China's Man-On-the-Side Attack on GitHub

Re:China's Man-On-the-Side Attack on GitHub by paraboul on Tuesday March 31, 2015 @08:22AM (#9295677)

Baidu network is not used. The response is altered as the trafic goes out of China. The only thing they can do is hosting http://hm.baidu.com in another country.

[ Parent | on HN ]

Re:China's Man-On-the-Side Attack on GitHub by nailer on Tuesday March 31, 2015 @08:44AM (#9295749)

> The response is altered as the trafic goes out of China.

By locating their network inside China, Baidu is allowing a malicious actor to leverage their network traffic - which indeed is a 'use' of Baidu's network.

> The only thing they can do is hosting http://hm.baidu.com in another country.

Most likely, yes. And until they do so, or come to another solution, their traffic should be blocked.

[ Parent | on HN ]

Re:China's Man-On-the-Side Attack on GitHub by ithkuil on Tuesday March 31, 2015 @09:40AM (#9296041)

If their traffic gets blocked by other countries they could mitigate the revenue loss by having some capacity outside China and make sure that most accesses to their property coming from outside China goes to the servers hosted outside China (geo dns or anycast routing).

This would restore their analytics infrastructure functionality and avoid being exploited by their own government for such kinds of attack, while being justified as an infrastructure scalability concern (to avoid backslashes by the Chinese government).

[ Parent | on HN ]

Re:China's Man-On-the-Side Attack on GitHub by teamhappy on Tuesday March 31, 2015 @08:52AM (#9295789)

So what's the rule then? Block all packets coming out of countries with governments that do MITM attacks? Blame the companies for not locating their servers in other countries? Companies like GitHub? This is so hypocritical.

[ Parent | on HN ]

Re:China's Man-On-the-Side Attack on GitHub by nailer on Tuesday March 31, 2015 @09:26AM (#9295955)

> So what's the rule then? Block all packets coming out of countries with governments that do MITM attacks?

Block packets from any company that does not take reasonable steps to stop its network from being used to attack others.

This has been networking rule for a long time.

- We block open mail relays

- we block hacked Windows XP machines

- we should block a company who's in a hacked data center where their upstream adds malicious JavaScript.

Edit: 'we' = network administrators.

[ Parent | on HN ]

Re:China's Man-On-the-Side Attack on GitHub by teamhappy on Tuesday March 31, 2015 @09:43AM (#9296053)

I assumed you were talking about our governments when you said we. Who's stopping you from blocking whatever you want? Or from creating a public block list for that matter. You have to convince me to install it on my machines though. :P

[ Parent | on HN ]

Re:China's Man-On-the-Side Attack on GitHub by woah on Tuesday March 31, 2015 @01:07PM (#9297980)

I think they are addressing their fellow network admins with that comment

[ Parent | on HN ]

Re:China's Man-On-the-Side Attack on GitHub by acveilleux on Tuesday March 31, 2015 @02:00PM (#9298518)

They probably should use a global, non-chinese CDN to avoid this. That and HSTS and HTTPS to pin certs.

[ Parent | on HN ]