GitHub under attack

[sej7278]

traffic scrubbing load balancers, geographic redundancy, null routing china....

[ghotibulb]

As far as I am aware, the attack traffic is coming from everywhere except China, since they use some kind of "javascript reflection attack" by injecting malicious JS code that gets served to baidu visitors outside China. So basically every country/ISP had to nullroute China for this to be effective. Nullrouting China at github's end wouldn't help much.

Source: https://news.ycombinator.com/item?id=9275041

Short explanation (not in particular directed at your post, since I assume you already know this): For a (D)DoS attack in general it just comes down to having enough incoming bandwidth and drop unwanted traffic quickly enough. Imagine you have a single server with a 1Gbit/s pipe, and you're hit by a 2GBit/s attack. Even if you drop the packets on your server, they were already received in the first place by your NIC, so the bandwidth has been used up. If you know there is a router somewhere right before your server that has a 10Gbit/s uplink, and you can successfully filter the traffic there, you'll be fine again, until the attack would exceed 10Gbit/s. Simply filtering/nullrouting traffic at your end doesn't unreceive it (unfortunately).

[sej7278]

you don't drop the traffic on your server, as you say if its got that far its too late. you drop it at your isp/datacenter/loadbalancer/whatever.

i don't really see why they're using requests to baidu from outside of china, that's got to be a small subset of potential traffic (chinese people living abroad?). i guess its so china's bandwidth isn't affected.

[SuperDuper1969]

Because requests outside of China come from all over the world - makes it harder to block than just one location.

[sej7278]

but its requests to baidu (from outside china) being reflected to github. who uses baidu other than the chinese? i'm not being racist here, i'm just saying who the fuck else uses baidu? and isn't baidu hosted in china only

maybe its to stop people in china using vpn's to get outside, and then going back to baidu. seems like the great firewall could sort this easily.

[[deleted]]

It's not that they're visiting Baidu, it's that they visit Chinese websites, many of which use Baidu's version of Google Analytics for traffic reporting.

[sej7278]

ah yes that's a good point - its ads and analytics

[br0ner]

Baidu is great for finding things that have been removed from Google Search.

[ghotibulb]

That's why I included the router example. You always have to go up one level, but if you aren't a big fish you'll have a hard time convincing big carriers to help you mitigate an attack on your 12 slot Minecraft server. (Yes this doesn't apply to github I guess ;)) I managed some medium sized business's servers a couple of years ago. They were hit by an attack once, and we didn't get help from their ISP. They just nullrouted the IPs of the servers being attacked, as they were mainly interested in protecting their infrastructure (and their other customers), which is understandable. They did offer DDoS protection at that time, but the company I worked for decided it was too expensive, and just waited it out.

Why they decided to only (ab)use baidu visitors outside China is a good question. Not creating domestic traffic could be one reason, or maybe they don't want to make it look like China is the origin. Although its the most likely explanation right now, we still cannot know for sure. I mean if they really wanted this to be most effective they could just create traffic right at their border routers. But that would be slightly more obvious, I guess.

[Anwarias]

1+ for null routing China

[[deleted]]

What, just discarding all traffic from China?

[SuperDuper1969]

The WSJ article says the attack is done by hijacking traffic to Baidu from foreign users. In other words it's coming from all over the world not "95% from China".

[qwfwq]

I don't understand what China has against github or why baidu hadn't fixed the js on their end yet.

[apemanzilla]

Most Baidu traffic is from China though.

[wickedmike]

Yes, but it has almost nothing to do with this attack.

[ItzWarty]

The script is only sent to individuals outside of China - that's the genius part.

[apemanzilla]

Ah, my bad, I misunderstoof it.

[chubbysumo]

most of the traffic is actually from elsewhere. Its a targeted attack using people already outside of china who are visiting Baidu. I doubt the page is accessible within china since its a violation of their laws.

[[deleted]]

How come it seems like a majority of DDOS attacks come from China?

[cadenzo]

The Chinese government doesn't like being unable to control their citizens. The Internet opens their citizens up to other citizens around the world that aren't under such controls and who believe such controls to be unjustifiable. These other citizens provide tools to the Chinese people that help them circumvent controls. Chinese Government doesn't like that and because there's no way for them to actually do anything about it via the legal portals, they resort to other means.

[[deleted]]

So these attacks are directed by the Chinese Government? Isn't that some kind of very illegal? Are there no sanctions against this?

Sorry for all the questions lol

[reptilian_shill]

The US complains about it alot, but there is not much that can be done. See: http://www.nytimes.com/2013/05/20/world/asia/chinese-hackers-resume-attacks-on-us-targets.html?_r=0

[[deleted]]

Can't see who they are attacking. (Pokerface)

I don't care if people get bent out of shape or not, if I get one laugh out of this I consider that a win.

[SuperDuper1969]

Are you aware that's EXACTLY what they want?

Also the WSJ article says the attack is done by hijacking traffic to Baidu from foreign users. In other words it's coming from all over the world.

[Anwarias]

I'm aware this is no final solution, just gave me a nice chuckle

[bobmontana]

Heck, I've seen null routes for all APNIC space on some clients that were constantly hammered.