Hacker News Reader

Comment by wsxcde | Hacker News Reader

> We remain puzzled as to why the GC’s operator chose to first employ its capabilities in such a publicly visible fashion.

This is the most important question here. I think it's fair to assume this must've been a deliberate choice by the Chinese authorities to conduct such a visible attack. The alternative, that they didn't realize what they were getting into, that they thought Github would cave quickly, seems much to simplistic and naive. And whatever else you can say about the Chinese government, you can't accuse them of being naive.

If you believe this was deliberate attack, it seems this is a parade demonstrating electronic warfare abilities. The message being sent seems to be, "don't mess with us, we can do everything you can do and possibly more."

View on HN

> If you believe this was deliberate attack, it seems this is a parade demonstrating electronic warfare abilities.

Probably deliberate with a lot of incompetence mixed in.

Most politicians have zero understanding of the Internet. They decided to do this as a demonstration of force and may not have consulted the people who built the Great Cannon. Or, the people who built it don't have the clout to say not to use it except for important reasons.

They also probably didn't realize that Github could eat the attack.

The problem with having done this is that, I suspect, that a lot of ISP's now have null routes of China on standby along with bandwidth monitors that will choke traffic spikes from China almost immediately.

So, it didn't actually succeed. And people have now analyzed the attack and deployed coutermeasures.

Not a great result for China.

I don't think DDoS is a real offensive weapon in cyber-warfare. It's just a noise-making attention-drawing machine.

What the paper calls targeted exploitation is the real weapon here. The main thing I took away from this paper is that the Chinese government now has the infrastructure to pwn anyone who visits websites hosted in China. This is pretty scary and simultaneously an amazing engineering feat.

Any advice for visitors of those websites hosted in China? As a Chinese, I am always wondering if there is a way to avoid this. Many of us are aware of the backdoors in the Chinese apps (across all the platforms). No matter how big names they are, they have to comply with the order from the ruling ones (I guess most of them cooperate with little guilty feeling). The best I can think of is to have different devices for visiting/using Chinese apps/websites. To a larger scale, I think average users have very limited resources to hide from big organizations. What average Joe could do is a more general question I have not figured out. Thanks in advance.

The ideal answer is to convince the sites you visit to use https.

I don't think, practically, we could expect anything positive from the other side. But still thanks.

Given that the Chinese government could inject malware into any insecure connection you make across the firewall, you may also want to do most of your browsing through a virtual-machine.

Thanks, note taken.

If the Chinese government controls a single CA that's installed by default, couldn't they MitM any TLS connection that isn't pinning certs?

Are there any Chinese CAs in any browsers' default installs? If so, they should probably be removed immediately.

CNNIC is no longer trusted by Chrome due to recent incidents, and you can manually remove it from Firefox and IE. While you're at it, take a few minutes to browse the list and also remove anything that sounds Chinese.

If any website you visit legitimately uses a Chinese SSL certificate, you can whitelist it specifically. I actually do this for SSL certificates signed by my own country's CA (not China), and it works wonderfully.

Some general advice, to decrease the chance any given browser exploit will work against you:

- Disable Java; disable or whitelist Flash; use a different PDF reader than Adobe.

- Use either Firefox with NoScript or Chrome. (Disabling JavaScript is highly effective at reducing attack surface, but on any sites you've whitelisted, Firefox is significantly less secure than Chrome due to the lack of sandbox, though they're working on it... I think that NoScript equivalents for Chrome don't work correctly, but could be wrong.)

- Don't use XP! It no longer receives security updates...

- For the same reason, on mobile, prefer devices that have up to date operating systems.

Not perfect, but that's the state of computer security these days.

Very detailed. Thanks for your input.

Most of China is running on outdated, no-longer-supported software with lots of vulnerabilities. Pawning those computers is easy as there is an abundance of well documented exploit vectors available.

I disagree. If the history of EW/SIGINT has taught us anything it's that denial of service through saturation is effective. E.G. "Jamming".

The question is if that truth transcends well from broadcast media (i.e. Radio) to packet based, routed networks such as the Internet. Esp long term effects.

Wouldn't the attack on github not have resulted in any traffic spikes from China? If the DDOS scripts are injected into browsers viewing Chinese content outside the firewall/canon, the traffic spikes would be distributed from all over the globe where ever there are Chinese expats

That's correct. I work at a company in the US, and visitors to our website were giving the "Malicious Script" alert because we had Baidu analytics installed. Defending against this is much more nuanced than just blocking all traffic from China.

So block the Baidu analytics CDN and call it a day?

That would work, assuming there isn't a workaround. If they were really serious about the attack, though, it's easy to imagine ways around that, especially if you add the possibility of browser caching and exploits in the injected script.

I'm curious what prompted installing Baidu analytics in the first place.

One big difference between the u.s. and china is that chinese politicians tend to have engineering backgrounds while american politicians tend to have law backgrounds.

I'm not completely disagreeing with you that chinese politicians may not understand the internet, but I don't think you can apply the same view of politicians you have in the u.s. to china.

"Username checks out"

Great points. The short term effect was costly, but was handled. But now the world knows that the capability exist and will start taking long term countermeasures. Thus the cost of developing GC has now to some degree been wasted.

But more scarily, the deployment showed that the method used worked (to some degree) and others will learn to implement similar tech. Thus the long term side effect is that more MITM tools will be developed and deployed.

This is the premise of cyberweapons: fairly ineffective, esp on long term against the intended target. But long term side effects is big since once deployed you hand over the knowledge about the weapon tech to others when deployed. Just like Stuxnet.

It's too weak as show of force from state government. GitHub is after all, a small civilian service, despite its prominence within tech community.

Even DDoS itself is not really a serious cyber warfare measure -- you can't really take down any major government agency (except their public-facing website) or core infrastructure with it. What's the biggest damage caused by DDoS in all of Internet's history?

Here is how I believe it goes down:

1, the new chairman issued mandate that he wants to crack down on accessing illegal content on Internet.

2, different department heads make this top of their priority.

3, somewhere down the management chain, a manager found those tools that help people accessing illegal content on Intenet.

4, the said manager himself, or one of his analysts figure if they bully GitHub with some DDoS, they'd cave and take down those tools. Points for promotion!

I doubt if even the US government takes this seriously.

Maybe part of the explanation for this specific attack is incompetence - miscommunication, comparatively junior people exceeding their authority, subordinates afraid to object, and everyone doubling down rather than admitting defeat. I could definitely imagine that the people who devised and built out the capability being furious at it being deployed like this.

If it has lasted a couple hours I could see that. But as long as that attack continued, no way.

Well, once it started, terminating it requires someone to lose face. So, yeah, I can see it continuing.

    Dr. Strangelove: Of course, the whole point
    of a Doomsday Machine is lost, if you *keep*
    it a *secret*!

It aggravates me that other governments aren't making a bigger deal about this. This is a WMD where non-combatants are being unwittingly used to fight a computer war between countries they have nothing to do with.

We knew this was coming for 20 years![1] But instead of taking the high road and defending the internet from militarization, the governments of the world raced to become the first to make computer weapons and hasten the downward spiral to destruction. Sixty years ago we said "no weapons in space" and it was the right thing to do. It allowed the commercial use of satellites to grow without threat of being caught in the petty conflict of nations. The internet was supposed to be the next extra-national frontier and for a time it was. But now that there are weapons being fired why would I want to invest money in an internet business that may become the victim of a DDOS? My insurance doesn't cover acts of war, if I lose money because of it there's nothing I can do.

We've got treaties limiting the use of nuclear arms so innocent civilians aren't at risk of being irradiated. We've got treaties limiting chemical weapons so innocent civilians don't get their lungs burnt away. We've got treaties limiting land mines so innocent civilians don't get blown up when taking a hike through the woods. (Oh, and thanks for not ratifying that, Obama.) We need a treaty limiting computer weapons so innocent civilians don't have their computers hijacked and personal data put at risk.

[1] http://fmso.leavenworth.army.mil/documents/chinarma.htm

Does China respect the no-space-weapons treaty? Would China respect a treaty regarding cyber weaponry?

American politicians have little stomach for confronting China. If a treaty were put into place, they'd be in the position of having to confront someone they really don't want to.

A treaty might be useful in some ways, but the best defense is ... well, a good defense (i.e. educating the masses, improving browser security, etc).

> Does China respect the no-space-weapons treaty?

A quick search showed China followed the US's lead in not respecting the no-space-weapons treaty.

From http://en.wikipedia.org/wiki/2007_Chinese_anti-satellite_mis... ...

In January 2001, a (US) congressionally mandated space commission headed by Donald Rumsfeld recommended that “the U.S. government should vigorously pursue the capabilities called for in the National Space Policy to ensure that the president will have the option to deploy weapons in space to deter threats to, and, if necessary, defend against attacks on U.S. interests."

Moreover, the U.S. withdrawal from the Anti-Ballistic Missile Treaty in 2002 has allowed the United States to pursue missile defenses, including space-based.

In response to US weaponisation of space, the Chinese started a space defense program, including anti-satellite defense.

The problem with cyberweapons non-proliferation treaties is that, unlike nuclear weapons NPTs, they are incredibly hard to verify and enforce.

Estimating the offensive capabilities in cyberspace of any government is incredibly difficult, as is attributing attacks. Governments can attack you in the internet without you realizing you have been attacked or without you being able to distinguish between a government attack and that of a small criminal cell (the GFW attack is noteworthy because it is very easy to attribute, and even then we can't know for sure it wasn't a third party trying to falsely implicate the Chinese govt... not that I think it was, the point is that even in this case we can't be sure). In fact, many of the capabilities that governments have in cyberspace are quickly matched by non-state actors, making the attacks even harder to tell apart.

And that is only about enforcing norms on the use of cyberweapons. Verifying that states are not hoarding vulnerabilities or attack technologies is basically impossible.

The only real alternative is to build safer systems, mandate higher security standards and basically assume that companies and individuals are going to be the target of government attacks (their own and others) on the internet. The role of a good government, should one exist, would be to provide support to their citizens to increase their security (via research, mandating stronger standards, monitoring the supply chain for sabotage, economic insurance, etc).

I'm no policy expert, but it seems likely to me to be a demonstration of capability. The Chinese government has been arguing for awhile now for their right to "Internet Sovereignty", the ability to impose Chinese policy on Chinese users of the Internet. This attack seems to demonstrate they also feel the right to extend that sovereignty into other countries, to block services like GreatFire they think are harmful to their sovereignty. This attack is them showing the world they have the capability.

More detail on China's Internet Sovereignty theory: http://blogs.wsj.com/chinarealtime/2014/06/23/chinas-lays-ou... http://www.huffingtonpost.com/lu-wei/china-cyber-sovereignty...?

Lets not forget the context that the Snowden disclosures brought into light. Borders and diplomatic relationships has been systematically ignored when it comes to developing and deploying offensive capabilities on the Internet. Sovereignty does not seem to exist in nations mind when developing malware, breaking into critical infrastructure, stealing information, or causing sabotage online.

>I think it's fair to assume this must've been a deliberate choice by the Chinese authorities to conduct such a visible attack.

I think it is a fair explanation but I wouldn't assume it outright. The incompetence and ignorance of decision makers should never be underestimated when it comes to complex technology.

It seems to be a common mistake of our age to assume that decision makers are "incompetent" or "ignorant" when it comes to tech. Individually it is unrealistic to expect these people to be universally competent in any field of expertise. It has always been thus, and that is why decision makers surround themselves with expert advisors.

I would suggest we should never underestimate the deliberate and meaningful consideration taken by decision makers when it comes to complex technology. Regardless of if you agree with the outcome or not.

We should never underestimate either competence or incompetence. Instead lets put very wide error margins on statements about the intentions and plans of leaders. It is too easy to fall into the trap of assuming total incompetence, or the other hand Dumbledore-like foresight. The truth is, most leaders have moments of both and luck plays a big role (See Steve Jobs or Winston Churchill).

>we can do everything you can do

Well, they couldn't take down Github.

you can't accuse them of being naive I will.i am of the opinion that any country that thinks they can be a big player in the global economy and introduce open markets to their country whilst simultaneously limiting freedoms of speech and choice has a certain amount of innate naivety. This may be a silly notion, but is there any chance this was a mistake like the way Stuxnet broadcast itself to the world?

I remain convinced that there was some other reason other than cyberforce posturing for the DDOS. Past examples of highly visible international attacks (I'm thinking of SONY here) have been to punish and embarrass companies for being complicit with US foreign propaganda efforts (re leaked Bennett/State Dept./Lynton/RAND emails). I'm not saying the exact same motivation is in play, but as github hosts files - notably code - and many governments have been cracking down on files hosting and shares (like pastebin, etc).

This is speculation, but I prefer the explanation to cyberposturing, since this isn't something China needs to do, and as far as I can tell wouldn't benefit very much from.

The theory is in line with greatfire, as this organization is a "Civil Society Organization" funded ultimately by the US government to spread messages it wants within China. Github is more confusing.

I am mystified by the puzzlement people have shown over what the CPC's motivation could possibly be. The Xi Jinping administration has been engaged in a ham-handed crackdown on civil society and anyone who engages in political activism or discussion outside the context of the CPC for several years now and that crackdown has recently intensified. VPNs have been disabled, universities have been warned not use Western textbooks or discuss Western ideas, activists and intellectuals have been detained en masse or prevented from returning to the country, etc.

DDoSing foreign websites that are actively attempting to undermine the CPC's censorship and repression campaign is completely in line with the priorities of the CPC's high officials, as well as their general level of subtlety.

Yes. So greatfire, VOA, etc make a lot of sense - but what of Github? I don't believe they are a CSO on their face. I can imagine CSOs using github to host code or information that challenges the country (let's say software to organize demonstrations or circumvent surveillance) - I'm not aware of specifics.

With regard to CSOs and weaponized NGOs - I personally have a sour taste for them (I recognize that they are 'legal', however 'loophole-like').

This is because I am not willing to affirm foreign covert influence on United States/Western and my own opinion. So I usually hardly know whether to cheer or mope in cases where CSOs are challenged.

Huh? The reason for attacking github seems completely obvious, given that the attacked projects were (1) a mirror of the nytimes Chinese edition (explicitly intended to counter Chinese government censorship), and (2) anti-great-firewall-of-China tools...

[Not that they hoped to actually keep github down in the long run, but rather were probably trying to send a message that "hosting info the Chinese government doesn't like will make your life annoying so better not do it"...]

Thank you - this is what I was asking for. :)

(Can you provide the links?)

"If you believe this was deliberate attack, it seems this is a parade demonstrating electronic warfare abilities. The message being sent seems to be, "don't mess with us, we can do everything you can do and possibly more.""

I think this is silly.

The bar is still set at stuxnet, in terms of computerized attacks on infrastructure. This is nowhere near stuxnet in terms of capability, destructive effect or ingenuity.

Also how the Chinese government show little regard for their tech industry and is prepared to trash Baidu reputation just to disturb some sites they find annoying.

Agreed. At only 1.75% of traffic, my guess is that they could pack a much bigger punch if they wanted to.

It's not something they could do very often.

Every time they do such they risk having one of their most important commercial sites (Baidu, QQ, TaoBao) null-routed by the rest of the world. That's not exactly a long-term strategy.

Honest question: why would China care if Baidu is null-routed by the rest of the world?

Because once it's nullrouted, it can no longer be used as a weapon. They only have so many cannons.

perhaps targeting ads to the large Chinese diaspora provides an effective way of redirecting some of the wealth accumulated abroad back into China.

The GitHub attack apparently targeted sites using Baidu analytics visited from outside China, so outside visitors are weaponisable too.

They are, as long as their ISPs don't block Baidu.

1. They lose the ability to use it as part of a similar attack in the future. They can't use the same trick too many times or it stops working, forcing them to work their way down a list of pawns.

2. It damages their relationship with Baidu and indirectly with other Chinese tech companies, in much the same way that NSA overreach affects US ones. There will be some internal political effects, depending on what stakeholders have political clout.

3. When external Chinese-speakers use Baidu, the government has some influence on what they do (or don't) see. If they are forced to other alternatives, the government loses a certain degree of information-control.

It may not be as big and publicly visible as we think. Big would be targeting a stock exchange. Thinking at the nation-state level, Github is small potatoes. Who is going to know or care outside of the tech sector?

Reply on news.ycombinator.com