It's December 2019 and China has deployed a sophisticated cyberweapon,
dubbed the Great Cannon of China. What's interesting about the Great Cannon is
that it uses the devices of foreign nationals as ammunition; and it does this
without compromising them. Let that sink in for a minute. Your laptop, or phone, or
tablet could be taking part in cyberwarfare behind your back.
Welcome back to the Pro Tech Show - the place for tech, tips, and advice for IT pros
and decision makers. If that sounds like your kind of thing then hit that
subscribe button. This is the third time China's believed to have deployed the
Great Cannon. This time it appears to be targeting websites used to organise
pro-democracy protests in Hong Kong. So what the heck is the Great Cannon of
China? Well, China haven't exactly come out and
confirmed this, but they've not really denied it either; and according to the people
who've looked into it, it doesn't really look like China are trying to hide this.
In essence the Great Cannon is a tool that can generate large-scale DDoS
attacks by hijacking the devices and bandwidth of unassuming Internet users.
Let's do a quick explanation on what DDoS means. A DoS or D.O.S. attack is a
Denial of Service. This is when you throw so many requests at the server
that its entire capacity is used up just trying to reply to you. This leaves it
unavailable to respond to anyone else, and effectively takes it offline. You
know the way on Black Friday some websites crash because they can't handle
the load? Well it's the same sort of thing, but a DoS attack is deliberate. A
one on one Denial of Service attack is conceptually simple to defend against. If
you've got one person throwing a clearly malicious amount of data at you, you can
use a firewall to block that one person. Or you could go the brute force root - make sure
your server and your bandwidth has more capacity than they do. A DDoS attack
steps things up a gear. DDoS is Distributed Denial of Service. That means
instead of just one attacker this time we've got loads of attackers. Quite
often the attackers don't realise they're attacking anyone. DDoS attacks
are quite often launched from networks of compromised computers that have been
infected with malware. Defending against DDoS is a lot more complicated. If you
try to block it with a firewall it's kind of like playing whack-a-mole. You've
got different attackers popping up everywhere, all the time. And the combined
force of thousands and thousands of computers throwing data at you makes it
a lot more difficult to simply brute force your way out. Back to China though.
You may well have heard of the Great Firewall of China before - the Chinese
government's massive internet censorship programme. If you're not familiar with it,
then the basic gist is that every time a Chinese user connects to a website
hosted outside of China, it goes through the Great Firewall of
China. If the Chinese government decides that they don't like that website, it
gets blocked. A lot of common websites aren't available in China for this
reason - things like Facebook or Google for example, they get blocked. Think of it
as a massive security checkpoint drawn around China's electronic border. If you
try to access something the government doesn't like, you get stopped. The Great
Cannon of China is separate and has a completely different and offensive
function, but it does share the same massive infrastructure on China's
electronic order with the rest of the world.
Normally, you as a foreign national connecting into a web server in China:
that's fine. The Firewall isn't really there to block you - it's to keep people in,
not out; and the Chinese government is quite
happy for you to buy things from a Chinese company. It's more money for
their economy, right? That all changes when the Great Cannon gets fired. The
Great Cannon recruits foreign devices by performing a man-in-the-middle attack
against return traffic coming from Chinese servers. This could be any
Chinese website, or any website that contains ads hosted from China. You
request a web page, the server replies, and in-between the Cannon injects its
own code. This code probably isn't dangerous for you - it's just JavaScript.
Virtually every web site uses JavaScript; it's what makes them interactive. Your
computer tends to treat JavaScript with a healthy degree of scepticism because
any web site can send it to you. That means that it will allow it to load data
from a website for example, but not arbitrarily read information off your
computer. Now, it would be remiss of me if I didn't point out that bugs have been
discovered in the past that allowed JavaScript to do things it wasn't really
supposed to do, to escape from that security sandbox. In theory at least the Great
Cannon could be used to exploit that behaviour if such a bug was found again.
Back to how the Great Cannon has been observed to function, though. Its code
simply tells your computer to load a bit of data from a website. In this case the
website is the Cannon's target. So as you're browsing your intended Chinese
website, or your intended website that happens to load ads served in China,
you're also behind the scenes browsing the target website. This JavaScript can
only run while you've got the website open. As soon as you leave the site your
computer is no longer involved in the attack. That doesn't seem so bad. It's
just a little bit of traffic - one extra visitor to the site,
right? Well, consider the number of people accessing websites in China. That's a
huge number! If only a small percentage of these are hijacked by the Great Cannon
that adds up to a massive global-scale DDoS attack. Whenever the Chinese
government decide to pull the trigger, your computer does the dirty work for
them. So how do you defend against something like that? Well, that depends on
what you mean. If you mean literally "How do I defend myself against the Cannon
being fired at me?", well it's a DDoS attack so normal DDoS mitigation
measures would apply. You could use someone like CloudFlare who has a massive
content delivery network and DDoS mitigation who could help absorb the
traffic for you. But really, if you're worried about a nation-state coming
after you specifically, you've got a problem you're not going to solve watching
a few videos on YouTube. For most of us we're probably less worried about the
Great Cannon actually been aimed at us and more worried about our devices being
hijacked to do its bidding. So what can we do? To be honest with you I would like
to see security vendors take up the challenge and block it automatically.
There are plenty of technologies that already exist for filtering web traffic
and, personally, I think that a lot of the time they cause more harm than good. This
is a perfect opportunity from one of these vendors to step up and do
something useful. I suppose you could block access to Chinese websites,
although if you work with Chinese companies in particular that could be
throwing the baby out with the bathwater. And please try to see a distinction
between the actions of the Chinese government and every single individual
Chinese company. There's a lot of demonising going on in the media without a
lot of evidence at the minute. It's not the website's fault; it's the
infrastructure between you and the website. But hey, that might not matter to
you. If you can avoid getting tied up in this by just simply blocking Chinese IP
ranges, you might be quite happy to do that. The most effective defence right
now could be to ensure you are using HTTPS. That's the padlock icon in your web
browser. Maybe a good compromise is to make sure that you only allow access to
Chinese websites if they use HTTPS. HTTPS is safe because it's encrypted, and the
Cannon can't inject its code into encrypted data. Now there has been some
talk that China are considering passing a law that would require companies to
hand over their encryption keys to the government; but so
far that's just talk, and it seems to be one of these things that keeps coming
around and never actually happens. So for now at least,
HTTPS is safe. That's it for today, folks. If you found this one interesting
then hit the like button. It's nearly Christmas so I'll be taking a little
break. I'll be back in the new year. If you want to know when, hit the subscribe
button, and use the bell icon for notifications. Thanks for watching guys.
See you next time!