Top all-time · #2745
Netresec
Company blog · netresec.com/?page=Blog · on HN as netresecsecurity
Netresec is the company blog at netresec.com, writing about security. Since 2011, 27 different Hacker News readers have linked it 36 times, most often “China's Man-On-the-Side Attack on GitHub”. It is still writing: the last post was on 2026-10-19, and you can follow it by feed.
Network forensics, packet sniffers and IT security products. Download NetworkMiner and other free software for network security analysis.
Most-linked posts?
- China's Man-On-the-Side Attack on GitHub5 people · 5 mentions · first linked 2015-03-31
- /?month=2015-03&page=blog&post=china%27s-man-on-the-side-attack-on-github2 people · 2 mentions · first linked 2015-04-02
- Publicly Available PCAP Files2 people · 2 mentions · first linked 2022-03-02
- Finding Targeted Sunburst Victims with PDNS2 people · 2 mentions · first linked 2021-01-08
- Detecting Tor Communication in Network Traffic2 people · 2 mentions · first linked 2013-04-06
- RawCap - A Windows network sniffer that does not require Winpcap2 people · 2 mentions · first linked 2011-04-12
- Analysis of Chinese MITM on Google2 people · 2 mentions · first linked 2014-09-06
What Hacker News says?
Rawcap can do this. It's increasingly showing its age, but I still use it fairly frequently. It generates PCAP files, it's 23KB, and its only dependency is .NET Framework 2.0 (which, admittedly, is becoming more of a problem than a blessing): http://www.netresec.com/?page=RawCap
Comment linking /?page=RawCap
on “How I use Wireshark”Submitted China's Man-On-the-Side Attack on GitHub as a story · 692 points
HN discussionI assume you can (untested) reference https endpoints with a favicon? If you can inject html though, a hidden image would probably would just as well. Although the behavior of chrome apparently still requesting the favicon file after the tab has closed, and possibly storing it in the history or bookmark file, may make this more or less appealing. Unsure. http://www.netresec.com/?page=Blog&month=2015-03&post=China%...
Comment linking /?page=Blog&month=2015-03&post=China%27s-Man-on-the-Side-Attack-on-GitHub
on “Favicon bug”Submitted Detecting Tor Communication in Network Traffic as a story · 80 points
HN discussionThe man on the side they're performing, according to analysis, seems to be letting the initial SYN through to the original server, you get the SYN-ACK back from the actual Baidu server. Then after your ACK and HTTP GET, the other packets are injected. If they wanted to make the attack more subtle, messing with the timing to make it match the original SYN-ACK pair and keeping the right TTL values would make it much h…
Comment linking /?month=2015-03&page=blog&post=china%27s-man-on-the-side-attack-on-github
on “Pin-pointing China's attack against GitHub”Submitted Analysis of Chinese MITM on Google as a story · 11 points
HN discussionActually, it would have stopped this particular variant because Baidu serves the script from baidu.com: http://www.netresec.com/?page=Blog&month=2015-03&post=China%... That said, it would only matter if Baidu was doing something like serving the script only over HTTPS using HSTS which I imagine would incur a non-trivial backlash for them. I'd also be surprised if they couldn't relatively easily move on to another si…
Comment linking /?page=Blog&month=2015-03&post=China%27s-Man-on-the-Side-Attack-on-GitHub
on “China's Great Cannon”Submitted Analysis of Chinese MITM on Google as a story · 4 points
HN discussionExcited to read the title of this post. I've been searching for general pcap labs recently to sharpen my packet analysis skills. A little disappointed to see it's from CNTDA (since i've already done the labs from 7th ed). It's been a while though perhaps I will revisit these labs for the 8th ed. This site also offers a ton of pcaps but not necessarily in exercise/lab format https://www.netresec.com/?page=PcapFiles
Comment linking /?page=PcapFiles
on “Wireshark Labs”Submitted Finding Targeted Sunburst Victims with PDNS as a story · 3 points
HN discussionI've used this behaviour --- non-maliciously --- multiple times in the past to override APIs for logging/tracing/debugging purposes. For example, I have a set of DLLs[1] that you can put in the same directory as the .exe of an application and it will log all network traffic that it generates. Very useful and convenient compared to the alternatives. Another use is to workaround compatibility problems. What I find mor…
Comment linking /?page=Blog&month=2011-01&post=Proxocket---A-Winsock-Proxy-Sniffer
on “DLL Hijacking Just Won’t Die”Submitted Covert Man-On-the-Side Attacks (a.k.a. QUANTUM INSERT) as a story · 3 points
HN discussion"Baidu Yun" is an online file locker (like Dropbox) with a generous free quota. You can create a shareable link for a file with a single click. Why would you think someone at Baidu would have knowledge of a particular file a user shared on that service? Separately, you bring up Baidu's "involvement" in the DDoS attack on GitHub. I remember reading that this was achieved using a man-in-the-middle attack on customers…
Comment linking /?page=Blog&month=2015-03&post=China%27s-Man-on-the-Side-Attack-on-GitHub
on “Popular Chinese iOS apps compromised in malware attack”Submitted Chinese MITM Attack on iCloud as a story · 3 points
HN discussionRead the details of the attack. It's not a botnet. The attack works by injecting malicious JavaScript into common websites within Chinese borders, and doing this only for visitors of these files from outside China. Only the Great Firewall (or the website owners, ie. government-controlled Baidu) can possibly do that. http://www.netresec.com/?month=2015-03&page=blog&post=china%...
Comment linking /?month=2015-03&page=blog&post=china%27s-man-on-the-side-attack-on-github
on “President Obama creates new cyber sanctions programme”Submitted RawCap Windows sniffer as a story · 3 points
HN discussionLikely a technical misunderstanding by the author. It is possible for an ISP to detect tor traffic[1], but not determine the contents of the traffic. My guess is that the author is not aware of this. http://www.netresec.com/?page=Blog&month=2013-04&post=Detect...
Comment linking /?page=Blog&month=2013-04&post=Detecting-TOR-Communication-in-Network-Traffic
on “Comcast Declares War on Tor?”Submitted How to Inspect TLS Encrypted Traffic as a story · 2 points
HN discussionHere you go - happy reading. https://www.tuicool.com/articles/6vqyqan https://www.netresec.com/?page=Blog&month=2015-03&post=China...
Comment linking /?page=Blog&month=2015-03&post=China%27s-Man-on-the-Side-Attack-on-GitHub
on “UC Browser for Android, Desktop Exposes 500M Users to MiTM Attacks”Submitted How to Install NetworkMiner in Ubuntu Fedora and Arch Linux as a story · 2 points
HN discussionPrologue: http://techcrunch.com/2015/03/19/anti-censorship-service-gre... See links around this article, similar attacks have happened before: http://www.netresec.com/?page=Blog&month=2015-03&post=China%...
Comment linking /?page=Blog&month=2015-03&post=China%27s-Man-on-the-Side-Attack-on-GitHub
on “DDoS attack on GitHub has stopped? Status is green again.”Submitted Reassembling Victim Domain Fragments from Sunburst DNS as a story · 2 points
HN discussionNew findings regarding the Chinese MITM of GitHub.com can be found here: http://netresec.com/?b=1328C6B Turns out the guy who uploaded the packet capture file was @chenshaoju
Comment linking /?b=1328C6B
on “China, GitHub and the man-in-the-middle”Submitted Capturing Decrypted TLS Traffic with Arkime as a story · 2 points
HN discussionI used to use netsh to capture on Windows boxes but the workflow for getting the data into pcap format was awful. Lately I’ve been using RawCap[0]. It’s a single EXE that works on stock versions of Windows and produces pcap files. It has no capture-time filtering options, which is a bummer, but it’s quicker for me to get data to look at than the netsh / convert to pcap workflow. [0] https://www.netresec.com/?page=Bl…
Comment linking /?page=Blog&month=2020-01&post=RawCap-Redux
on “tcpdump is amazing (2016)”Submitted Findject.py – a new tool to detect man-on-the-side attacks like QUANTUM INSERT as a story · 2 points
HN discussionSubmitted CapLoader Port Independent Protocol Detection as a story · 2 points
HN discussionSubmitted Rinse-Repeat Intrusion Detection – a blacklist/signature free approach as a story · 2 points
HN discussionSubmitted Verifying Chinese MITM of Yahoo #GFW #UmbrellaRevolution as a story · 2 points
HN discussionSubmitted Command-line Forensics of hacked PHP.net as a story · 2 points
HN discussion
