China's 'Great Cannon' -- a Cyber-weapon to Accompany the Great Firewall 81
An anonymous reader writes: A new report from The Citizen Lab identifies a distinct new technology entity sitting next to the Great Firewall of China. Dubbed the 'Great Cannon', the multi-process cluster revealed itself quite openly in the recent attacks on Greatfire.org and its two Github pages. The DDoS attack was so sustained that CL was able to study the new technology in depth, determining architectural similarities and unearthing many strong indications that it is a product of the Chinese authorities.
They weaponised... (Score:1, Funny)
the slashdot effect.
Re: (Score:3)
So that's where Rob Malda actually went.
I knew it!
Can we stop pretending this isn't low level war? (Score:3, Insightful)
Why the hell do they have MFN status again?
Re: (Score:2)
Because, pardon the pun, they're too big to nail.
Re:Can we stop pretending this isn't low level war (Score:5, Insightful)
Okay, I suppose you don't mind we also stop pretending the Five Eyes (especially the USA) and Israel at not in a low level war with any other country? Right?
Re:Can we stop pretending this isn't low level war (Score:4, Insightful)
Other than you saw some other moron on the Internet say 'China Did It' ... can you provide some actual proof to back up your claims.
It is simply stunningly illogical for China to behave this way against such petty targets. It makes absolutely NO sense for them to flaunt their ability and willingness to do so as the simple course of action the entire reset of the world would take is a simple matter of NULL routing China and going on about their daily business, your 'war' would be over before anyone really cared.
And ... a DDoS does pretty much nothing to gain you access to government servers or trade secrets.
WTF is it with you nut jobs who seem to think the entire world is out to get you regardless of cost to themselves?
Slashdot is pretty much the only place on the planet that thinks this is an actual attack by the Chinese, perhaps you should ask yourself why? And no, before you get the idea, its not because slashdot is so smart and so far ahead of the general public, that ended 10 years ago.
Re:Can we stop pretending this isn't low level war (Score:5, Interesting)
Anyone who runs a server on the Internet only needs to look at their firewall log to see break-in attempts coming from China, 24 hours a day every day. It's blatantly obvious that Someone in China did something. Still that's not conclusive proof that governments are involved.
I have all of China shut off (Score:1)
Making sure to check the box for "AC"
I have all of china shut off.
None of my customers that matter, have noticed, nor would they likely give a shit if they knew.
The presence of china on the internet brings NOTHING to the table I want.
Someone should get a sub crew or two to drag through all of china's under sea connections and call it a day. Let em do whatever they want on their own network. We'll send non tainted chicken to them to eat in trade for plastic crap and cheap electronics via boat.
Re: (Score:1)
geo ip block lists to block china russia and some other countries at the firewall and viola peace on the network.
Now that you mention it some sweet, sweet viola music would go well with a peaceful network :-)
Re: (Score:2)
While China still tops the list on my firewalls, Russia has been rapidly raising up over the past few years.
Zombie Botnet (Score:3)
That could also be about a billion unpatched versions of Zombie XP running DOSS attacks as part of a huge Botnet and the only reason it originates from China is the fact that everyone uses pirated unpatched versions of OS there. Just speculating, but that would make sense. Not saying that is isn't a Chinese directed botnet, but it may not be the national government.
Re: (Score:2)
Re: (Score:2)
Again just speculation, but it could be that because China has their Internet so locked down for censorship, with their Great Firewall, that the ranges of discoverable IP addresses outside of it are manipulated causing it to look that way. I barely have a working understanding of how it all works anyway. However I do find it hard to believe that a nation particularly one as large as China would bother with this kind of low level tomfoolery (i.e. It doesn't seem all that targeted).
Then again it could be a ve
Re: (Score:2)
...it could be that because China has their Internet so locked down for censorship, with their Great Firewall, that the ranges of discoverable IP addresses outside of it are manipulated causing it to look that way...I do find it hard to believe that a nation particularly one as large as China would bother with this kind of low level tomfoolery (i.e. It doesn't seem all that targeted)
Not sure what you mean by manipulated, but i can assure you it's intentional, i don't claim to know what their intention is... but you don't accidentally and repeatedly attempt to login to SSH. If you really want some hard evidence all you have to do is go spin up a standard ubuntu VPS and leave it in it's default configuration for a few days (in particular you leave SSH on the default port), then have a dig through it's logs and plot the SSH login attempt IP locations... you should find a hot spot in China
Re:Can we stop pretending this isn't low level war (Score:4)
It is simply stunningly illogical for China to behave this way against such petty targets. It makes absolutely NO sense for them to flaunt their ability and willingness to do so...
Did you miss the part where China builds artificial islands wayyyy past the 200-mile line to do an end run around it?
Re: (Score:3, Interesting)
I was going to post exactly this ...
China does bully and take advantage of petty targets and nations that have no way to defend themselves, and the best example of this is their attitude in the china sea, they are building ilsands to expand their borders, and all of the nations around cant do anything about it... they are first class bullies... I fail to see how their "cyber-attitude" could be any different.
Re: (Score:1)
And ... a DDoS does pretty much nothing to gain you access to government servers or trade secrets.
China has built their entire infrastructure around denying access to information they don't want their people to see. This gives them a way to fire back at the outside sources that help people work around those blocks. If you want to cry about proof, then by all means, RTFA.
Re: Can we stop pretending this isn't low level wa (Score:2, Insightful)
While the attack, is progressing, with all the spoofing going on, why is everyone saying its China? With all the communications chips coming out of China, could it be misidentification? And reading your attack? Since you are trying to penetrate their defenses? Meaning its your spiders reporting back, making requests for service?
Re: (Score:3)
Glorious exposition, comrade!
Re:Can we stop pretending this isn't low level war (Score:5, Interesting)
It is simply stunningly illogical for China to behave this way against such petty targets. It makes absolutely NO sense for them to flaunt their ability and willingness to do so...
Just like it makes no sense for Americans to bomb the Bikini Atoll, or run new ships on trips around the world. The goal isn't to destroy a Pacific paradise or to wear out the engines, but rather to announce to the political world that we have a new capability, and we're ready to use it as we see fit.
The "petty targets" may be convenient places to point this "Great Cannon"... They provide a noticeable target, and apparently can be analyzed enough to provide some basic details to the rest of the world. Assuming China is behind the attack, we now know that China can run at least this level of attack, and there's no reason to expect that in a full-scale conflict, it wouldn't be turned against more serious targets. We don't know whether the attack can be made even bigger, or if it has different operational modes, or even how quickly such an operation can scale... and that's enough uncertainty to make it a deterrent weapon. It's all political posturing, and from outward appearances, it seems China is showing itself to be fairly powerful, but not yet openly aggressive.
Contrast that with North Korea, which has persistently demonstrated impotent aggression, and our main concern is that they might actually develop a real offensive capability that affects us.
...as the simple course of action the entire reset of the world would take is a simple matter of NULL routing China and going on about their daily business...
...except that a significant part of their daily business has now been null-routed. It's going to be hard to keep that great American economy moving when manufacturers can't contact their contracted suppliers. Without that continuous economic movement, we're facing yet another financial crash, which the United States government probably doesn't want to have happen just yet.
your 'war' would be over before anyone really cared.
On the contrary, an openly-hostile and traceable act (like cleanly disconnecting a major nation) would be the first strike in a bigger escalating conflict, as each side accuses the other of being the guy who really started the fight. Throw in a few false-flag operations and stage a few "exposed" false-flag operations, and it's not a very big leap to having a real war with real weapons and real death.
Frankly, I'd rather just have the political games.
Re: (Score:3)
Take a look at the stories about China in the South China sea. China is blatantly hostile, this is just another of the many hostilities. Also, it appears that they pay people to AC astroturf on /. This is the only explanation I can come up with for the ACs claiming that we don't know it was China when TFA is quite clear on the research that was done to determine how the attack occurred.
Re: (Score:2)
This is the only explanation I can come up with for the ACs claiming that we don't know it was China when TFA is quite clear on the research that was done to determine how the attack occurred.
Occam's Razor. Probably they just didn't RTFA.
Re:Can we stop pretending this isn't low level war (Score:5, Insightful)
I will just say this: The above post is a lie. I can name plenty of examples to show China's aggression.
If people remember a few years back, US solar companies getting breached, or breach attempts in large numbers, all from China. Six months later, China started shipping panels that mysteriously had the same IP as the US PV makers... but for costs well under what even the rare earths went for. This destroyed the US PV industry, and it nearly destroyed Europe's until they enacted a tariff to level the playing field (China will give you deep discounts on rare earths... provided their companies do the manufacturing... companies that you have to give all trade secrets to.)
So, China isn't an angel in any sense of the word. They have been having a lot of border skirmishes with neighbors. They only have MFN because most US companies can't see past next quarter's earnings.
A DDoS makes sense. Same way someone getting their face decorated with a black eye the first time they hit the prison yard... it sends a message.
Re: (Score:2)
Who do you think it is then, smart guy? If you have a less paranoid alternative (dont say Illuminati, please), I would love to hear it.
theory about what *would* happen vs has happened (Score:3)
> It makes absolutely NO sense for them to flaunt their ability and willingness to do so as the simple course of action the entire reset of the world would take is a simple matter of NULL routing China and going on about their daily business
It amazes me how many Slashdot posts theorize about what *would* happen, under conditions that *already* have been going on for years. If you said that in 1990, it would be a reasonable prediction, an intelligent guess. After 20 years of attacks, very few networks h
Re: (Score:2)
Re: (Score:2)
Other than you saw some other moron on the Internet say 'China Did It' ... can you provide some actual proof to back up your claims.
50 cent army on the prowl!
It is simply stunningly illogical for China to behave this way against such petty targets. It makes absolutely NO sense for them to flaunt their ability and willingness to do so as the simple course of action the entire reset of the world would take is a simple matter of NULL routing China and going on about their daily business, your 'war' would be over before anyone really cared.
Its not like this fits with the MO of China, right?
Its not like they negotiated with Microsoft, Yahoo, and Google to expose dissidents on those blogging platforms a decade ago.
Not like they coordinated with Skype to capture phone conversations via their well-documented TOM platform.
Not like they used state-sponsored hackers to infiltrate Google, like they commonly attempt to do corporate espionage.
Not like they engaged in a well-documented and highly-visible war with Google when Go
Re: (Score:1)
It makes absolutely NO sense for them to flaunt their ability and willingness to do so as the simple course of action the entire reset of the world would take is a simple matter of NULL routing China and going on about their daily business
unless of course you are a proxy server trying to aid Chinese ppl trying the evade the great firewall of China. Think of this as a new option to make evading their firewall much more expensive.
Re: (Score:2)
We've seen attack upon attack on various countries by the government of China. These attacks are way beyond simple con jobs for access to government servers or trade secrets. Why the hell do they have MFN status again?
Probably for the same reason the US does.
Re: (Score:1)
If you're calling this an act of war, then what the hell was stuxnet? A DOS attack more than pales in comparison to the destruction of Iranian nuclear enrichment equipment.. let's not get too hypocritical here
Re: (Score:2)
Stuxnet was an act of mercy for the rest of the world. Iran with a nuke is a scary thing. Look at North Korea if you want to see where it goes. Fortunately NK can't build a nuke small enough or a missile powerful enough to hit the US, but they could hit South Korea or Japan, and they have shown a willingness to attack both.
Re: (Score:2)
It's hard to say with NK. They don't have the military capacity to take on the world, and they know it - but they do need an effective deterrant, and you can only have an effective deterrant if the world believes you are crazy enough to use it.
Re: (Score:2)
Worked real well for Cuba...
Re: (Score:2)
It did. They haven't been invaded. Even if they don't have their own nukes, they have allies who do - which is enough.
Re: (Score:2)
Seems to me like it's time to look [nationalpost.com] at that again [nationalinterest.org].
Re: (Score:2)
Redirect to HTTPS (Score:2)
How about blocking http traffic to China and 301 redirecting any connections to the https address. If the endpoint doesn't support https, tough.
Re: (Score:2)
Re: (Score:3)
Well, that's really sort of the definition of fixed here, isn't it? You do nothing with the DDoS traffic while responding as normal to the regular traffic.
Re: (Score:3)
In order to inspect the DDoS traffic to reject it, it has already come in over your internet.If they use all your bandwidth it does not matter if you drop the traffic, you are already dead.
For large companies Internet providers will install anti-DDOS software at the interconnect point. We have a 1 GBPS connection and whatever anti-DDOS software we had at our end could be relatively easily swamped. Our network provider on the other hand has a huge bandwidth (can't remember what) and swamping their system would be very difficult even for the large botnets.
Re: (Score:2)
For not-large companies, you can put someone in front of your public infrastructure to take care of DDoS crap for you, like these guys: www.incapsula.com
Re: (Score:2)
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
For a second there, I was about to agree. Then I realised that you said "Chinese" and not "US".
Comment removed (Score:4, Interesting)
Re: (Score:2)
That leads to escalation. They attack us, we attack them, they attack us - and ordinary internet users get caught in the middle, unable to access their precious porn and lolcats because half the internet is swamped.
Re: (Score:2)
Set up an entire NSA team to infiltrate the Chinese military establishment and depants their national security secrets on a Wikileaks-By-Uncle-Sam level
There's far too much value for us in them not knowing what we know. I wouldn't be terribly surprised if the Chinese military establishment is largely depantsed already.
Re: (Score:1)
Did you read the article? Its actually the Great Wall of China acting as a C&C for 98% of users outside china who access Baudi.. I am guessing here but I would suspect that 2% of visitors are distributed across the globe somewhat.
Botnets much more likely (Score:2)
That all these "Chinese Cyber Attacks" are in actuality more due to the fact that most of the versions of Windows in China are pirated and unpatched. This would make them the biggest target for the creation of zombie botnets which can be controlled by anyone really for whatever nefarious purposes, such as DOSS attacks on whoever. The Russians seem to have the most of those types of individuals out there, so it is more likely individual or groups or Russian hackers, owning Chinese botnets and using them to t
Netizen Deathstar covered at Shakacon last year (Score:1)
http://www.slideshare.net/Shakacon/netizen-death-star-l0rd-v covers an anonymous researchers review of this capability over a year ago.