Hacker News Reader

Comment by TazeTSchnitzel | Hacker News Reader

Hmm, I wonder if this could backfire. If it's an <iframe>, couldn't GitHub insert code that framebusts? If it's some other mechanism, couldn't they block by referrer? If it's CORS, couldn't GitHub deny CORS requests? If it's a <script> tag, couldn't GitHub do some nasty XSS?

Edit: ooh, take a look at the more detailed look from insight-labs: http://insight-labs.org/?p=1682

It's XMLHttpRequest ($.ajax), but with dataType: "script". Looking at the jQuery docs (http://api.jquery.com/jquery.ajax/):

"script": Evaluates the response as JavaScript and returns it as plain text. Disables caching by appending a query string parameter, "_=[TIMESTAMP]", to the URL unless the cache option is set to true. Note: This will turn POSTs into GETs for remote-domain requests.

Oh dear. If GitHub can detect this, GitHub can basically XSS all sites using Baidu's analytics.

Edit 2: Oh, the insight-labs article says the attack has stopped.

View on HN

That's exactly what they did! At the moment of this writing they are sending back:

    alert("WARNING: malicious javascript detected on this domain")

when you're trying to reach: https://github.com/greatfire/ or https://github.com/cn-nytimes/ That's why other people have started to notice it (as the article describes).

Timeline of the attack looks something like this:

1. The Chinese firewall hijacks requests to http://hm.baidu.com/h.js and sends back a script that attacks GH instead.

2. Github notices that a huge amount of people are trying to reach https://github.com/greatfire/ and https://github.com/cn-nytimes/

3. GH figures out what's happening and starts replying with the alert javascript snippet.

4. Users are now getting noticed by the alert every time their browser runs the hijacked javascript.

5. The person that wrote this article writes this article after investigating what the alert message is about.

If I were Github I would redirect the attacker back at one of their own resources.

A attack reflection of sort.

Edit: You're technically not attacking you're reflecting if the attack stops there's nothing to reflect.

Just like in martial arts you don't just take a beating you defend and return the opponents attack back at them. Seems fair to me.

Who should they "reflect" the attack back at? Baidu, who seem to be a victim of HTTP hijacking in this case? Or the Chinese government? If the latter, then where exactly do you focus the counter-attack?

http://www.gov.cn/

That will show them!

Baidu == Chinese Government

I don't know. If I were a private company, I'd go out of my way to avoid antagonizing nation-state level governments.

That does not seem wise. China vs. GitHub, China will win.

It would be interesting to know how important Github is for China's economy and how important China is for Github's.

China's GDP is 10 Trillion dollars. Github is not at all important to China, other than a source of tools to citizens use to circumvent their authoritative regime.

> Github is not at all important to China

If that were the case, I don't think they would have backed down and allowed access to Github again.

Or maybe by blocking it during the timeframe they did, they have accomplished their mission and there was no further need for blocking.

I sincerely doubt github is at all important to China.

again, then why did they unblock it? it is important, we're in a new paradigm for software where developing in the open leads to higher quality software written faster than previous ways

It's hardly a new paradigm, it's just a place with a lot of software that you'd otherwise have to write from scratch. It's merely software development catching up with everything else.

I'm sure Github and free software is a goldmine to the country that built its economy on copying other people's stuff.

On the other hand, the capitalists running the communist party might scoff at the idea of software that everyone is allowed to copy, because that offers no advantage to the unscrupulous. At least I'd imagine they would scoff at copyleft, just like Github does.

That is true, even Google can't fight against China.

I imagine they have the technical resources to – they just don't because as a public company they are obligated to maximize shareholder value.

I would put it more on the fact that attacking a foreign government is kinda usurping the role US government and they won't take kindly to that.

Google made a choice.

You can always fight, even if you believe you will lose.

...in China. Outside of China, my money would be on Google.

An eye for an eye makes the whole world blind?

Apart from one person with one eye left

As much as I love MLK and Gandhi, this assertion never made sense to me.

An eye for an eye would leave two people blind: the person who blinded the other, and the one that was blinded.

Once people start seeing the severe consequence of blinding someone (getting blinded back), they and everyone else would most likely stop, not continue blinding more people.

The reason it doesn't make sense to you is because you are assuming it is applied in an ideal perfect universe, while the statement is referring to the real world, where any retributive rule is applied by imperfect actors who make errors in the assignment of culpability (both in identification of who is responsible and in identify whether their act was justified in the first place.)

Such errors result in people who shouldn't be blinded themselves being blinded, and are themselves the subject of retaliation by the same error-prone process.

And there are many, many real-world examples of this in the form of multi-generational inter-family feuds.

Well said. It's your nuance that I like, and it's the lack of nuance in the original assertion that I find wanting.

>An eye for an eye would leave two people blind

Well under your reading wouldn't it just leave them each without one eye. They may be blind but in most cases they will still have one other functioning eye. /pedantry

"Who paid retribution for the second blinding? The second paid for the first, I demand a third eye" ... ergo the aphorism.

That's correct, the only problem is it takes thousands of years for humanity as a whole to agree that the consequence is too severe to stand. On this time scale, the idea of not fighting wars because they cause damage is relatively new.

>redirect the attacker back at one of their own resources

Why only one? :)

Because that’s not a DDoS anymore if you target a lot of traffic to a lot of different resources.

Yes, it is an amplified DDoS. The attack doesn't become weaker, it would only target more machines.

Just to clarify, did the DDOS stop due to GitHub adding that warning text making the hack reflect poorly on Baidu and hence the perpetrators being subjected to internal pressure? If not, GitHub would still have to serve that JS and hence would still be bombarded by millions of content request.

Even better, popping up a JS alert stops further JS execution, so this was a clever way for Github to throttle connections (rather than them being made every 2 seconds as per the hijacked Baidu JS)

I see; I missed the part where the resource request was executed every 2 seconds. The alert essentially would make the page unusable. From my understanding that Baidu is Google for china, the amount of productivity lost since people not being able to search, would mean the hack backfired spectacularly.

Well, except for the fact that it only impacts people who access Baidu from outside the Chinese firewall. People who access Baidu from inside China would not have their Baidu use interrupted.

they can do something better: they can put some javascript disabling the hijacked JS like

alert('......'); r_send = function(){}

window.top.location = "http://gov.cn";

It looks like what they did was change the url to only serve out the alert in plain text. Which is a lot less resources to use. I would also assume that they are willing to use those resources to fight back.

Imo they should have converted the targetted pages to a static cache and just document.body=page it, the users would notice (not able to access anything) and the pages would still be accessible on github.

Oh, I see, gotcha.

They already are, inserting a alert().

What would be much more interesting is replacing <body> with a multi-lingual message explaining what's happening and how to block the Baidu script.

Reply on news.ycombinator.com