Re:GitHub under ongoing DDoS attack
by sunflowerdeath on Sunday March 29, 2015 @08:12AM
(#9284583)
What about inserting invisible iframe to affected sites? I think it can not be prevented.
Re:GitHub under ongoing DDoS attack
by dujiulun2006 on Sunday March 29, 2015 @08:21AM
(#9284598)
Since GitHub (and other sites) can modify their webpages, something like:
<script> if (window != top) top.location = 'http://www.google.com'; </script>
returned as a static webpage would do the trick.
This script can be disabled with the sandbox attribute on <iframe>: https://developer.mozilla.org/en-US/docs/Web/HTML/Element/if...
Scorch the earth if it doesn't work then:
<script>
function fork() {
setTimeout(fork, 2);
setTimeout(fork, 2);
}
setTimeout(fork, 1000);
if (window != top) top.location = 'http://www.google.com';
</script>
Too late, they should have done that first. Nice idea though.
Re:GitHub under ongoing DDoS attack
by dujiulun2006 on Sunday March 29, 2015 @08:33AM
(#9284614)
In that case maybe the other solution is better. Wow HTML5 is crazy...
You can serve an X-Frame-Options:"DENY" (or "SAMEORIGIN") header to prevent browsers from loading the iframes.
Re:GitHub under ongoing DDoS attack
by sunflowerdeath on Sunday March 29, 2015 @08:53AM
(#9284648)
But this is a response header, so server shoud respond and that is the goal of attack.
Browser doesn't send any request headers saying that site is opened in the iframe.
> 第一轮外域JavaScript，一个alert防住；第二轮外域img，Referer挡外面；第三轮GitHub Pages被D；第四波正在进行，是TCP SYN Flood攻击。
My translation:
> The first round was cross-domain JavaScript, stopped with an "alert()". Second round was cross-domain <img>, stopped with referrer. Third was DDoS-ing GitHub Pages. Fourth is the ongoing TCP SYN Flood attack.