More than four days after it started, coding hub GitHub says it is deflecting most of the traffic from anattack that has caused intermittent outages on the site, which the Wall Street Journal says stems from China.
“Eighty-seven hours in, our mitigation is deflecting most attack traffic. We’re aware of intermittent issues and continue to adapt our response,” a tweet from the GitHub Status account said on Sunday.
The attack took the form of a flood of traffic, known as a distributed denial of service – or DDoS – attack, which are among the most common on the internet.
The Wall Street Journal reported that the flood of internet traffic to GitHub came from Chinese search engine Baidu, targeting two GitHub pages that linked to copies of sites that are banned in China.
On its blog, GitHub said the attack began early last Thursday “and involves a wide combination of attack vectors”. The company, which supplies social coding tools for developers and calls itself the world’s largest code host, said web users’ computers were hijacked to try and bring the site down.
“These include every vector we’ve seen in previous attacks as well as some sophisticated new techniques that use the web browsers of unsuspecting, uninvolved people to flood github.com with high levels of traffic,” the blogpost continued. “Based on reports we’ve received, we believe the intent of this attack is to convince us to remove a specific class of content.”
According to security researchers Insight Labs , the code specifically targets the pages of two Github users. The first is GreatFire , an organisation which reports on, and develops ways to circumvent, the “great firewall of China”. GreatFire’s most recent success allows Chinese residents who want to bypass the nation’s internet surveillance and censorship to do so by cleverly using commodity cloud hosting platforms such as Amazon Web Services. Since blocking AWS would break significant portions of the internet, China has found it hard to directly counter that circumvention method.
The second target is the page for the New York Times’ Chinese mirror , which aims to allow Chinese residents to read the paper even when its website is blocked. It lets users download an unblockable iOS app, and links to further cloud-based copies of the newspaper’s website.
Insight Labs adds that at least part of the attack seemed to be co-ordinated through code originating on Baidu’s servers, although a Beijing-based Baidu spokesman said the company had conducted a thorough investigation and found that it was neither a security problem on Baidu’s side nor a hacking attack. “We have notified other security organisations and are working to get to the bottom of this,” the spokesman said.
GitHub’s outages have also revealed the extent to which the supposedly decentralised internet is actually focused around a few pieces of critical infrastructure. The site, which was created to allow coders to collaborate on software projects remotely, has evolved to become a massive web host in its own right, and a crucial part of a number of other software platforms.
With GitHub sporadically unavailable for days, companies which rely on the site – or on any software or service which itself relies on the site, such npm and Bower, two popular items in many programmers’ toolkits – have found themselves unable to deploy new code, paralysing them until the site returns.
