bk99.de entertain the web since 1997

bk99.de
HN · Network securityCurated

China's man-on-the-side attack on GitHub

Summary

Netresec analyses injected JavaScript traffic that caused browsers to send masses of requests to GitHub. The attack targeted GitHub in March 2015. Manipulated Baidu scripts generated repeated requests.

Ideas

  • A network observer copies packets and answers faster than the real server.
  • Unencrypted HTTP allows content to be injected unnoticed on the way.
  • Other people's browsers became participants in a DDoS attack.
  • Packet characteristics reveal differences between genuine and forged responses.

Insights

  • Encryption protects not only secrets but also the integrity of content.
  • A position in the network can turn passive surveillance into active manipulation.
  • Third-party content transfers the security risk of its transport paths to every page that embeds it.

Facts

  • Netresec compared the TTL and TCP characteristics of the packets.

Recommendations

  • Only load active third-party content over HTTPS.
  • Use packet captures to separate origin from injection.

References

Read the original article

Search the Web Archive

Lutz Donnerhacke · 2001

Firewall FAQ: Security is a maintained concept

Lutz Donnerhacke’s FAQ explains firewalls as a security concept that has to be maintained continuously and clears up common misconceptions about NAT, packet filters and desktop firewalls. The preserved page calls itself the FAQ of the newsgroup de.comp.security.firewall. The available version carries the version number 0.38.

HN · 2012

A Rails commit demonstrates unsafe mass assignment

Egor Homakov exploits a Rails mass assignment hole to push someone else's code into the public Rails repository. The vulnerability affected GitHub's Rails application. GitHub initially suspended Homakov.

HN · 2026

Dirty Frag: a note on a Linux privilege escalation

The oss-security post describes a chained local Linux privilege escalation and its problematic disclosure before a coordinated fix. The publication contains working demonstration code for x86-64 systems. Chaining vulnerabilities makes individually limited bugs system-critical together.