News for hackers. Stuff that matters.

A comment on China's Man-On-the-Side Attack on GitHub. Parent comment

Re:China's Man-On-the-Side Attack on GitHub by belorn on Tuesday March 31, 2015 @09:53AM (#9296135)
The takeaway from this attack is the same as we got from the Snowden disclosure: Nations will abuse network services that is located on their borders. They will hack-tap-and-steal, modify, block, and use any method available to distribute malware. Any action is viable so long there is a target to attack which could produce political, economical or military advantages.

I suspect we will reach a point where treaties are needed to protect the basic building blocks of the Internet. We can't expect nations to respond by sending in military force, or voluntary give up the benefits from this kind of attacks. This leaves few options left if one want the economic benefits from cloud services and similar shared-network concepts.

[ Parent | on HN ]
Re:China's Man-On-the-Side Attack on GitHub by ethbro on Tuesday March 31, 2015 @10:45AM (#9296546)
I like to grab old books at yard sales, and found this an interesting read (Arms Control Disarmament And National Security, 1961, https://archive.org/details/armscontroldisar013124mbp). It's a collection of essays by various authors on a variety of arms control subjects.

Everyone sees nuclear / Cold War negotiations in hindsight, but in 1961 (and probably also ~1950) the logic is much more interesting, given that the theories were developed from a position of profound ignorance. How would things turn out? What did the other side actually want? How reasonable was the other side? Unknown!

On a technical point, is there a reason that javascript doesn't tend to be signed in any way? Or is it? Even if you're serving unsecured content for whatever reason, it'd be nice to allow the user to verify the code they received was as you intended. (Admittedly, encrypting all traffic as a default solves this)

[ Parent | on HN ]
Re:China's Man-On-the-Side Attack on GitHub by e40 on Tuesday March 31, 2015 @10:57AM (#9296632)
On a technical point, is there a reason that javascript doesn't tend to be signed in any way?

A good point. I think it's convenience that we don't do it, but I'd hope we move in that direction. It seems like a prudent move.

[ Parent | on HN ]
Re:China's Man-On-the-Side Attack on GitHub by ethbro on Tuesday March 31, 2015 @11:14AM (#9296797)
> A good point. I think it's convenience that we don't do it, but I'd hope we move in that direction. It seems like a prudent move.

After a bit of Googling, (a) http://stackoverflow.com/questions/1368164/javascript-code-s... (b) http://www-archive.mozilla.org/projects/security/components/...

It seems it's simultaneously too difficult to do without ECMA spec support & would require a certificate chain anyway. And if you're running a cert chain infrastructure, why not use the one that already exists and run TLS?

Other side thought: with regards to the usefulness & impracticality of cert pinning, has any work been done on systems specifically designed to target low % injection systems? If 1/10 visitors gets the poisoned page, then it seems you'd have a 9/10 chance to pull a good page for comparison & verification if you (or a proxy you trust) made another request from a different IP.

[ Parent | on HN ]
Re:China's Man-On-the-Side Attack on GitHub by comex on Tuesday March 31, 2015 @11:37AM (#9297038)
In this case, the problem with any kind of technical workaround on the server side is that Baidu is under the jurisdiction of the government implementing the DDoS and is thus unlikely to be able to actively work to defeat it. If another country tried to do the same... well, that's what HTTPS is for.
[ Parent | on HN ]
Re:China's Man-On-the-Side Attack on GitHub by jordanilchev on Tuesday March 31, 2015 @01:29PM (#9298214)
HTTPS is not secure when we talk about China it is false sense of security! Last case 7days ago: http://www.theregister.co.uk/2015/03/24/google_ssl_cnnic/
[ Parent | on HN ]
Re:China's Man-On-the-Side Attack on GitHub by comex on Tuesday March 31, 2015 @01:44PM (#9298378)
That's fairly off topic - I mentioned that HTTPS is somewhat irrelevant here since Baidu is located in China, and anyway a forged certificate could not be used in a mass attack like this one since the issuing CA would come to the attention of browser vendors rather quickly. For the record, hopefully Google's upcoming Certificate Transparency feature in Chrome will help address the general issue, although who knows what kind of adoption it will have in practice.
[ Parent | on HN ]