4 ms·

I don't like the underlying assumption in all these articles that the Chinese government was behind the attacks, as if we had proof for anything. Apart from th

by moe 12y ago

I don't like the underlying assumption in all these articles that the Chinese government was behind the attacks, as if we had proof for anything. Apart from the rather blurry technical analysis this particular article claims: In recent public statements, China has deflected questions regarding whether they are behind the attack But when you follow the actual citation[1] it refers to this rather underwhelming exchange, taken place on a chinese press conference: QUESTION: [..] a report says that a US website was under hacker attack, and the source of the attack was from China. How do you respond? ANSWER: [..] it is quite odd that every time a website in the US or any other country is under attack, there will be speculation that Chinese hackers are behind it. I'd like to remind you that China is one of the major victims of cyber attacks. [..] So the chinese press lady gave her standard boilerplate response, to a less than specific inquiry (which she probably hears on every press conference), in between handling questions about illegal fishing in Somali waters and the Arab League Summit's commitment to a joint Arab military force. And this is now "compelling evidence" for China being officially behind the Github attack? [1] http://www.fmprc.gov.cn/mfa_eng/xwfw_665399/s2510_665401/2511_665403/t1250354.shtml http://www.fmprc.gov.cn/mfa_eng/xwfw_665399/s2510_665401/251...

rpedroso 12y ago
The leap to blame the Chinese government for this attack reminds me of the leap to attribute the Sony attack to North Korea. It's possible that North Korea was responsible, but the primary evidence the FBI held up was that the malware used was similar to malware used by DPRK in previous attacks. As many researchers pointed out[1], that malware has been widely available outside DPRK for years. Certain 3-letter agencies have claimed to have additional intelligence pointing towards North Korea[2], but don't go into significant detail. "We're the NSA, so just trust us" In both cases, it's possible the attack was carried out by a state actor, but I'm personally unwilling to point a finger without better evidence than what I've seen. [1] http://www.cnn.com/2014/12/27/tech/north-korea-expert-doubts-about-hack/ http://www.cnn.com/2014/12/27/tech/north-korea-expert-doubts... [2] http://recode.net/2015/01/18/how-the-u-s-knew-north-korea-was-behind-the-sony-hack/ http://recode.net/2015/01/18/how-the-u-s-knew-north-korea-wa...
- criley2 12y ago
  Considering that the USA has similar cyberweapon capacities that are publicly known, I believe it's naive to assume that China isn't developing similar weapons. How can we link this weapon with China? I don't know, but it requires deep access to the colocation of major servers in China for sophisticated man-in-the-middle hijacking, so it seems like the number of organizations that can, in an intentional fashion, compromise a Chinese baidu colocated server is very small. When one considers the sophistication and access required for this attack, and the reality that China is developing cyberweapons, and the reality that China openly uses cyberweapons against the west in various capacities, it seems improbable to suggest that a third party is more likely the culprit than the state. It isn't as if accusing China is outlandish- we're merely saying that they're striving for cyberweapon parity with the USA...
  - moe 12y ago
    it seems like the number of organizations that can, in an intentional fashion, compromise a Chinese baidu colocated server is very small. As it happens the organizations who could do either that, or who could make it look as if the attack originated from a chinese baidu colocated server, are just the same and the only ones who have any stake in this game. I agree with your notion that China is developing "cyber weapons" just as every other large nation. I just remain skeptical about the idea of them using their guns so incompetently and aimlessly as in this case.
NelsonMinar 12y ago
Your comment is thoughtful so I'll reply in kind. Is there any other plausible actor who could be carrying on this attack for so long? And is motivated to attack GreatFire? The Chinese government controls their Internet connection to the world with a firm hand. Who else could it be? I agree that more technical evidence of the attack's source would be welcome. But the analysis published here is pretty convincing. Specifically "the GC acted on traffic between hop 17 and hop 18, the same link we observed as responsible for the GFW". There's pcap files if you want to verify for yourself.
- moe 12y ago
  Is there any other plausible actor who could be carrying on this attack for so long? For me the more interesting question remains: Why would China be carrying out this attack? I have yet to hear a plausible motive. Other plausible actors would be the people who have an interest in creating the perception of a "cyber threat", in order to implement more "protections". Protections like an Executive Order[1] "to target those attempting cyber attacks on US assets and infrastructure". After all, with both China and Russia[2] attacking us, who would argue against the urgent need for such measures? And yet, technically either China or the NSA (via their control over Tier1 carriers) could be responsible for this attack. Perhaps it really was China. But considering we're talking about state-level secret agencies in any case it's a bit sad how reluctant many HNers seem to be to even consider any scenario other than the mainstream narrative. [1] http://www.nationaljournal.com/tech/obama-declares-cyber-attacks-a-national-emergency-20150401 http://www.nationaljournal.com/tech/obama-declares-cyber-att... [2] http://www.dailymail.co.uk/news/article-3029768/Russian-hackers-blamed-cyber-attack-exposed-president-s-private-schedule-Obama-aide-insists-White-House-computer-secure.html http://www.dailymail.co.uk/news/article-3029768/Russian-hack...
  - imron 12y ago
    > Why would China be carrying out this attack? I have yet to hear a plausible motive. Exactly this. Not to mention the hundreds (if not thousands) of sites the government is more likely to target, that are far less known than GitHub and that they could take off-line indefinitely, with little or no outrage from anyone in the West.
wmt 12y ago
The technical analysis pinpointing the attack to the Chinese government was definitely not blurry. TTL based tracing is very deterministic and easy to understand, and finding the injection point to be at the same spot with the Great Firewall is pretty much the closest thing to a smoking gun with regards to Interner attacks. Of course, while the smoking gun was found from Chinese Internet censorship offices and was covered with fingerprints of Chinese Internet censorship officials, it still might be not perpetrated by the Chinese Internet censorship officials. It is only very likely that they were behind the attack.
- moe 12y ago
  The technical analysis pinpointing the attack to the Chinese government was definitely not blurry. If anything the attack was pinpointed to Chinese infrastructure, not the Chinese government. TTL based tracing is very deterministic and easy to understand It's only deterministic if you trust all hops between yourself and the target, as any of them could fake the remaining route. I don't know about you, but my 'traceroute baidu.com' passes through AT&T, an american company that is mentioned first in about every article and lawsuit about the NSA mass surveillance. So if you're willing to buy into the theory of China performing this attack just for a demonstration of ability (because there's no other visible benefit), how can we know it isn't exactly the other way round? [1] http://en.wikipedia.org/wiki/NSA_warrantless_surveillance_(2001%E2%80%9307)#Developments http://en.wikipedia.org/wiki/NSA_warrantless_surveillance_(2... [2] https://www.eff.org/nsa-spying https://www.eff.org/nsa-spying
  - NelsonMinar 12y ago
    Chinese infrastructure, not the Chinese government There's no meaningful difference.
    - sarciszewski 12y ago
      Governments can lose control of their infrastructure in the face of a well-equipped hacker.
  - 12y ago

by moe 12y ago

rpedroso 12y ago

The leap to blame the Chinese government for this attack reminds me of the leap to attribute the Sony attack to North Korea. It's possible that North Korea was responsible, but the primary evidence the FBI held up was that the malware used was similar to malware used by DPRK in previous attacks. As many researchers pointed out[1], that malware has been widely available outside DPRK for years. Certain 3-letter agencies have claimed to have additional intelligence pointing towards North Korea[2], but don't go into significant detail. "We're the NSA, so just trust us" In both cases, it's possible the attack was carried out by a state actor, but I'm personally unwilling to point a finger without better evidence than what I've seen. [1] http://www.cnn.com/2014/12/27/tech/north-korea-expert-doubts-about-hack/ http://www.cnn.com/2014/12/27/tech/north-korea-expert-doubts... [2] http://recode.net/2015/01/18/how-the-u-s-knew-north-korea-was-behind-the-sony-hack/ http://recode.net/2015/01/18/how-the-u-s-knew-north-korea-wa...

criley2 12y ago
Considering that the USA has similar cyberweapon capacities that are publicly known, I believe it's naive to assume that China isn't developing similar weapons. How can we link this weapon with China? I don't know, but it requires deep access to the colocation of major servers in China for sophisticated man-in-the-middle hijacking, so it seems like the number of organizations that can, in an intentional fashion, compromise a Chinese baidu colocated server is very small. When one considers the sophistication and access required for this attack, and the reality that China is developing cyberweapons, and the reality that China openly uses cyberweapons against the west in various capacities, it seems improbable to suggest that a third party is more likely the culprit than the state. It isn't as if accusing China is outlandish- we're merely saying that they're striving for cyberweapon parity with the USA...
- moe 12y ago
  it seems like the number of organizations that can, in an intentional fashion, compromise a Chinese baidu colocated server is very small. As it happens the organizations who could do either that, or who could make it look as if the attack originated from a chinese baidu colocated server, are just the same and the only ones who have any stake in this game. I agree with your notion that China is developing "cyber weapons" just as every other large nation. I just remain skeptical about the idea of them using their guns so incompetently and aimlessly as in this case.

NelsonMinar 12y ago

Your comment is thoughtful so I'll reply in kind. Is there any other plausible actor who could be carrying on this attack for so long? And is motivated to attack GreatFire? The Chinese government controls their Internet connection to the world with a firm hand. Who else could it be? I agree that more technical evidence of the attack's source would be welcome. But the analysis published here is pretty convincing. Specifically "the GC acted on traffic between hop 17 and hop 18, the same link we observed as responsible for the GFW". There's pcap files if you want to verify for yourself.

moe 12y ago
Is there any other plausible actor who could be carrying on this attack for so long? For me the more interesting question remains: Why would China be carrying out this attack? I have yet to hear a plausible motive. Other plausible actors would be the people who have an interest in creating the perception of a "cyber threat", in order to implement more "protections". Protections like an Executive Order[1] "to target those attempting cyber attacks on US assets and infrastructure". After all, with both China and Russia[2] attacking us, who would argue against the urgent need for such measures? And yet, technically either China or the NSA (via their control over Tier1 carriers) could be responsible for this attack. Perhaps it really was China. But considering we're talking about state-level secret agencies in any case it's a bit sad how reluctant many HNers seem to be to even consider any scenario other than the mainstream narrative. [1] http://www.nationaljournal.com/tech/obama-declares-cyber-attacks-a-national-emergency-20150401 http://www.nationaljournal.com/tech/obama-declares-cyber-att... [2] http://www.dailymail.co.uk/news/article-3029768/Russian-hackers-blamed-cyber-attack-exposed-president-s-private-schedule-Obama-aide-insists-White-House-computer-secure.html http://www.dailymail.co.uk/news/article-3029768/Russian-hack...
- imron 12y ago
  > Why would China be carrying out this attack? I have yet to hear a plausible motive. Exactly this. Not to mention the hundreds (if not thousands) of sites the government is more likely to target, that are far less known than GitHub and that they could take off-line indefinitely, with little or no outrage from anyone in the West.

wmt 12y ago

The technical analysis pinpointing the attack to the Chinese government was definitely not blurry. TTL based tracing is very deterministic and easy to understand, and finding the injection point to be at the same spot with the Great Firewall is pretty much the closest thing to a smoking gun with regards to Interner attacks. Of course, while the smoking gun was found from Chinese Internet censorship offices and was covered with fingerprints of Chinese Internet censorship officials, it still might be not perpetrated by the Chinese Internet censorship officials. It is only very likely that they were behind the attack.

moe 12y ago
The technical analysis pinpointing the attack to the Chinese government was definitely not blurry. If anything the attack was pinpointed to Chinese infrastructure, not the Chinese government. TTL based tracing is very deterministic and easy to understand It's only deterministic if you trust all hops between yourself and the target, as any of them could fake the remaining route. I don't know about you, but my 'traceroute baidu.com' passes through AT&T, an american company that is mentioned first in about every article and lawsuit about the NSA mass surveillance. So if you're willing to buy into the theory of China performing this attack just for a demonstration of ability (because there's no other visible benefit), how can we know it isn't exactly the other way round? [1] http://en.wikipedia.org/wiki/NSA_warrantless_surveillance_(2001%E2%80%9307)#Developments http://en.wikipedia.org/wiki/NSA_warrantless_surveillance_(2... [2] https://www.eff.org/nsa-spying https://www.eff.org/nsa-spying
- NelsonMinar 12y ago
  Chinese infrastructure, not the Chinese government There's no meaningful difference.
  - sarciszewski 12y ago
    Governments can lose control of their infrastructure in the face of a well-equipped hacker.
- 12y ago