A JavaScript-Based DDoS Attack as Seen by Safe Browsing

If this was done by China, would TLS everywhere really have prevented them from performing this attack? Couldn't they perform a TLS MITM, spoofing Baidu to people outside the GFoC. They would have the ability to modify the DNS records that show up outside China and certainly would have a CA they, effectively, control to provide a Baidu cert. They could proxy the request through to the real Baidu, then inject the JS to whatever comes back before passing it on. To the user outside China, everything looks copacetic.

It is certainly a more difficult attack, but it doesn't seem like it's outside the realms of possibility for a state actor that funnels all content through one pipe. Am I overlooking something?

Out of curiosity did the Safe Browsing people notice the DDOS at all while it was happening, or did you just use the news item as justification to poke through some historical data?

They don't identify the network operator they mention. I wonder if this is to prevent an international incident...