NETRESEC Blog

Read the details of the attack. It's not a botnet. The attack works by injecting malicious JavaScript into common websites within Chinese borders, and doing this only for visitors of these files from outside China. Only the Great Firewall (or the website owners, ie. government-controlled Baidu) can possibly do that. http://www.netresec.com/?month=2015-03&page=blog&post=china%27…

Prologue: http://techcrunch.com/2015/03/19/anti-censorship-service-greatfire-is-… See links around this article, similar attacks have happened before: http://www.netresec.com/?page=Blog&month=2015-03&post=China%27…

I used to use netsh to capture on Windows boxes but the workflow for getting the data into pcap format was awful. Lately I’ve been using RawCap[0]. It’s a single EXE that works on stock versions of Windows and produces pcap files. It has no capture-time filtering options, which is a bummer, but it’s quicker for me to get data to look at than the netsh / convert to pcap workflow. [0] https://www.netresec.com/?page=Blog&month=2020-01&post=RawCap-…

Excited to read the title of this post. I've been searching for general pcap labs recently to sharpen my packet analysis skills. A little disappointed to see it's from CNTDA (since i've already done the labs from 7th ed). It's been a while though perhaps I will revisit these labs for the 8th ed. This site also offers a ton of pcaps but not necessarily in exercise/lab format https://www.netresec.com/?page=PcapFiles

Here you go - happy reading. https://www.tuicool.com/articles/6vqyqan https://www.netresec.com/?page=Blog&month=2015-03&post=China%2…

"Baidu Yun" is an online file locker (like Dropbox) with a generous free quota. You can create a shareable link for a file with a single click. Why would you think someone at Baidu would have knowledge of a particular file a user shared on that service? Separately, you bring up Baidu's "involvement" in the DDoS attack on GitHub. I remember reading that this was achieved using a man-in-the-middle attack on customers of Baidu's analytics product, which would not need Baidu's cooperation: http://www.netresec.com/?page=Blog&month=2015-03&post=China%27…

I assume you can (untested) reference https endpoints with a favicon? If you can inject html though, a hidden image would probably would just as well. Although the behavior of chrome apparently still requesting the favicon file after the tab has closed, and possibly storing it in the history or bookmark file, may make this more or less appealing. Unsure. http://www.netresec.com/?page=Blog&month=2015-03&post=China%27…

Actually, it would have stopped this particular variant because Baidu serves the script from baidu.com: http://www.netresec.com/?page=Blog&month=2015-03&post=China%27… That said, it would only matter if Baidu was doing something like serving the script only over HTTPS using HSTS which I imagine would incur a non-trivial backlash for them. I'd also be surprised if they couldn't relatively easily move on to another similarly insecure script requested by many people outside of China.

The man on the side they're performing, according to analysis, seems to be letting the initial SYN through to the original server, you get the SYN-ACK back from the actual Baidu server. Then after your ACK and HTTP GET, the other packets are injected. If they wanted to make the attack more subtle, messing with the timing to make it match the original SYN-ACK pair and keeping the right TTL values would make it much harder to detect. http://www.netresec.com/?month=2015-03&page=blog&post=china%27…

Likely a technical misunderstanding by the author. It is possible for an ISP to detect tor traffic[1], but not determine the contents of the traffic. My guess is that the author is not aware of this. http://www.netresec.com/?page=Blog&month=2013-04&post=Detectin…

New findings regarding the Chinese MITM of GitHub.com can be found here: http://netresec.com/?b=1328C6B Turns out the guy who uploaded the packet capture file was @chenshaoju

I've used this behaviour --- non-maliciously --- multiple times in the past to override APIs for logging/tracing/debugging purposes. For example, I have a set of DLLs[1] that you can put in the same directory as the .exe of an application and it will log all network traffic that it generates. Very useful and convenient compared to the alternatives. Another use is to workaround compatibility problems. What I find more saddening is the trend to view any behaviour that could potentially be exploited as a vulnerability, regardless of how useful it could be, which just leads to locked-down user-hostile systems where nothing is possible without going through some sort of ridiculously bureaucratic excess of process. Thus, I think the root cause of this problem is not with the DLL loading behaviour, but with this... The bad guy just navigates a frame of your browser to the DLL of his choice and, if you’re on Chrome or Microsoft Edge, the DLL is dropped in the Downloads folder without even asking ...entirely unconsented file download. The design of putting all downloads in one place is a small contributing factor. [1] http://www.netresec.com/?page=Blog&month=2011-01&post=Proxocke… Edit: we can also exploit this behaviour benevolently by putting a set of DLLs in the Downloads folder that would be loaded by any installers being run from there, which could do things like sandboxing/install logging. (Presumably browsers would be not so brash as to…