China's Man-On-the-Side Attack on GitHub

Re:China's Man-On-the-Side Attack on GitHub by e79 on Monday March 30, 2015 @11:42PM (#9294232)

I wonder how GitHub mitigated the attack so successfully. I can't find any baidu scripts using the injected code anymore (in fact the original tracking scripts on baidu's own domain return nothing), and GitHub is now serving the two repos that were originally targeted.

What happened? Whatever it is, I'm glad they were able to mitigate the attacks.

[ Parent | on HN ]

Re:China's Man-On-the-Side Attack on GitHub by pmontra on Tuesday March 31, 2015 @12:39AM (#9294416)

The attack is still going on. Details at https://status.github.com/messages They describe what they're doing to mitigate it.

The latest message is

0:09 UTC

Hour 118: Mitigation remains effective and service is stable.

[ Parent | on HN ]

Re:China's Man-On-the-Side Attack on GitHub by e79 on Tuesday March 31, 2015 @12:54AM (#9294452)

Yes but they don't explain what the mitigation is.

[ Parent | on HN ]

Re:China's Man-On-the-Side Attack on GitHub by dandelany on Tuesday March 31, 2015 @01:00AM (#9294468)

During an ongoing attack? I wonder why not...

[ Parent | on HN ]

Re:China's Man-On-the-Side Attack on GitHub by e79 on Tuesday March 31, 2015 @01:06AM (#9294485)

Right. Not looking for specifics. My curiosity would be satisfied by something like "we've reached out to Baidu and they've done X and Y. Meanwhile, traffic has decreased so we've unblocked the affected repos."

Just a bit more transparency on the situation.

[ Parent | on HN ]

Re:China's Man-On-the-Side Attack on GitHub by mkesper on Tuesday March 31, 2015 @03:29AM (#9294824)

It's not baidu.com that serves that malicious code, it gets inserted on its way through the Great Fire Wall.

[ Parent | on HN ]

Re:China's Man-On-the-Side Attack on GitHub by enraged_camel on Tuesday March 31, 2015 @01:38AM (#9294564)

They might release a post-mortem once it's over, but I wouldn't expect any transparency during the attack itself.

[ Parent | on HN ]

Re:China's Man-On-the-Side Attack on GitHub by clippit on Monday March 30, 2015 @11:48PM (#9294254)

The injection has been stopped and Baidu's script checks if there exists a referer.

[ Parent | on HN ]

Re:China's Man-On-the-Side Attack on GitHub by zaroth on Tuesday March 31, 2015 @02:15AM (#9294647)

What do you mean "has been" stopped? There's no definitively stopping this without HTTPS, which I'm pretty sure hasn't magically "happened" in China in the last couple days.

The GFW may have ceased its attack, but there's no check you can possibly add into an asset delivered over HTTP which can't be undone by the GFW.

As long as there's a script being delivered over HTTP, the GFW can intercept that script request and replace with a script of its own.

[ Parent | on HN ]

Re:China's Man-On-the-Side Attack on GitHub by clippit on Tuesday March 31, 2015 @04:08AM (#9294921)

I mean the Javascript hijacking has been stopped. This DDoS mixes several ways and during the js hijacking period, GitHub returns `alert()` on specific url for blocking browsers sending ajax requests. For now, the infected urls are back to normal.

[ Parent | on HN ]

Re:China's Man-On-the-Side Attack on GitHub by lgas on Tuesday March 31, 2015 @03:31AM (#9294829)

There don't even have to be scripts being served -- as long as HTML is being served over HTTP they can inject their own scripts.

[ Parent | on HN ]