China's Man-On-the-Side Attack on GitHub

Re:China's Man-On-the-Side Attack on GitHub by throwaway7767 on Tuesday March 31, 2015 @08:44AM (#9295750)

Does that mean we should drop everything coming from US prefixes also because the NSA uses them for man-on-the-side attacks?

[ Parent | on HN ]

Re:China's Man-On-the-Side Attack on GitHub by throwaway7767 on Tuesday March 31, 2015 @08:52AM (#9295797)

Replying to myself as HN won't let me reply to the post by 'nailer

> If there is a specific network being leveraged by the US government to attack someone else, and the owner of the network is not taking steps to prevents its misuse, then yes, of course.

We have documented evidence of GCHQ doing man-on-the-side attacks against visitors of LinkedIn and slashdot.org. So are you currently blocking the prefixes of LinkedIn and SourceForge, Inc. on your networks? Or are you aware of any specific acts of these companies to prevent this from being possible in the future?

I worry about mass surveillance and national firewalls no matter where they come from, but I don't think balkanising the internet is a good response.

[ Parent | on HN ]

Re:China's Man-On-the-Side Attack on GitHub by nailer on Tuesday March 31, 2015 @08:47AM (#9295769)

If there is a specific infrastructure being leveraged by the someone to attack someone else, and the owner of the infrastructure is not taking steps to prevent its misuse, then yes, of course.

Edit: yes, throwaway7767, this means any company. However LinkedIn, in this case, was being spoofed, and LInkedIn's infrastructure was not used: http://www.spiegel.de/international/world/ghcq-targets-engin...

Edit 2: no, throwaway7767, Baidu's infrastructure - their bandwidth, their customers, and location within the Chinese Firewall are being used to attack GitHub. Baidu has control over where they locate their servers. Baidu are not exercising that control.

[ Parent | on HN ]

Re:China's Man-On-the-Side Attack on GitHub by throwaway7767 on Tuesday March 31, 2015 @09:44AM (#9296062)

Apparently I can now reply further into the thread, must be a timed thing.

> Edit: yes, throwaway7767, this means any company. However LinkedIn, in this case, was being spoofed, and LInkedIn's infrastructure was not used: http://www.spiegel.de/international/world/ghcq-targets-engin....

LinkedIn was indeed being spoofed, which is exactly what was being done to baidu in this case we are discussing. So it seems to be we now agree that blocking baidu would not be appropriate?

> Edit 2: no, throwaway7767, Baidu's infrastructure - their bandwidth, their customers, and location within the Chinese Firewall are being used to attack GitHub. Baidu has control over where they locate their servers. Baidu are not exercising that control.

And in what way is this different than the attack on LinkedIn we were discussing? Please be specific.

I've already said I disapprove of these methods regardless of who applies them, but you have not seen fit to specifically state that companies like linkedin should move all their servers outside the US/UK/FVEY countries, reserving that course of action only for chinese companies.

[ Parent | on HN ]

Re:China's Man-On-the-Side Attack on GitHub by nailer on Tuesday March 31, 2015 @11:21AM (#9296868)

>> If there is a specific infrastructure being leveraged by the someone to attack someone else, and the owner of the infrastructure is not taking steps to prevent its misuse, then yes, of course.

> you have not seen fit to specifically state that companies like linkedin should move all their servers outside the US/UK/FVEY countries, reserving that course of action only for chinese companies.

Yes, I have. See quote above.

[ Parent | on HN ]