4 ms·
I mentioned this as a reply in the other thread on this topic, but just to make sure it is clear to those who may not have read or reasoned about the full repor
by ddlatham 12y ago
I mentioned this as a reply in the other thread on this topic, but just to make sure it is clear to those who may not have read or reasoned about the full report:
The reason it is powerful is not this particular attack. It's a demonstration that they are willing and able to inject malicious responses to any request going to a Chinese resource (web site, analytics service, ads, etc.). Imagine if instead of returning some DoS javascript they deliver a payload to silently exploit a vulnerability in your browser/OS (and they are surely capable of finding or purchasing those) to do whatever they want with it:
- Add it to a botnet
- Steal your personal data
- Infiltrate your corporate network
- Wipe your system (punishment for those accessing or producing GFW circumvention software)
Are you confident your browser never makes HTTP requests to Chinese servers? Are there tools we can install to prevent it?
[EDIT: It looks like two separate HN stories got merged, and the comments along with them. Didn't know that could happen, but this comment now appears twice here at different places.]
- pdkl95 12y ago> Imagine if instead of returning some DoS javascript they deliver a payload to silently exploit a vulnerability It would be foolish to imagine that this is still theoretical. Tools this powerful are tempting to use. Unfortunately, the first publicly known use of a tool or method is often assumed to be the use in general. Not only are you correct in that the GFW will be used for much smaller attacks that will probably go unnoticed, it almost certainly already has.