Reports: Millions of innocent Internet users conscripted into Chinese DDoS army.
The massive denial-of-service attacks that have intermittently shut down Github for more than five days is the work of hackers with control over China's Internet backbone, according to two technical reports published Tuesday that build a strong case that government authorities are at least indirectly responsible.
HTTP hijacking used to redirect Baidu search engine traffic into a massive DDoS.
Github officials have said the torrent of junk data pummeling their servers is the biggest they have ever seen. As previously reported, the two Github pages are constantly loaded and reloaded by millions of computer users inside and outside of China, an endless loop that left unmitigated outages not just on the two targeted pages but throughout Github's entire network. Exhibit A in the case in which China is involved are the two specific Github pages targeted: one hosts anti-censorship service GreatFire.org while the other hosts a mirror site of The New York Times' Chinese edition. The targets suggest the attackers are sympathetic to the vast censorship apparatus known as the Great Firewall of China.
A time to live
"This attack demonstrates how the vast passive and active network filtering infrastructure in China, known as the Great Firewall of China or 'GFW,' can be used in order to perform powerful DDoS attacks," the Netresec researchers wrote in a report published Tuesday. "Hence, the GFW cannot be considered just a technology for inspecting and censoring the Internet traffic of Chinese citizens, but also a platform for conducting DDoS attacks against targets world wide with help of innocent users visiting Chinese websites."
The report included the following data, which was taken using the tshark packet sniffer. It shows that the TTL of a legitimate SYN+ACK packet is 42 seconds, while three packets with a malicious payload have TTL values of 227, 228, and 229 seconds. The results suggest that the SYN+ACK packets are coming from the actual Baidu server, while the packets carrying the malicious payload are injected somewhere else:
If you can't see the pic, see below:
tshark -r baidu-high-ttl.pcap -T fields -e ip.src -e ip.dst -e tcp.flags -e ip.ttl
192.168.70.160 188.8.131.52 0x0002 64 <- SYN (client)
184.108.40.206 192.168.70.160 0x0012 42 <- SYN+ACK (server)
192.168.70.160 220.127.116.11 0x0010 64 <- ACK (client)
192.168.70.160 18.104.22.168 0x0018 64 <- HTTP GET (client)
22.214.171.124 192.168.70.160 0x0018 227 <- Injected packet 1 (injector)
192.168.70.160 126.96.36.199 0x0010 64
188.8.131.52 192.168.70.160 0x0018 228 <- Injected packet 2 (injector)
184.108.40.206 192.168.70.160 0x0019 229 <- Injected packet 3 (injector)
192.168.70.160 220.127.116.11 0x0010 64
192.168.70.160 18.104.22.168 0x0011 64
Researchers from GreatFire have issued their own report that also lays out evidence the attacks could not have been carried out without the cooperation of Chinese authorities. In an accompanying blog post, they went on to name the Cyberspace Administration of China and its head Lu Wei. The GreatFire researchers wrote:
Inserting malicious code in this manner can only be done via the Chinese Internet backbone. Even if CAC did not launch the DDoS attack directly, they are responsible for managing the internet in China and it is not possible that they did not know what was happening. These attacks have occurred under CAC’s watch and would have needed the approval of Lu Wei.
Lu Wei and the Cyberspace Administration of China have clearly escalated the tactics that they use to control information. The Great Firewall has switched from being a passive, inbound filter to being an active and aggressive outbound one. This is a frightening development and the implications of this action extend beyond control of information on the internet. In one quick movement, the authorities have shifted from enforcing strict censorship in China to enforcing Chinese censorship on internet users worldwide. CAC can launch these attacks quickly and easily and they have the technical and financial resources behind them to continue to launch DDoS attacks against any website, anywhere in the world.
These attacks also illustrate the shortsighted nature of the Chinese authorities. Weaponizing Chinese internet services stifles global confidence in Chinese entrepreneurs and contributes to the fragmentation of the global internet. The SEC has already asked Weibo to explain how the censorship apparatus works - Baidu, a publicly-listed company in the US, may be called in to do the same.
We correctly predicted last year that China would increase their use of MITM attacks in an effort to censor encrypted websites. We now sadly predict that the DDoS attacks against us and GitHub are likely to signal a ramping up of attacks against foreign internet properties. These kinds of attacks should draw scorn and criticism from government officials of all countries around the world.
So far, there are no reports of Chinese officials responding to the accusations. In fairness, readers should remember that assigning responsibility to Internet-based attacks is extremely difficult. Attackers often manipulate their hacks to give the appearance they originated somewhere else. Still, there's no doubt that Chinese authorities carefully police that country's Internet backbone. It's hard to imagine how malicious code could be inserted into so many different China-based websites for five days straight without a government authority actively participating, or at least looking the other way, while it happened.