Comment by moe | Hacker News Reader

Comment by moe | Hacker News Reader

I don't like the underlying assumption in all these articles that the Chinese government was behind the attacks, as if we had proof for anything.

Apart from the rather blurry technical analysis this particular article claims:

In recent public statements, China has deflected questions regarding whether they are behind the attack

But when you follow the actual citation[1] it refers to this rather underwhelming exchange, taken place on a chinese press conference:

  QUESTION: [..] a report says that a US website was under
            hacker attack, and the source of the attack was from China.
            How do you respond?

  ANSWER: [..] it is quite odd that every time a website in
          the US or any other country is under attack, there
          will be speculation that Chinese hackers are behind it.
          I'd like to remind you that China is one of the
          major victims of cyber attacks. [..]

So the chinese press lady gave her standard boilerplate response, to a less than specific inquiry (which she probably hears on every press conference), in between handling questions about illegal fishing in Somali waters and the Arab League Summit's commitment to a joint Arab military force.

And this is now "compelling evidence" for China being officially behind the Github attack?

[1] http://www.fmprc.gov.cn/mfa_eng/xwfw_665399/s2510_665401/251...

The technical analysis pinpointing the attack to the Chinese government was definitely not blurry. TTL based tracing is very deterministic and easy to understand, and finding the injection point to be at the same spot with the Great Firewall is pretty much the closest thing to a smoking gun with regards to Interner attacks.

Of course, while the smoking gun was found from Chinese Internet censorship offices and was covered with fingerprints of Chinese Internet censorship officials, it still might be not perpetrated by the Chinese Internet censorship officials. It is only very likely that they were behind the attack.

The technical analysis pinpointing the attack to the Chinese government was definitely not blurry.

If anything the attack was pinpointed to Chinese infrastructure, not the Chinese government.

TTL based tracing is very deterministic and easy to understand

It's only deterministic if you trust all hops between yourself and the target, as any of them could fake the remaining route.

I don't know about you, but my 'traceroute baidu.com' passes through AT&T, an american company that is mentioned first in about every article and lawsuit about the NSA mass surveillance.

So if you're willing to buy into the theory of China performing this attack just for a demonstration of ability (because there's no other visible benefit), how can we know it isn't exactly the other way round?

[1] http://en.wikipedia.org/wiki/NSA_warrantless_surveillance_(2...

[2] https://www.eff.org/nsa-spying

Chinese infrastructure, not the Chinese government

There's no meaningful difference.

Governments can lose control of their infrastructure in the face of a well-equipped hacker.

Demonstration of ability is one way to put it. Limited weapons testing is another. You don't enter a fight with untested weapons.

Limited weapons testing

That's not a very convincing theory.

For a proof of concept they'd only have to mangle a handful of requests without anyone noticing. There's no need to attract everyone's attention and inform your potential opponents about your capabilities.

Your comment is thoughtful so I'll reply in kind. Is there any other plausible actor who could be carrying on this attack for so long? And is motivated to attack GreatFire? The Chinese government controls their Internet connection to the world with a firm hand. Who else could it be?

I agree that more technical evidence of the attack's source would be welcome. But the analysis published here is pretty convincing. Specifically "the GC acted on traffic between hop 17 and hop 18, the same link we observed as responsible for the GFW". There's pcap files if you want to verify for yourself.

Is there any other plausible actor who could be carrying on this attack for so long?

For me the more interesting question remains: Why would China be carrying out this attack? I have yet to hear a plausible motive.

Other plausible actors would be the people who have an interest in creating the perception of a "cyber threat", in order to implement more "protections".

Protections like an Executive Order[1] "to target those attempting cyber attacks on US assets and infrastructure".

After all, with both China and Russia[2] attacking us, who would argue against the urgent need for such measures?

And yet, technically either China or the NSA (via their control over Tier1 carriers) could be responsible for this attack. Perhaps it really was China. But considering we're talking about state-level secret agencies in any case it's a bit sad how reluctant many HNers seem to be to even consider any scenario other than the mainstream narrative.

[1] http://www.nationaljournal.com/tech/obama-declares-cyber-att...

[2] http://www.dailymail.co.uk/news/article-3029768/Russian-hack...

> Why would China be carrying out this attack? I have yet to hear a plausible motive.

Exactly this. Not to mention the hundreds (if not thousands) of sites the government is more likely to target, that are far less known than GitHub and that they could take off-line indefinitely, with little or no outrage from anyone in the West.

>Is there any other plausible actor who could be carrying on this attack for so long?

Well, if we're talking about government-level conspiracy, how about the NSA?

We know they have the capability to infiltrate telecom systems, we also know that following the Snowden leaks, there has been a large amount of negative feelings towards the NSA amongst programmers many of whom have been deciding to actively work against the NSA's attempts to collect and eavesdrop on everything.

So what better way to get a bunch of programmers and hackers back on your side and interested in hacking for you at a state level, than feigning an attack from a foreign power and stirring up "we need to fight back" sentiment, that gets mentioned (often near the top) of every single HN thread on this matter.

To me, that's a far more plausible motive than any of the motives being attributed to the Chinese government.

I also see that many of the assumptions made by people about the Chinese government's capabilities and motivations are obviously being made by people with little/no understanding and experience of the Chinese - both from a cultural and technological perspective.

That being said, I don't believe this attack had any real nation state involvement. It's far more likely to have been "patriotic" Chinese hackers (who often perform hacks on perceived slights against the Chinese nation) rather than any sort of explicit nation-state action.

It's far more plausible and fits in with exactly the sort and style of hacks that they've been known to do in the past.

The leap to blame the Chinese government for this attack reminds me of the leap to attribute the Sony attack to North Korea.

It's possible that North Korea was responsible, but the primary evidence the FBI held up was that the malware used was similar to malware used by DPRK in previous attacks. As many researchers pointed out[1], that malware has been widely available outside DPRK for years.

Certain 3-letter agencies have claimed to have additional intelligence pointing towards North Korea[2], but don't go into significant detail. "We're the NSA, so just trust us"

In both cases, it's possible the attack was carried out by a state actor, but I'm personally unwilling to point a finger without better evidence than what I've seen.

[1] http://www.cnn.com/2014/12/27/tech/north-korea-expert-doubts... [2] http://recode.net/2015/01/18/how-the-u-s-knew-north-korea-wa...

Considering that the USA has similar cyberweapon capacities that are publicly known, I believe it's naive to assume that China isn't developing similar weapons.

How can we link this weapon with China? I don't know, but it requires deep access to the colocation of major servers in China for sophisticated man-in-the-middle hijacking, so it seems like the number of organizations that can, in an intentional fashion, compromise a Chinese baidu colocated server is very small.

When one considers the sophistication and access required for this attack, and the reality that China is developing cyberweapons, and the reality that China openly uses cyberweapons against the west in various capacities, it seems improbable to suggest that a third party is more likely the culprit than the state. It isn't as if accusing China is outlandish- we're merely saying that they're striving for cyberweapon parity with the USA...

it seems like the number of organizations that can, in an intentional fashion, compromise a Chinese baidu colocated server is very small.

As it happens the organizations who could do either that, or who could make it look as if the attack originated from a chinese baidu colocated server, are just the same and the only ones who have any stake in this game.

I agree with your notion that China is developing "cyber weapons" just as every other large nation. I just remain skeptical about the idea of them using their guns so incompetently and aimlessly as in this case.

Reply on news.ycombinator.com