China's Man-On-the-Side Attack on GitHub

Re:China's Man-On-the-Side Attack on GitHub by jakejake on Tuesday March 31, 2015 @12:31AM (#9294389)

Do those requests show up as coming from China? I thought it was only people outside China who are being giving the poisoned javascript, and the requests are being made on the client-side from them - which would appear to be just random traffic?

Perhaps Baidu still shows up as the referring URL, though?

[ Parent | on HN ]

Re:China's Man-On-the-Side Attack on GitHub by cft on Tuesday March 31, 2015 @01:16AM (#9294506)

the requests are coming from the computers outside of china (that access chinese sites), thus you cannot simply BGP null-route all Chinese prefixes to mitigate this.

[ Parent | on HN ]

Re:China's Man-On-the-Side Attack on GitHub by peteretep on Tuesday March 31, 2015 @01:38AM (#9294565)

    > I thought it was only people outside China who are being 
    > giving the poisoned javascript, and the requests are
    > being made on the client-side from them - which would
    > appear to be just random traffic

I would have thought you could usefully heuristically look at the referrer header.

[ Parent | on HN ]