China's Man-On-the-Side Attack on GitHub

Re:China's Man-On-the-Side Attack on GitHub by fixermark on Tuesday March 31, 2015 @09:29AM (#9295975)

Unfortunately, the countermeasure for this sort of sniff already exists: the attacking referrer detects traffic from the victim's IP range and returns a sanitized copy of the content with the automatic loading logic removed. "Nothing to see here, officer."

It's a big programming task for a small processing task for a temporary payoff.

[ Parent | on HN ]

Re:China's Man-On-the-Side Attack on GitHub by downandout on Tuesday March 31, 2015 @09:31AM (#9295983)

There's nothing that says the headless requests would have to come from the victim's IP range. Any cloud service could be used. Also, since open source headless browsers already exist (phantomjs et al), it's a small programming task.

[ Parent | on HN ]