GitHub under ongoing DDoS attack
status.github.com
status.github.com
1. Even if this isn't a PRC-ordered or sponsored attack, large parts of their infrastructure are being co-opted. If they aren't criminally involved, they're criminally irresponsible.
1. SSDP Flood 21%
2. SYN Flood 19%
3. UDP Flood 13%
4. UDP Fragment 12%
5. NTP Flood 8%
6. GET Flood 7%
7. CharGEN Attack 5%
8. DNS Flood 5%
9. ICMP Flood 2%
10. SNMP Flood 2%
Eliminating these 10 attack vectors would account for 94% of DDoS attacks according to this visualization[1], as witnessed by Akamai over the last 30 days. Just the top 3 is more than 50%. Seems like a reasonable start on a way to measure success.
Who'd like to sponsor? Or should I just spin up a GitHub repo for the code and a kickstarter for the prize money?
[1] http://www.stateoftheinternet.com/trends-visualizations-secu...
I see this latest development as good news. The Javascript MITM trick was very clever because forcing github to render and serve a page is a lot more resource consuming than just firing packets at servers that ignore them (like a UDP or SYN flood). The latter can saturate network links until the sources are blocked, but those sources tend to be somewhat focused and don't shift much. An HTTP level attack driven by random web users means every request might have a different IP and it requires running way more of the app stack to be able to filter them out. If China is now resorted to SYN flooding then it means they ran out of better techniques.
Is "DNS flood" a DNS reflection attack though?
There are generally two types of floods against DNS infrastructure:
- Flood of "valid" requests, to a large number of open DNS recursors. To avoid caching they usually contain random prefix. Flood against large number of open DNS recursors basically causes the recursors to not work, and many authoritative servers to be overwhelmed.
- Flood directly against authoritative servers, to fill the network or use up all the CPU.
Traditional reflections aren't that popular any more.
You have to somehow identify and separate the unwanted requests from you regular traffic. That's why these cases are unique and needs to be handled manually, in cooperation with your uplink(s).
However, this is no doubt not a complete list of DDoS vectors as it doesn't account for application level exploits like demonstrated in the GitHub attacks. And obviously not everything that is a DDoS is a protocol flood.
Either there is a way to identify those types of attacks now, or improved attack identification should be included as a requirement for the X-Prize.
Let's say your pipe can receive 1 Liter per second of water. There are some impurities that you can filter through your faucet, this is analogous to the software firewall. However what happens when someone starts piping 99 L/s of sludge through the other end? No matter how sophisticated the filter you have on your faucet, the water you will get out of it is going to slow to a trickle.
Now I can already hear you asking, why does the Internet allow people to send whatever sludge they want? And the answer is because that's the way the internet is made. There has been a push to stop spoofing called BCP38, but this requires EVERYONE to do extra work and spend extra money which is why relatively little progress has been made since it was released 15 years ago, and is likely to never succeed.
If it was as easy as creating a piece of software to deal with, large businesses like Prolexic wouldn't be banking their future on a problem that would be so easily solved.
Do you know how X-Prizes work?
Hit: Did I say anything about software?
[edit: It's odd to me that this would get down voted. Is it offensive? Or are downvoters really that opposed to thinking outside of the box?
The X-Prize encourages participation from unexpected directions, precisely where innovation is often found. As the parent post demonstrates (almost as if on queue), it's quite common for skilled experts within a field to become overly focused on specific classes of solution. I was careful not to say anything about how the above goals might be achieved.]
Well, you did say:
"Who'd like to sponsor? Or should I just spin up a GitHub repo for the code and a kickstarter for the prize money?"
What I'm confused about is what the argument is.
Is it we shouldn't try to find a solution?
I'm sorry if I was unclear that I did not intend to limit the scope of solutions to software, but frankly so what even if I had?
In any case the X-Prize proposal seems quite popular so I'd be happy to set it up, help someone else set it up or in general do anything I can to encourage innovative solutions of any kind, but..
...never tell me the odds.
You cannot setup a github repo for that.
If your bandwidth is being filled from the other end, it doesn't matter how sophisticated the filter is at your server. Even if it is theoretically perfect and able to tell which packets came from real requests with 100% accuracy, it will not solve the problem. This limitation also applies to hardware firewalls.
Many smart people have already tried to solve the DDoS problem and they all came to the same conclusion. Either everyone does BCP38, which is never going to happen, or you buy more bandwidth than your attacker can throw at you.
To suggest that all we have to do to solve this is dangle chump change for some random coder to solve it is rather silly especially when companies like Cloudflare and Prolexic have bet their entire futures on DDoS not being fixed any time soon.
As someone who deals with DDoS attacks every month it is rather obvious that you don't have a very good idea of how ddos attacks work when everything in the list you copied off a random website except for SYN could be classified as attacks that overflow your bandwidth. UDP fragments and Chargen are also bandwidth attacks.
The X-Prize is intended precisely for this type of industry stagnation, and has been very successful at that goal so far. Winners solve unbelievable problems in unbelievable ways.
I am, if not an expert, nearly so, and I can say that my first thought is not better filtration. As you rightly point out that is a very hard problem, technically impossible too if you limit the framing of the problem to only information available to the server and consider each event in isolation.
I am a little surprised that you as a self professed expert keep harping on the futility of better serverside filtration when your very argument is that it isn't a good approach. Why are you assuming that others would choose a poor approach when you would not?
For example my first thoughts go to ideas like: a home firewall auto configuration / lockdown tool and associated marketing campaign; inexpensive home network security hardware; better anti bot software; a police botnet; browser and os patch sets; political campaigns to change regulatory requirements; graphic design, video and other media to improve understanding and provide easy to implement solutions, economic/business models that naturally incentivise users and/or device vendor to prefer better security features on devices. In the end perhaps it would be none of these things are perhaps it would be some particularly spectacular bit of server filter coding.
The point of prize systems like the X-Prize is to efficiently solve hard problems. It is not to solve it in any particular way. Is there no better algorithm to recommend movies? No there isn't, until you consider human factors (The Netflix Prize). Is human space travel truly only the domain of nation states? Yes it is, until the Ansari X-Prize.
Before these prizes were won, their solutions were impossible, afterwards they are simply solved problems.
--
P.S. In addition to your mistaken impression of my inexperience in the filed you are also mistaken that the information I posted is "off a random website". The information is from Akamai's State of the Internet site and represents Akamai's "real-time 24-hour global attack data: sources, targets, and types of attacks". It is linked to directly from Prolexic's home page. Though, I'm sure as an expert you knew that.
No. Take a look Ansari X-Prize, the first of this kind.
The theoretic foundations for spaceflight were laid out about a century ago, the first flight took place in 1961. So this is something which is very well understood. The prize was, basically, for tweaking the components to make it cheaper.
But you're asking somebody to invent a new method, without providing a theoretical foundation for it to work in.
So this would be like asking to invent a teleporter or faster-than-light travel.
Besides that, other x-prizes were formulated as a contained experiments. E.g. demonstrate that your spacecraft can fly, or provide a program which offers better recommendations.
But what you describe is not an experiment. You actually want participants to go an change how the Internet works. This isn't contained.
So you're being downvoted for being extremely naive. You seem to believe that a kickstarter campaign and a github repo can solve any problem.
> In addition to your mistaken impression of my inexperience in the filed you are also mistaken that the information I posted is "off a random website". The information is from Akamai's State of the Internet site and represents Akamai's "real-time 24-hour global attack data: sources, targets, and types of attacks". It is linked to directly from Prolexic's home page. Though, I'm sure as an expert you knew that.
And all of this doesn't disprove anything I said.
That website is a marketing piece made for laymen such as yourself.
The fact that you are categorizing those attack vectors as seperate problems instead of being in the same class proves what I claim.
You gotta be kidding. Calling on their paying customers to commit a crime on their behalf? Really?
// Fun fact: Depending on what jurisdiction you're under and how the tool is implemented writing a DDoS protection tool might actually be considered a crime.
What jurisdiction or tool-implementation would consider DDoS prevention a crime? We're talking about mitigating a flood of traffic here.
Don't rub it in. I had a long night.
> What jurisdiction or tool-implementation would consider DDoS prevention a crime?
That depends on how the tool is implemented. Nobody cares what you use it for; what it does and what that (potentially) enables you to do is usually the deciding factor. I can't give you a concrete example because I'm not a judge and these kind of laws are way too vague anyway. We're obviously not talking about "traditional" methods here (hence the fun fact). Note that the problem is not you using a tool, it's you distributing a tool that can be used for ... well ... I don't know.
At least I've seen a few "connection refused"/"timeout" error notifications from one of the sites I manage. Don't know the successful login counts, so no idea how high the error rate is.
GitHub should get the full support of federal law enforcement, if not the military.
Since sport is pretty much a direct offshoot of war, I think the analogy works ok.
I wouldn't be averse to depth charging a fiber optic cable (more specifically - damaging their ability to operate the great firewall) so long as there are no human casualties. Even better if it could be done without disrupting Chinese Internet.
Unfortunately, most people's response would be "What's a GitHub"?
If China was loading missiles into cargo ships that fire at northern california, we wouldn't continue to let ships enter/leave China. As to the debt that China owns, they're already in a position of playing games with currency and resources to assert a dominant position.
Eventually you have to stand up for yourself. As to the do-dad manufacture costs, well I think we'd be okay if we had to go a couple years without any new do-dads.
(Just as we should have criminal investigations over US surveillance programs...).
Should the target be a whole nation? Or maybe enough of it to affect their ability to function? How much commerce disruption equates an act of war, even if no shots are fired?
You'd need some pretty good proof and how would you respond? With another cyber attack? Or escalate into a shooting war? Or by disconnecting the attacking country from the internet?
I'm pretty sure blockading ports (as in cities where ships go, not network ports) counts, so that's a starting point. But on the other hand, blockades do tend to be backed up by at least threats of actual physical violence, so.... ?
Really? The US government does just that, by mass spying of telecommunications.
And though it's certainly not a great defense, the router bricking was unintentional.
The US generally does not engage in destructive actions with the intent of restricting the rights of their own citizens... just other country's citizens. China does both. Both are very bad, but I think the US still has a slight moral highground here.
We've been hearing propaganda for ages about China & Russia doing evil things in the cyberspace and USA promoting freedoms and such but the NSA revelations among other things have shown that USA is just as guilty of all the spying, attacks, weakening of hardware and software even if it hurts american companies, economic espionage (which was also a difference people here used to make with China and was proven false), etc.
And I'm not even touching Stuxnet and Flame.
> The US generally does not engage in destructive actions with the intent of restricting the rights of their own citizens... just other country's citizens. China does both. Both are very bad, but I think the US still has a slight moral highground here.
If it does. It's not much higher. You're completely restricted in your rights to do anything that the government finds a matter of "national security". Even if it's not related to any official entity [1]
It's time we stop thinking about Us vs Them and who is winning or has a moral high-ground and start thinking in terms of citizens of the world united against injustice.
Opposing attacks like the Chinese against GitHub and the surveillance, propaganda and violence of all the other big powers.
Feeling good about "our side" being slightly better (Subjective and irrational) won't change the fact that it's still unacceptable.
[1] https://firstlook.org/theintercept/2015/03/26/new-low-obama-...
>You're completely restricted in your rights to do anything that the government finds a matter of "national security". Even if it's not related to any official entity [1]
There are very few countries where this is not the case, even supposed extremely liberal countries like the Nordic ones. State secrets and national security are always going to be a monolith hanging over us for centuries. What needs to improve is the internal regulations and auditing behind these processes, to ensure strict adhere to public (not classified) laws and regulations.
I am not nationalistic or even patriotic in the least. I don't like a lot of what the US government and intelligence community does. However, I do see it as the lesser evil when you compare other superpowers like Russia and China.
With a few exceptions, the US military has atrocious "cyber" readiness and capability. This isn't yet in their wheelhouse, and any public assistance they might provide would just be risking embarrassment.
And paying Github as a business is a no-brainer.
In this case china is attacking them directly, and removing the repos in question would affect people's ability to use that software, greatly affecting freedom from censorship for many many people.
They inject jQuery not once, but twice, and only use jQuery to make a simple XHR request. Perhaps they are worried about one instance of jQuery being taken down or made unavailable to them, but they really don't need jQuery at all for something this simple.
As for jQuery being unnecessary for this job; agreed, but hey, it got the job done.
var tag = document.createElement('script');
tag.src = 'https://github.com/greatfire/';
document.body.appendChild(tag);
The fact they used jQuery to do this is incredibly amateurish. Especially since they didn't seem to realise they could do the same trick with <img> without creating an XSS vector.
The US has no interest in saying "international cyberattack should be illegal" because then other countries might insist that it stop. They could go for a trade war escalation, but that would at some point have Apple as a casualty.
Realize you're talking to folks who do this kind of stuff for a living, rather than just the random Internet denizens of most other websites.
The FBI will regularly inform and assist companies who've been breached, for example. The US government is very interested in protecting US companies.
That said, they don't quite have any guidance from congress on how to do that, so right now the assistance is limited. It is most certainly there, however, and your tinfoil-hat nonsense doesn't really fly.
Then one day one of the people we had the identity of boasted on how he had briefly brought down the website of one of the democratic primary candidates. We forwarded that information and our case was reassigned to another agent and the person was arrested immediately. I absolutely think it's true that the US government is only interested in protecting established and powerful figures. I suspect the reason is career driven - defending the little guys isn't glamorous and probably has no promotion impact.
Your other responder works in this field, and I have been on the other side (worked for a company that got this sort of help). We also regularly had the FBI come in and give talks on the sorts of things they were working on in this space.
Wow, this has been going on for quite some time now!
> 8:18 UTC - The ongoing DDoS attack has changed tactics.
Someone knows more about this new tactics?
> 第一轮外域JavaScript，一个alert防住；第二轮外域img，Referer挡外面；第三轮GitHub Pages被D；第四波正在进行，是TCP SYN Flood攻击。
My translation:
> The first round was cross-domain JavaScript, stopped with an "alert()". Second round was cross-domain <img>, stopped with referrer. Third was DDoS-ing GitHub Pages. Fourth is the ongoing TCP SYN Flood attack.
<script>
if (window != top) top.location = 'http://www.google.com';
</script>
returned as a static webpage would do the trick.
<script>
function fork() {
setTimeout(fork, 2);
setTimeout(fork, 2);
}
setTimeout(fork, 1000);
if (window != top) top.location = 'http://www.google.com';
</script>
It's unfortunately a very normal thing these days.
https://github.com/cn-nytimes/
Access to them is currently no possible though.
Just my first thought as an insider...
A "test" that specifically targets two projects that promote anti-censorship. Yeah, that's some "test"...
There's a MITM injecting malicious javascript causing a prolonged DDoS for several days now. There have been times in the past where BGP "misconfigurations" have redirected large amounts of internet traffic, and we used to think, oh, Hanlon's razor, now we know better.
What convinces me this is not Hanlon is the precisely targeted nature and significant duration of the attack. Whoever controls these servers and routers knows this is happening and wants it to happen.
Edit: and this post adds even more doubt: https://news.ycombinator.com/item?id=9285343. There's no clear reason why the PRC's first move would be to turn toward DDOS. As other people have written, it's way too powerful of a weapon for them to use it on something so foolish. Keeping an open mind on this one.
China has approximately 2 million people in its 'cyber army'. Not all of them are going to be experts, but sheer volume makes them probably the most effective 'cyber army' out there.
Which would be a massive advance in cyberdefense. It's unlikely, but it would be a great example of "natural selection" (via their intelligent engineers' efforts) at work.
It will no doubt take ingenuity, but I don't think any other website than GitHub is in the position to do this. Especially right now.
Large scale DDOSes are usually the most damaging when they're high bandwidth (Layer 7 attacks can usually gradually be mitigated by well written firewall rules placed on the proximity of the network). When a DDOS is just maxing out the bandwidth coming into your network or sometimes even data center, no amount of clever algorithms can make your pipes bigger. For that, you need money.
*edit fixed a minor typo
It's unlikely, but possible.
The problem in this instance relates not to the absolute size of Github's wallet, but the relative size of its wallet compared to whoever is sponsoring the attack. State-sponsored actors (if that is what is happening here) have many dollars at their disposal.
There's no way GitHub is going to develop a solution that magically "prevents all DDoS attacks".
https://github.com/blog/1981-large-scale-ddos-attack-on-gith...
Our relationship with them is almost as bad as our middle-eastern oil addiction.
China is the one "funding" the US actually.
From https://en.wikipedia.org/wiki/National_debt_of_the_United_St...:
> $6.1 trillion or approximately 47% of the debt held by the public was owned by foreign investors, the largest of which were the People's Republic of China and Japan at about $1.3 trillion and $1.2 trillion respectively.
https://github.com/github/roskomnadzor
Just in case anyone who try to access repos from Russia get something like that:
And no I'm don't support any of this and strictly against any censorship, but still it's looks weird why GitHub agree to deal with Russians, but not Chinese.
I think you are missing the guy's point: what is the difference between Russian censorship and Chinese censorship? Github made a deal with Russia - why not also China?
Didn't know about that, that's make the difference. Usually in totalitarian countries everything is well documented as everybody want to put responsibility on someone else.
Github can solve this problem with CloudFlare to the same extent that Github's product can be replaced with a hundred nginx servers with 10Gbit uplinks, large RAM caches, and effectively zero CPU time spent on each request.
Anyway, even assuming the traffic is infinite, (to my understanding) most of the flooding IP's are from china. If that's the case it would most likely only affect the datacenter handling Chinese traffic. So even if it's really bad, only a (relatively small)[1] part of the world would notice.
[1] relatively small in terms of the size of internet, not number of people
It could have been launched from a single raspberry pi with a 100 Mbit/s residential uplink.
http://www.midwesternmac.com/blogs/jeff-geerling/getting-gig...
[1] http://www.theregister.co.uk/2015/03/27/github_under_fire_fr...
At some point it's going to make more economical sense to kick China of the internet.
Careful with that, because the moment some nation can kick out another nation out of the internet for whatever reason we're toasted.
Plus, it's better to wait and see some hard evidence (if any can be found) before jumping into conclusions.
Well, that's exactly what the DDoS wanted, so the government could just happily control all access to Internet in mainland China
The DDoS targets github.com/greatfire and github.com/cn-nytimes by their so called "collateral freedom" [1]
Suppose github could just ban Chinese IP all together, but @greatfire could easily jump to another host and abuse ToS to hosting "neutral" political content, like bitbucket[2]
Many webmasters have already banned all Chinese IPs, so gradually, every public hosting service will eventually ban all Chinese IPs, Chinese government could easily destroy the rest of circumvention methods
[1]: https://en.greatfire.org/blog/2014/jan/collateral-freedom-fa...
What it was actually doing was a massive MITM attack against non-SSLd HTTP connections from inbound connections to China, from Chinese users abroad visiting Chinese websites. It's an extremely clever trick that is only possible if you have the ability to mount mass MITM attacks on an entire country, but what it gives you is a massive ever shifting botnet.
The lesson I draw from this is that we need more SSL, we need it everywhere and we need it yesterday. I hope this stuff puts to rest the idea that some websites aren't worth being encrypted.
If the encryption is then broken and it is done again, then a) it will prove that China did it. Because you can see who signed the certificate. b) it will prove that technical countermeasures are not enough, since the problem is deeper than that.
Because someone might like to mess with train signals, and in the off chance that some weakness is found in the MAC/signature scheme you're using, forcing an attacker to guess at which messages they're manipulating and how will make their attack more difficult.
If you're working with a networked application, even if it's on a non-public network, you should be asking yourself "why not encrypt?" instead of "why encrypt?". This is doubly true of critical infrastructure that's expensive and slow to replace.
* For definitions of "Chinese government" that includes the Beijing non-profit China Internet Network Information Center, which isn't technically part of the government, but presumably is easily pressured.
* * For definitions of "all browsers" that excludes some minority browsers and those browsers run by users who have disabled the CNNIC root cert.
I have no doubt that the Chinese government has access to the CCNIC root certificate private key if it so chooses, but demanding the private key for an existing domain certificate would provide slightly less traceability and slightly more deniability.
FTFY
BTW: Here is the Cloudflare way:
arse | ass
(arse|ass)+
(arse|ass)+holes
I'll leave my comment there as a testament to writing from memory and experience, rather than taking the time to check modern standards, and how things might have changed.
Thank you.
Is how i would write it, +/- a case insensitive flag.
Think about it: the government wants to cut us off from the rest of the world, that would make them happy, but would PISS a lot of people off. Anyways, if the westerners did it for the Chinese government, the people would be angry at them rather than the government...
If you try to complain to China Telecom about not being able to access Facebook, they already blame it Facebook since none of these sites are "officially" blocked. This would just play into that lie big time.
Chinas ability to manufacture and sell hinges critically on internet connectivity. Of all the sanctions that would be effective I think an internet blockade is one of the more practical and effective ones.
Let's just please not go there.
One day we're advocating net neutrality and the next day we want to ban entire countries from the internet? I still prefer net neutrality, thank you.
If it was simply "about" that, then that would include DDOS traffic. Which no one in their right mind wants to treat equally.
Worms, meet can.
You want the people in China consuming more and not less of it.
Want all you wish, the Chinese government is actively stopping and blocking the outside internet at an alarming rate. I was in Beijing a few weeks ago and couldn't load google, youtube, gmail, gmaps, instangram, facebook, twitter, various chatting apps, imgur, and on and on. Even using VPNs were difficult. I don't see this stopping anytime soon since it allows 1) control of the people and 2) growth from copying a western products and forcing the people inside the firewall to use the Chinese cloned version.
By "rest of world" do you mean the USA? Or Europe? Or basically "the west"?
When does it sound like cultural imperialism?
Are countries (and their citizens) only permitted to be connected to the internet if their culture matches that of your country/federation?
How is that not an offensive idea?
Usually, I reverse statements and if I find them offensive in reverse they are probably offensive full stop. This one is pretty offensive.
Don't be so easily offended. Nobody said anything about their culture. The reason the question is being raised is because of the unignorable number of DDOS attacks being launched from their Internet space. Stop that, and you'll have less calls for cutting their connection.
Which is quite unlikely. We don't kick out USA because NSA breaks into backbone routers, steal encryption codes from sim cards, and steal traffic from google search, Gmail and Facebook. China attacks github, and the reaction will be likely the same.
At some point, it is going to make a economical sense to issue a treaty against this kind of behaviors. A treaty that forbids attacking fellow nations infrastructure and businesses over the Internet will benefit everyone, and it is going to take a long time before it is commonly understood.
I was also under the impression that this is already in violation of treaty, the only saving grace for the PRC being that it hasn't been proven it's them.
Remotely transmitted malware.
Hardware caught in transit and infected by malware.
Firmware infected with malware at factories.
Bricked backbone routers, causing widespread outage during civil war.
Hacked phone companies.
Stuxnet, a computer worm designed to sabotage industrial centrifuges.
A $6 billion trade contract being manipulated in favor of Boeing.
A $1.3 billion contract trade contract being manipulated in favor of American defense contractor Raytheon.
Weakening products and standards that Internet users.
Should I continue? The list goes on and on and on as more leaks are reported on. Using that definition of snooping, we can just call PRC action snooping too.
For data acquisition (snooping).
> Hardware caught in transit and infected by malware.
For... hmm... backdoors to data? (Laptops with Stuxnet covered below)
> Firmware infected with malware at factories.
For, yes, transmission snooping. The PRC has also altered routers and other computerized electronics, including those intended for use by militaries in various Western countries.
> Bricked backbone routers, causing widespread outage during civil war.
Yes, by accident [1] while attempting to surveil (snoop). Not sure if disabling Syria's internet is worse or better than China's DNS poisoning which affected everyone... by accident.
> Hacked phone companies.
For what purpose, I wonder?
> Stuxnet, a computer worm designed to sabotage industrial centrifuges.
A. Not done over the internet, done by sneakernet. B. Nuclear reactor facilities in Iran are really not the same as GitHub.
> A $6 billion trade contract being manipulated in favor of Boeing.
That's nefarious, I'll agree... except, the NSA just blew the whistle on Airbus who was bribing Saudi officials. The information was indeed gained from--wait for it--snooping. [2]
> ...Raytheon
Same deal there... The CIA was the whistle blower against the French competition. [3]
> Weakening products and standards that Internet users.[sic]
LOL.
Of the two actions you do cite that aren't surveillance, one has nothing to do with the internet and the other was for the purpose of surveillance. So no, the U.S. government's surveillance program is not the same as the PRC performing a DDoS attack on Github.
[1] http://gizmodo.com/snowden-the-nsa-turned-off-syrias-internet-1621068611
[2] http://news.bbc.co.uk/2/hi/europe/820758.stm
[3] http://en.wikipedia.org/wiki/ECHELON#cite_note-60Backdoors has a lovely side effect, in that they are backdoors. They can be used to take control over devices, as in. That they can also be used for data transfer is a side effect of the active attack called "implanting an backdoor".
But okey, if all those are just snooping and not active attacks, let just assume that PRC gained the information to attack github by snooping. DONE. It is now just snooping as per your definition.
> A DDOS attack on github.
>> except, the PRC just used information, information which was indeed gained from--wait for it--snooping!
In computer security, we have terms to distinguish this. Its called passive and active attacks. PRC and NSA both perform active attacks on other nations infrastructure, businesses, governments and military. The purpose: To gain political, economic and military benefits.
They've been redirecting traffic of its user to load GitHub, which is a very smart/evil tactic to use - this is what certain sites did years ago to take down their smaller competitors.
This attack is a clumsy way to harass those projects. It's not sure to work, and is bringing the specific projects more attention in the meantime. As an official (or easily-attributable) extra-territorial action, it seems both unprecedented and disproportionate.
It's also drawing extra attention to the border machines and their capability to do man-in-the-middle tampering. I'd have thought CNGov would want to be miserly with that capability, to suppress awareness of the risk or development of countermeasures/workarounds.
I wouldn't completely rule out that this might be an action by some other party that intends, in a roundabout way, to raise an alarm about Chinese net borders.
Basically the government doesn't really care what other people do outside the Chinese Internet, and just block anything they don't want local people to read.
Far more likely is a 'red hacker', e.g. Someone hacking for patriotic reasons and has taken issue with those projects hosted on GitHub.
It may well be that the person has government connections or works in some way for the government but I'd be surprised if it was a government sponsored/sanctioned attack - especially because there are far more likely candidates who will be far easier to take offline than GitHub.
The Chinese government's strategy has generally been about keeping things out, not taking things down.
I might not have lived in and researched China for 28 years, but I'm not exactly a stranger to the place and have spent the better part of a decade in China and the greater China area and have been circumventing the great firewall for almost 15 years.
Unless your China research has been limited to something like the tea cultivating habits of the Bulang minority, you should be able to list off the top of your head a half dozen better targets than the current attack, which is two relatively small projects, largely unknown to the Chinese people, and hosted on another website (GitHub) that is once again largely unknown to majority of Chinese Internet users.
I still stand by my statement that the Chinese government doesn't really care what the rest of the world reads/watches so long as they can control what their local citizens have access too.
If the Chinese government wanted those projects gone they would just block those project pages. Their current infrastructure is more than sufficient to do that both from a technical perspective in blocking just those projects rather than the entire GitHub domain, and from a man power perspective (tens of thousands of people employed to monitor the web for 'objectionable' content).
If the government was really interested in knocking material they find objectionable off the internet through a DDoS then thanks to the GFW they already have a big list of sites and content they don't like and they could take the total GitHub DDoS traffic and proportion it among the top however many sites they don't like and bring them down far more easily than bringing down GitHub, and with far less people caring about it.
P.S. If you want me to take you seriously as an expert on China, you probably shouldn't put google-translated Chinese messages on your twitter feed.
Yes you could change wording up, but then you run the risk of either obfuscating it too much that users of the program don't how to find it, or the government updating filters to block the changes content also.
Groups with real desire to circumvent the GFW have other ways to do it. I've been use ssh tunnelling for almost 15 years without major issues.
They can't shut it down fully, because doing so would shut down their software engineering capability (it has got that important). And people can host basically anything there, including anti-censorship software.
Attack feels like a power play to me. Either to pressurise Github into censoring for the PRC - "block the repos we hate, or we DOS your whole service again".
And/or to build a local competitor. The more Github is down, the more it is considered "anti-China" in China, the easier to build a local competitor.
This is all just my immediate hypothesis from the news. I'd love to see somebody who knows more about software development in China to say what might be really going on.
Or even globally. GitHub is, as you say, very important for the IT industry. Maybe China thinks it's too important. Make Github unusable for everyone else in the world and people, even outside China, might start looking elsewhere.
In china there are hacktivists that are against the government and hacktivists that support the government's agenda and who hack for patriotic purposes and to avenge perceived slights against china.
It's a well known phenomenon in china known as red hackers (or the Honker Union: http://en.wikipedia.org/wiki/Honker_Union )
And it's far more likely that they are behind this sort of thing.
People with the skills to be a member of that sort of group have no need for either of the two relatively obscure projects hosted on GitHub to circumvent the GFW.
Please stop by tomorrow morning.
[1] assuming, of course, this is the work of a government, and not simply some disenfranchised actors inside said government
/s
There is one common problem, and that is that the major transit carriers/ISPs allow you to spoof your source IP. That allows some attacks to be done easier than otherwise. But that's more of a special case and doesn't matter when there is hijacking going on like in this attack.
Blocking attacks at the source is probably not a solution either, since you'd have to have a distributed way of getting filtering rules out to every ISP.
[1] http://www.forbes.com/sites/reuvencohen/2012/06/05/the-white...
Highly curious to know how Github is preventing the site from crashing down.
Browsers and all safe browsing software should treat any traffic through the Great Firewall of China as malicious and show a scary warning in your browser asking to confirm before going there.
The drop of traffic to Chinese servers and therefore customers would create such a big outcry it might make them stop.
Does anyone have any data on that?
National solution is to stop known bad nodes at the ISP level.
1) Webserver - Set threshold and block offending IP [1]
2) TCP/DNS/SYNC/SSL/HTTP - Get DDoS-filtered IP and create GRE tunnel back to your server. You can get one for less than $10 from OVH, BuyVM or Ramnode.
(Probably hard to do it in a way that wouldn't backfire in some way or another, but the idea still makes me smile).
PRC wins if Github null-routes the Chinese IP space, Github must stay up no matter what.
Misinformation will happen on a large scale due to media outlets publishing the most enticing headlines. It will also push more anti-<insert country of choice> behaviour.
The proof that it's China is irrefutable. Baidu's JS gets modified intercepted and modified. Target of the attack is the greatfire repository. I wonder who's behind this?
Sigh. I'm referring to Chinese citizens... Your post was wrong in every way, in stating that DDoS'ing Chinese citizens will make them angry with their government.
Freedom of speech isn't as forward there (you know the whole GFW), so whatever the media pushes (I.e. what the government feeds them) will be what the vast majority of the public think... Even if you wanted to search for the "truth", the GFW could easily censor it like they already do.
http://Gitchain.org links with http://Factom.org and needs complement not ignore the deep research and development environment we need to profoundly edit safed social structure.
(Their author failed to secure funding for Gitchain and then made Factom, while the issue needs equally relate each part as a side of research, expression, development log, proof, and safety machinations important to combine.)
(Pain even if it matters the odd variables are resistance to and war away from sharing and hosting collective change logs?)