News for hackers. Stuff that matters.

A comment on GitHub hit by DDoS attack. Parent comment

Re:GitHub hit by DDoS attack by orf on Friday March 27, 2015 @05:55AM (#9275373)
According to this[1] post GitHub (or someone else in between) started changing the responses to alert("Malicious Script Detected")[2]. That's an awesome counterattack - this stops the script from looping indefinitely and annoys the users.

1. http://insight-labs.org/?p=1682

2. https://github.com/greatfire/

[ Parent | on HN ]
Re:GitHub hit by DDoS attack by dengnan on Friday March 27, 2015 @06:12AM (#9275416)
For github, this is a smart move.

But, really, you can hardly negotiate with Chinese government. I'm pretty sure that they will deny this attack and re-emphasize their so-called Internet policy.

If I were github, instead of a warning message, I would redirect the workload to some Chinese government's website and let them suffer what they've created. Let's face it, they are waging a war on the Internet first.

Edit: Disclaimer: I know that my post is quite biased, especially this one. I'm not suggesting that people should wage a war to Chinese government. Please take my words just as a (biased?) sample from an ordinary Chinese citizen who is really tired of the government's censorship.

[ Parent | on HN ]
Re:GitHub hit by DDoS attack by dagw on Friday March 27, 2015 @06:28AM (#9275471)
Let's face it, they are waging a war on the Internet first.

The two most important aspects in war are casus belli and plausible deniability. China has the latter and github lacks the former. Thus github would lose by default in any 'war' against the Chinese government.

[ Parent | on HN ]
Re:GitHub hit by DDoS attack by tedunangst on Friday March 27, 2015 @07:52AM (#9275717)
How would github redirect the load?
[ Parent | on HN ]
Re:GitHub hit by DDoS attack by ninjaoxygen on Friday March 27, 2015 @08:25AM (#9275815)
http://en.wikipedia.org/wiki/HTTP_301
[ Parent | on HN ]
Re:GitHub hit by DDoS attack by eli on Friday March 27, 2015 @09:14AM (#9276018)
I think you are underestimating the volume of traffic. Simple generating that many 301s would be an issue. And... where would you redirect to?
[ Parent | on HN ]
Re:GitHub hit by DDoS attack by kevinchen on Friday March 27, 2015 @09:50AM (#9276221)
Generating a 301 is certainly less work than rendering the entire user's profile page.
[ Parent | on HN ]
Re:GitHub hit by DDoS attack by spartas on Friday March 27, 2015 @10:34AM (#9276494)
Generating a 301 is likely more work. Profile pages are simple database hits, and they may be dynamically or even statically cached (for popular pages). You're probably severely underestimating how much traffic China can produce [1].

1. http://furbo.org/2015/01/22/fear-china/

[ Parent | on HN ]
Re:GitHub hit by DDoS attack by true_religion on Friday March 27, 2015 @11:03AM (#9276680)
A 301 avoids a database hit, and avoids having to go through the cache framework all together.

It just says given this URL, we return an header that tells the browser to redirect. The only thing faster would be just dropping the connection as soon as its given to you.

[ Parent | on HN ]
Re:GitHub hit by DDoS attack by rookieljw on Saturday March 28, 2015 @03:52AM (#9280783)
Excuse me, Why no 403 or 404?
[ Parent | on HN ]
Re:GitHub hit by DDoS attack by pbjtime on Saturday March 28, 2015 @05:15AM (#9280866)
If I scroll up a bit, I see the reason is:

> redirect the workload to some Chinese government's website and let them suffer what they've created.

[ Parent | on HN ]
Re:GitHub hit by DDoS attack by orf on Friday March 27, 2015 @12:16PM (#9277180)
A 301 is unequivocally less work in every respect.
[ Parent | on HN ]
Re:GitHub hit by DDoS attack by tracker1 on Friday March 27, 2015 @11:35AM (#9276880)
If verizon and the like can hold up traffic to/from Netflix... couldn't they just do the same for chinese traffic? Maybe redirect requests for baidu to a chinese version of google?

I'm not saying this is a great idea, just that something could be done.

[ Parent | on HN ]
[dead]
Re:GitHub hit by DDoS attack by hobs on Friday March 27, 2015 @08:18AM (#9275792)
Could you be more of a sock puppet in this discussion?
[ Parent | on HN ]
Re:GitHub hit by DDoS attack by kardos on Sunday March 29, 2015 @07:09AM (#9284474)
The Chinese government is for sure a plausible culprit here, but consider that the American government (NSA, or another TLA) is also a plausible culprit. If this ends up successfully blamed on the Chinese, it builds support for "cyberwar" defence funding in the US.
[ Parent | on HN ]
Re:GitHub hit by DDoS attack by hobs on Sunday March 29, 2015 @09:16AM (#9284694)
kardos, that is fair. I do not know which government entity paid for this poster, just that as usual someone is trying to sway online opinion with their workforce.
[ Parent | on HN ]
Re:GitHub hit by DDoS attack by pbuckley on Friday March 27, 2015 @01:05PM (#9277547)
That's an insult to sock puppets everywhere.
[ Parent | on HN ]
Re:GitHub hit by DDoS attack by verroq on Friday March 27, 2015 @10:18PM (#9280208)
The wu-mao is real.
[ Parent | on HN ]
Re:GitHub hit by DDoS attack by imaginenore on Friday March 27, 2015 @08:08AM (#9275763)
Instead of that "script detected" they should convert the whole page to something the Chinese government really hates, like Tiananmen Square massacre.
[ Parent | on HN ]
Re:GitHub hit by DDoS attack by minot on Friday March 27, 2015 @09:39AM (#9276146)
I hope they do. I hope they regret it happened. It should never have happened.
[ Parent | on HN ]
Re:GitHub hit by DDoS attack by amalantony06 on Friday March 27, 2015 @11:28AM (#9276832)
And DDoS the end sites?
[ Parent | on HN ]
Re:GitHub hit by DDoS attack by JasuM on Friday March 27, 2015 @10:49AM (#9276584)
If the message had some information about the Tiananmen Square massacre or some other censored information, the attack would probably stop. At least temporarily.
[ Parent | on HN ]
Re:GitHub hit by DDoS attack by analyst74 on Friday March 27, 2015 @12:11PM (#9277127)
This is genius idea, Using GFW to deflect GFW attacks!
[ Parent | on HN ]
Re:GitHub hit by DDoS attack by x1957 on Saturday March 28, 2015 @05:58AM (#9280925)
They are using the IP outside China...
[ Parent | on HN ]
Re:GitHub hit by DDoS attack by NoCowLevel on Friday March 27, 2015 @07:07AM (#9275574)
Very interesting defense. It seems that it works because the attacking AJAX call is done with content dataType 'script'. I don't think it'll be too hard for the attacker to fix that.
[ Parent | on HN ]
Re:GitHub hit by DDoS attack by teknologist on Friday March 27, 2015 @07:21AM (#9275614)
It's either that or call a jsonp endpoint, which could still throw up the alert. CORS protects standard AJAX from requesting anything outside the current domain.
[ Parent | on HN ]
Re:GitHub hit by DDoS attack by dheera on Friday March 27, 2015 @11:46AM (#9276951)
So Baidu is using eval() instead of JSON.parse()? What kind of engineers did they hire?!
[ Parent | on HN ]
Re:GitHub hit by DDoS attack by dandelany on Friday March 27, 2015 @01:27PM (#9277732)
They're using neither. It's a cross-domain call so Github could block a regular AJAX GET by just not including ACAO headers. So they are using $.get with dataType 'script'. This is basically like JSONP without the callback - it adds a script tag with the remote URL to the page which means the client has no choice but to run the contents.
[ Parent | on HN ]
Re:GitHub hit by DDoS attack by talnet on Friday March 27, 2015 @01:11PM (#9277592)
Even I use JSON.parse() without knowing its benefit :3
[ Parent | on HN ]
Re:GitHub hit by DDoS attack by Havvy on Friday March 27, 2015 @04:24PM (#9278767)
JSON.parse takes a string of "JSON" and turns it into a JS object. It doesn't evaluate the string in a JS context at all, which is what eval() does.

Some people have used eval() to do JSON parsing because JSON is a subset of JS, but if the user has any control into making malformed JSON, they could do so to create JS that can do anything the page can from the context of another user, otherwise known as Cross-Site-Scripting (XSS).

[ Parent | on HN ]
Re:GitHub hit by DDoS attack by afarrell on Friday March 27, 2015 @10:59AM (#9276649)
I wonder what percentage of Baidu users read English rather than just Chinese.
[ Parent | on HN ]
Re:GitHub hit by DDoS attack by kej on Friday March 27, 2015 @12:11PM (#9277128)
Wikipedia suggests the English-reading Chinese population is in the hundreds of millions (much higher than the English-speaking Chinese population), and I would guess that group overlaps quite a bit with Baidu users.
[ Parent | on HN ]
Re:GitHub hit by DDoS attack by jfroma on Friday March 27, 2015 @07:42AM (#9275678)
Why the attacker will run the content loaded as an script instead of just dumping what they get?

Edit: I think is the dataType: "script" part. From jquery docs:

> "script": Evaluates the response as JavaScript and returns it as plain text.

[ Parent | on HN ]
Re:GitHub hit by DDoS attack by dandelany on Friday March 27, 2015 @01:31PM (#9277759)
They have no choice. If they used an AJAX call it could be blocked by (lack of) ACAO headers. The only way to hit a remote URL that cannot be blocked is by adding a <script href="//github..." /> tag to the URL, which means the client has no choice but to run the contents.
[ Parent | on HN ]
Re:GitHub hit by DDoS attack by IshKebab on Friday March 27, 2015 @03:14PM (#9278430)
What about an img tag?
[ Parent | on HN ]
Re:GitHub hit by DDoS attack by dandelany on Friday March 27, 2015 @04:36PM (#9278824)
Hmm, yes that would probably work... Not sure though.
[ Parent | on HN ]
Re:GitHub hit by DDoS attack by mckoss on Friday March 27, 2015 @10:08AM (#9276326)
The JavaScript used is very amateurish with many outmoded features, poorly optimized. I couldn't believe they were loading jquery, for example. This looks to be the work of a script kiddie rather then a superpower's cyber warriors.
[ Parent | on HN ]
Re:GitHub hit by DDoS attack by zagnut8088 on Saturday March 28, 2015 @01:13AM (#9280590)
I agree - but it might just be deflection. The Chinese could use the same argument to assert they bore no responsibility. Besides - everybody has jquery cached. Why create an ajax from scratch and add to the weight of the crap they are injecting into the script?

For quick and dirty I like it. Its not exactly long term or really destructive - but its kind of a cute and clever attack.

Github's response to pop an alert was priceless. Sure it probably annoyed the hell out of millions of Chinese people - and their government will probably claim Github attacked them --- but the truth will out... maybe.

Totalitarian regimes are shady as hell.

[ Parent | on HN ]
Re:GitHub hit by DDoS attack by slang800 on Friday March 27, 2015 @10:34AM (#9276495)
Or a script kiddie working for a superpower.
[ Parent | on HN ]
Re:GitHub hit by DDoS attack by jle on Sunday March 29, 2015 @12:42AM (#9283905)
i feel like this alert should be in chinese for greatest effect
[ Parent | on HN ]