of the explanation for this specific attack is incompetence - miscommunication, comparatively junior people exceeding their authority, subordinates afraid to object, and everyone doubling down rather than admitting defeat. I could definitely imagine that the people who devised and built out the capability being furious at it being deployed like this.
- tw04 12y ago
  If it has lasted a couple hours I could see that. But as long as that attack continued, no way.
  - bsder 12y ago
    Well, once it started, terminating it requires someone to lose face. So, yeah, I can see it continuing.
NelsonMinar 12y ago
I'm no policy expert, but it seems likely to me to be a demonstration of capability. The Chinese government has been arguing for awhile now for their right to "Internet Sovereignty", the ability to impose Chinese policy on Chinese users of the Internet. This attack seems to demonstrate they also feel the right to extend that sovereignty into other countries, to block services like GreatFire they think are harmful to their sovereignty. This attack is them showing the world they have the capability. More detail on China's Internet Sovereignty theory: http://blogs.wsj.com/chinarealtime/2014/06/23/chinas-lays-out-argument-for-internet-sovereignty-convinced/ http://blogs.wsj.com/chinarealtime/2014/06/23/chinas-lays-ou... http://www.huffingtonpost.com/lu-wei/china-cyber-sovereignty_b_6324060.html http://www.huffingtonpost.com/lu-wei/china-cyber-sovereignty...?
- belorn 12y ago
  Lets not forget the context that the Snowden disclosures brought into light. Borders and diplomatic relationships has been systematically ignored when it comes to developing and deploying offensive capabilities on the Internet. Sovereignty does not seem to exist in nations mind when developing malware, breaking into critical infrastructure, stealing information, or causing sabotage online.
deleted 12y ago
[deleted]
yAnonymous 12y ago
>we can do everything you can do Well, they couldn't take down Github.
EthanHeilman 12y ago
>I think it's fair to assume this must've been a deliberate choice by the Chinese authorities to conduct such a visible attack. I think it is a fair explanation but I wouldn't assume it outright. The incompetence and ignorance of decision makers should never be underestimated when it comes to complex technology.
- northernmonkey 12y ago
  It seems to be a common mistake of our age to assume that decision makers are "incompetent" or "ignorant" when it comes to tech. Individually it is unrealistic to expect these people to be universally competent in any field of expertise. It has always been thus, and that is why decision makers surround themselves with expert advisors. I would suggest we should never underestimate the deliberate and meaningful consideration taken by decision makers when it comes to complex technology. Regardless of if you agree with the outcome or not.
  - EthanHeilman 12y ago
    We should never underestimate either competence or incompetence. Instead lets put very wide error margins on statements about the intentions and plans of leaders. It is too easy to fall into the trap of assuming total incompetence, or the other hand Dumbledore-like foresight. The truth is, most leaders have moments of both and luck plays a big role (See Steve Jobs or Winston Churchill).
classicsnoot 12y ago
you can't accuse them of being naive I will.i am of the opinion that any country that thinks they can be a big player in the global economy and introduce open markets to their country whilst simultaneously limiting freedoms of speech and choice has a certain amount of innate naivety. This may be a silly notion, but is there any chance this was a mistake like the way Stuxnet broadcast itself to the world?
bsder 12y ago
> If you believe this was deliberate attack, it seems this is a parade demonstrating electronic warfare abilities. Probably deliberate with a lot of incompetence mixed in. Most politicians have zero understanding of the Internet. They decided to do this as a demonstration of force and may not have consulted the people who built the Great Cannon. Or, the people who built it don't have the clout to say not to use it except for important reasons. They also probably didn't realize that Github could eat the attack. The problem with having done this is that, I suspect, that a lot of ISP's now have null routes of China on standby along with bandwidth monitors that will choke traffic spikes from China almost immediately. So, it didn't actually succeed. And people have now analyzed the attack and deployed coutermeasures. Not a great result for China.
- wsxcde 12y ago
  I don't think DDoS is a real offensive weapon in cyber-warfare. It's just a noise-making attention-drawing machine. What the paper calls targeted exploitation is the real weapon here. The main thing I took away from this paper is that the Chinese government now has the infrastructure to pwn anyone who visits websites hosted in China. This is pretty scary and simultaneously an amazing engineering feat.
  - LiweiZ 12y ago
    Any advice for visitors of those websites hosted in China? As a Chinese, I am always wondering if there is a way to avoid this. Many of us are aware of the backdoors in the Chinese apps (across all the platforms). No matter how big names they are, they have to comply with the order from the ruling ones (I guess most of them cooperate with little guilty feeling). The best I can think of is to have different devices for visiting/using Chinese apps/websites. To a larger scale, I think average users have very limited resources to hide from big organizations. What average Joe could do is a more general question I have not figured out. Thanks in advance.
    - Buge 12y ago
      The ideal answer is to convince the sites you visit to use https.
deleted 12y ago
[deleted]
xnull6guest 12y ago
I remain convinced that there was some other reason other than cyberforce posturing for the DDOS. Past examples of highly visible international attacks (I'm thinking of SONY here) have been to punish and embarrass companies for being complicit with US foreign propaganda efforts (re leaked Bennett/State Dept./Lynton/RAND emails). I'm not saying the exact same motivation is in play, but as github hosts files - notably code - and many governments have been cracking down on files hosting and shares (like pastebin, etc). This is speculation, but I prefer the explanation to cyberposturing, since this isn't something China needs to do, and as far as I can tell wouldn't benefit very much from. The theory is in line with greatfire, as this organization is a "Civil Society Organization" funded ultimately by the US government to spread messages it wants within China. Github is more confusing.
- bricnbrac 12y ago
  I am mystified by the puzzlement people have shown over what the CPC's motivation could possibly be. The Xi Jinping administration has been engaged in a ham-handed crackdown on civil society and anyone who engages in political activism or discussion outside the context of the CPC for several years now and that crackdown has recently intensified. VPNs have been disabled, universities have been warned not use Western textbooks or discuss Western ideas, activists and intellectuals have been detained en masse or prevented from returning to the country, etc. DDoSing foreign websites that are actively attempting to undermine the CPC's censorship and repression campaign is completely in line with the priorities of the CPC's high officials, as well as their general level of subtlety.
  - xnull6guest 12y ago
    Yes. So greatfire, VOA, etc make a lot of sense - but what of Github? I don't believe they are a CSO on their face. I can imagine CSOs using github to host code or information that challenges the country (let's say software to organize demonstrations or circumvent surveillance) - I'm not aware of specifics. With regard to CSOs and weaponized NGOs - I personally have a sour taste for them (I recognize that they are 'legal', however 'loophole-like'). This is because I am not willing to affirm foreign covert influence on United States/Western and my own opinion. So I usually hardly know whether to cheer or mope in cases where CSOs are challenged.
rsync 12y ago
"If you believe this was deliberate attack, it seems this is a parade demonstrating electronic warfare abilities. The message being sent seems to be, "don't mess with us, we can do everything you can do and possibly more."" I think this is silly. The bar is still set at stuxnet, in terms of computerized attacks on infrastructure. This is nowhere near stuxnet in terms of capability, destructive effect or ingenuity.
whoopdedo 12y ago
Dr. Strangelove: Of course, the whole point of a Doomsday Machine is lost, if you *keep* it a *secret*! It aggravates me that other governments aren't making a bigger deal about this. This is a WMD where non-combatants are being unwittingly used to fight a computer war between countries they have nothing to do with. We knew this was coming for 20 years![1] But instead of taking the high road and defending the internet from militarization, the governments of the world raced to become the first to make computer weapons and hasten the downward spiral to destruction. Sixty years ago we said "no weapons in space" and it was the right thing to do. It allowed the commercial use of satellites to grow without threat of being caught in the petty conflict of nations. The internet was supposed to be the next extra-national frontier and for a time it was. But now that there are weapons being fired why would I want to invest money in an internet business that may become the victim of a DDOS? My insurance doesn't cover acts of war, if I lose money because of it there's nothing I can do. We've got treaties limiting the use of nuclear arms so innocent civilians aren't at risk of being irradiated. We've got treaties limiting chemical weapons so innocent civilians don't get their lungs burnt away. We've got treaties limiting land mines so innocent civilians don't get blown up when taking a hike through the woods. (Oh, and thanks for not ratifying that, Obama.) We need a treaty limiting computer weapons so innocent civilians don't have their computers hijacked and personal data put at risk. [1] http://fmso.leavenworth.army.mil/documents/chinarma.htm http://fmso.leavenworth.army.mil/documents/chinarma.htm
- BrandonMarc 12y ago
  Does China respect the no-space-weapons treaty? Would China respect a treaty regarding cyber weaponry? American politicians have little stomach for confronting China. If a treaty were put into place, they'd be in the position of having to confront someone they really don't want to. A treaty might be useful in some ways, but the best defense is ... well, a good defense (i.e. educating the masses, improving browser security, etc).
  - vorg 12y ago
    > Does China respect the no-space-weapons treaty? A quick search showed China followed the US's lead in not respecting the no-space-weapons treaty. From http://en.wikipedia.org/wiki/2007_Chinese_anti-satellite_missile_test http://en.wikipedia.org/wiki/2007_Chinese_anti-satellite_mis... ... In January 2001, a (US) congressionally mandated space commission headed by Donald Rumsfeld recommended that “the U.S. government should vigorously pursue the capabilities called for in the National Space Policy to ensure that the president will have the option to deploy weapons in space to deter threats to, and, if necessary, defend against attacks on U.S. interests." Moreover, the U.S. withdrawal from the Anti-Ballistic Missile Treaty in 2002 has allowed the United States to pursue missile defenses, including space-based. In response to US weaponisation of space, the Chinese started a space defense program, including anti-satellite defense.
analyst74 12y ago
It's too weak as show of force from state government. GitHub is after all, a small civilian service, despite its prominence within tech community. Even DDoS itself is not really a serious cyber warfare measure -- you can't really take down any major government agency (except their public-facing website) or core infrastructure with it. What's the biggest damage caused by DDoS in all of Internet's history? Here is how I believe it goes down: 1, the new chairman issued mandate that he wants to crack down on accessing illegal content on Internet. 2, different department heads make this top of their priority. 3, somewhere down the management chain, a manager found those tools that help people accessing illegal content on Intenet. 4, the said manager himself, or one of his analysts figure if they bully GitHub with some DDoS, they'd cave and take down those tools. Points for promotion! I doubt if even the US government takes this seriously.
JoachimS 12y ago
Also how the Chinese government show little regard for their tech industry and is prepared to trash Baidu reputation just to disturb some sites they find annoying.

by wsxcde 12y ago

vinceguidry 12y ago

It may not be as big and publicly visible as we think. Big would be targeting a stock exchange. Thinking at the nation-state level, Github is small potatoes. Who is going to know or care outside of the tech sector?

ddoolin 12y ago

Agreed. At only 1.75% of traffic, my guess is that they could pack a much bigger punch if they wanted to.

moe 12y ago
It's not something they could do very often. Every time they do such they risk having one of their most important commercial sites (Baidu, QQ, TaoBao) null-routed by the rest of the world. That's not exactly a long-term strategy.
- stingraycharles 12y ago
  Honest question: why would China care if Baidu is null-routed by the rest of the world?
  - T-A 12y ago
    Because once it's nullrouted, it can no longer be used as a weapon. They only have so many cannons.
  - ithkuil 12y ago
    perhaps targeting ads to the large Chinese diaspora provides an effective way of redirecting some of the wealth accumulated abroad back into China.
  - mcintyre1994 12y ago
    The GitHub attack apparently targeted sites using Baidu analytics visited from outside China, so outside visitors are weaponisable too.
    - praptak 12y ago
      They are, as long as their ISPs don't block Baidu.
  - Terr_ 12y ago
    1. They lose the ability to use it as part of a similar attack in the future. They can't use the same trick too many times or it stops working, forcing them to work their way down a list of pawns. 2. It damages their relationship with Baidu and indirectly with other Chinese tech companies, in much the same way that NSA overreach affects US ones. There will be some internal political effects, depending on what stakeholders have political clout. 3. When external Chinese-speakers use Baidu, the government has some influence on what they do (or don't) see. If they are forced to other alternatives, the government loses a certain degree of information-control.

alex-g 12y ago

Maybe part of the explanation for this specific attack is incompetence - miscommunication, comparatively junior people exceeding their authority, subordinates afraid to object, and everyone doubling down rather than admitting defeat. I could definitely imagine that the people who devised and built out the capability being furious at it being deployed like this.

tw04 12y ago
If it has lasted a couple hours I could see that. But as long as that attack continued, no way.
- bsder 12y ago
  Well, once it started, terminating it requires someone to lose face. So, yeah, I can see it continuing.

NelsonMinar 12y ago

I'm no policy expert, but it seems likely to me to be a demonstration of capability. The Chinese government has been arguing for awhile now for their right to "Internet Sovereignty", the ability to impose Chinese policy on Chinese users of the Internet. This attack seems to demonstrate they also feel the right to extend that sovereignty into other countries, to block services like GreatFire they think are harmful to their sovereignty. This attack is them showing the world they have the capability. More detail on China's Internet Sovereignty theory: http://blogs.wsj.com/chinarealtime/2014/06/23/chinas-lays-out-argument-for-internet-sovereignty-convinced/ http://blogs.wsj.com/chinarealtime/2014/06/23/chinas-lays-ou... http://www.huffingtonpost.com/lu-wei/china-cyber-sovereignty_b_6324060.html http://www.huffingtonpost.com/lu-wei/china-cyber-sovereignty...?

belorn 12y ago
Lets not forget the context that the Snowden disclosures brought into light. Borders and diplomatic relationships has been systematically ignored when it comes to developing and deploying offensive capabilities on the Internet. Sovereignty does not seem to exist in nations mind when developing malware, breaking into critical infrastructure, stealing information, or causing sabotage online.

deleted 12y ago

[deleted]

yAnonymous 12y ago

>we can do everything you can do Well, they couldn't take down Github.

EthanHeilman 12y ago

>I think it's fair to assume this must've been a deliberate choice by the Chinese authorities to conduct such a visible attack. I think it is a fair explanation but I wouldn't assume it outright. The incompetence and ignorance of decision makers should never be underestimated when it comes to complex technology.

northernmonkey 12y ago
It seems to be a common mistake of our age to assume that decision makers are "incompetent" or "ignorant" when it comes to tech. Individually it is unrealistic to expect these people to be universally competent in any field of expertise. It has always been thus, and that is why decision makers surround themselves with expert advisors. I would suggest we should never underestimate the deliberate and meaningful consideration taken by decision makers when it comes to complex technology. Regardless of if you agree with the outcome or not.
- EthanHeilman 12y ago
  We should never underestimate either competence or incompetence. Instead lets put very wide error margins on statements about the intentions and plans of leaders. It is too easy to fall into the trap of assuming total incompetence, or the other hand Dumbledore-like foresight. The truth is, most leaders have moments of both and luck plays a big role (See Steve Jobs or Winston Churchill).

classicsnoot 12y ago

you can't accuse them of being naive I will.i am of the opinion that any country that thinks they can be a big player in the global economy and introduce open markets to their country whilst simultaneously limiting freedoms of speech and choice has a certain amount of innate naivety. This may be a silly notion, but is there any chance this was a mistake like the way Stuxnet broadcast itself to the world?

bsder 12y ago

> If you believe this was deliberate attack, it seems this is a parade demonstrating electronic warfare abilities. Probably deliberate with a lot of incompetence mixed in. Most politicians have zero understanding of the Internet. They decided to do this as a demonstration of force and may not have consulted the people who built the Great Cannon. Or, the people who built it don't have the clout to say not to use it except for important reasons. They also probably didn't realize that Github could eat the attack. The problem with having done this is that, I suspect, that a lot of ISP's now have null routes of China on standby along with bandwidth monitors that will choke traffic spikes from China almost immediately. So, it didn't actually succeed. And people have now analyzed the attack and deployed coutermeasures. Not a great result for China.

wsxcde 12y ago
I don't think DDoS is a real offensive weapon in cyber-warfare. It's just a noise-making attention-drawing machine. What the paper calls targeted exploitation is the real weapon here. The main thing I took away from this paper is that the Chinese government now has the infrastructure to pwn anyone who visits websites hosted in China. This is pretty scary and simultaneously an amazing engineering feat.
- LiweiZ 12y ago
  Any advice for visitors of those websites hosted in China? As a Chinese, I am always wondering if there is a way to avoid this. Many of us are aware of the backdoors in the Chinese apps (across all the platforms). No matter how big names they are, they have to comply with the order from the ruling ones (I guess most of them cooperate with little guilty feeling). The best I can think of is to have different devices for visiting/using Chinese apps/websites. To a larger scale, I think average users have very limited resources to hide from big organizations. What average Joe could do is a more general question I have not figured out. Thanks in advance.
  - Buge 12y ago
    The ideal answer is to convince the sites you visit to use https.

deleted 12y ago

[deleted]

xnull6guest 12y ago

I remain convinced that there was some other reason other than cyberforce posturing for the DDOS. Past examples of highly visible international attacks (I'm thinking of SONY here) have been to punish and embarrass companies for being complicit with US foreign propaganda efforts (re leaked Bennett/State Dept./Lynton/RAND emails). I'm not saying the exact same motivation is in play, but as github hosts files - notably code - and many governments have been cracking down on files hosting and shares (like pastebin, etc). This is speculation, but I prefer the explanation to cyberposturing, since this isn't something China needs to do, and as far as I can tell wouldn't benefit very much from. The theory is in line with greatfire, as this organization is a "Civil Society Organization" funded ultimately by the US government to spread messages it wants within China. Github is more confusing.

bricnbrac 12y ago
I am mystified by the puzzlement people have shown over what the CPC's motivation could possibly be. The Xi Jinping administration has been engaged in a ham-handed crackdown on civil society and anyone who engages in political activism or discussion outside the context of the CPC for several years now and that crackdown has recently intensified. VPNs have been disabled, universities have been warned not use Western textbooks or discuss Western ideas, activists and intellectuals have been detained en masse or prevented from returning to the country, etc. DDoSing foreign websites that are actively attempting to undermine the CPC's censorship and repression campaign is completely in line with the priorities of the CPC's high officials, as well as their general level of subtlety.
- xnull6guest 12y ago
  Yes. So greatfire, VOA, etc make a lot of sense - but what of Github? I don't believe they are a CSO on their face. I can imagine CSOs using github to host code or information that challenges the country (let's say software to organize demonstrations or circumvent surveillance) - I'm not aware of specifics. With regard to CSOs and weaponized NGOs - I personally have a sour taste for them (I recognize that they are 'legal', however 'loophole-like'). This is because I am not willing to affirm foreign covert influence on United States/Western and my own opinion. So I usually hardly know whether to cheer or mope in cases where CSOs are challenged.

rsync 12y ago

"If you believe this was deliberate attack, it seems this is a parade demonstrating electronic warfare abilities. The message being sent seems to be, "don't mess with us, we can do everything you can do and possibly more."" I think this is silly. The bar is still set at stuxnet, in terms of computerized attacks on infrastructure. This is nowhere near stuxnet in terms of capability, destructive effect or ingenuity.

whoopdedo 12y ago

Dr. Strangelove: Of course, the whole point of a Doomsday Machine is lost, if you *keep* it a *secret*! It aggravates me that other governments aren't making a bigger deal about this. This is a WMD where non-combatants are being unwittingly used to fight a computer war between countries they have nothing to do with. We knew this was coming for 20 years![1] But instead of taking the high road and defending the internet from militarization, the governments of the world raced to become the first to make computer weapons and hasten the downward spiral to destruction. Sixty years ago we said "no weapons in space" and it was the right thing to do. It allowed the commercial use of satellites to grow without threat of being caught in the petty conflict of nations. The internet was supposed to be the next extra-national frontier and for a time it was. But now that there are weapons being fired why would I want to invest money in an internet business that may become the victim of a DDOS? My insurance doesn't cover acts of war, if I lose money because of it there's nothing I can do. We've got treaties limiting the use of nuclear arms so innocent civilians aren't at risk of being irradiated. We've got treaties limiting chemical weapons so innocent civilians don't get their lungs burnt away. We've got treaties limiting land mines so innocent civilians don't get blown up when taking a hike through the woods. (Oh, and thanks for not ratifying that, Obama.) We need a treaty limiting computer weapons so innocent civilians don't have their computers hijacked and personal data put at risk. [1] http://fmso.leavenworth.army.mil/documents/chinarma.htm http://fmso.leavenworth.army.mil/documents/chinarma.htm

BrandonMarc 12y ago
Does China respect the no-space-weapons treaty? Would China respect a treaty regarding cyber weaponry? American politicians have little stomach for confronting China. If a treaty were put into place, they'd be in the position of having to confront someone they really don't want to. A treaty might be useful in some ways, but the best defense is ... well, a good defense (i.e. educating the masses, improving browser security, etc).
- vorg 12y ago
  > Does China respect the no-space-weapons treaty? A quick search showed China followed the US's lead in not respecting the no-space-weapons treaty. From http://en.wikipedia.org/wiki/2007_Chinese_anti-satellite_missile_test http://en.wikipedia.org/wiki/2007_Chinese_anti-satellite_mis... ... In January 2001, a (US) congressionally mandated space commission headed by Donald Rumsfeld recommended that “the U.S. government should vigorously pursue the capabilities called for in the National Space Policy to ensure that the president will have the option to deploy weapons in space to deter threats to, and, if necessary, defend against attacks on U.S. interests." Moreover, the U.S. withdrawal from the Anti-Ballistic Missile Treaty in 2002 has allowed the United States to pursue missile defenses, including space-based. In response to US weaponisation of space, the Chinese started a space defense program, including anti-satellite defense.

analyst74 12y ago

It's too weak as show of force from state government. GitHub is after all, a small civilian service, despite its prominence within tech community. Even DDoS itself is not really a serious cyber warfare measure -- you can't really take down any major government agency (except their public-facing website) or core infrastructure with it. What's the biggest damage caused by DDoS in all of Internet's history? Here is how I believe it goes down: 1, the new chairman issued mandate that he wants to crack down on accessing illegal content on Internet. 2, different department heads make this top of their priority. 3, somewhere down the management chain, a manager found those tools that help people accessing illegal content on Intenet. 4, the said manager himself, or one of his analysts figure if they bully GitHub with some DDoS, they'd cave and take down those tools. Points for promotion! I doubt if even the US government takes this seriously.

JoachimS 12y ago

Also how the Chinese government show little regard for their tech industry and is prepared to trash Baidu reputation just to disturb some sites they find annoying.