Researchers have uncovered a powerful and previously unknown weapon that China's government is brazenly using to knock sites out of commission. Dubbed the Great Cannon, the tool has been used to bombard two anti-censorship GitHub pages with junk traffic, but it just as easily could be used to wage stealthy attacks that silently install malware on the computers of unwitting end users.

As Ars explained previously, the attacks on the pages of anti-censorship service GreatFire.org and a mirror site of the New York Times Chinese edition had some novel characteristics. The junk traffic came from computers of everyday people who browsed to websites that use analytics software from Chinese search engine Baidu to track visitor statistics. About one or two percent of the visits from people outside China had malicious code inserted into their traffic that caused their computers to repeatedly load the two targeted GitHub pages. The malicious JavaScript was the product of the Great Cannon, which China uses to alter traffic passing over its backbone and takes no steps to conceal.

"The operational deployment of the Great Cannon represents a significant escalation in state-level information control: the normalization of widespread use of an attack tool to enforce censorship by weaponizing users," the researchers from the University of California at Berkeley, the University of Toronto, and Princeton wrote in a report published Friday. "Specifically, the Cannon manipulates the traffic of 'bystander' systems outside China, silently programming their browsers to create a massive DDoS attack."

Not only China

Lest readers think that the Great Cannon is a tool unique to China's repressive government, the researchers say it in many ways resembles the secret Internet backbone nodes known as Quantum that the National Security Agency and its British counterpart use to conduct targeted surveillance. While there is no evidence that US and British actors have used Quantum indiscriminately against such a large audience to perform a denial-of-service attack, the program makes it clear that the Great Cannon isn't the only state-operated mechanism that can and does manipulate Internet traffic.

Friday's report supported a finding Ars reported last week that the source of the man-in-the-middle attacks hammering GitHub was located on the backbone of China Unicom, a major service provider in China known to host parts of that country's Great Firewall. The new research shows that the Great Cannon is distinct from the Great Firewall. In short, the Great Cannon is an "in-path" device built into the Chinese backbone for the purposes of performing man-in-the-middle attacks, while the Great Firewall is an "on-path" system that sits off to the side for the purposes of eavesdropping on traffic passing between China and the rest of the world.

The researchers said the Great Cannon could largely be neutralized if websites sent all of their pages over encrypted HTTPS connections. The reason: communications that are end-to-end encrypted can't be modified by people sitting in between the sender and receiver. This is true in theory but not necessarily so in practice. Websites that offer HTTPS protections frequently mix unencrypted traffic from third-party sites into their encrypted traffic. The Great Cannon—and presumably Quantum nodes as well—could potentially seize on this by manipulating the traffic of one of the third parties.