Google: For about a month and a half, the Great Cannon attack via HTML and JavaScript aimed to leak GitHub and Greatfire.org servers to China's most popular search engine, Baidu.
Google said over the weekend that the attack would not have been possible if Google had made moves to encrypt its websites. “This provides additional incentive to encrypt the web to ensure encrypted and secure communications,” said Niels Provos, a security engineer at Google. “Unfortunately, defending against such an attack is not easy for website operators.”
Using analysis data from Google's Safe Browsing infrastructure, Provos said the attack on Great Cannon lasted from March 1 to April 15, and included the investigation phases before the March 14 attack against Greatfire.org.
“At first, the requests were made over HTTP and then upgraded to HTTPS,” Provos said. “On March 14, the attack began targeting d3rkfw22xppori.cloudfront.net over HTTP and HTTPS. Attacks against this host continued until March 17."At some point during this phase of the attack, cloudfront hosts initiated 302 redirects to greatfire.org, as well as other domains. JavaScript substitution ceased completely on March 20, but injections into HTML pages continued."
According to Google, on March 25, the attack moved from Greatfire to Github.
“The attack against GitHub appears to have stopped on April 7, 2015, and that is the last time we saw injections during our measurement period,” Provos said.
During the attack, 19 different JavaScript replacement payloads were detected, and although Google said it was unable to determine a number for the different HTML attacks, the payloads were similar.
