INTERNET-FREEDOM advocates hope Lu Wei, China’s internet tsar, will indicate today whether the authorities have any knowledge of a raid on GitHub, an American-based website for programmers that also hosts content objectionable to China. Since Thursday hackers have been hijacking web traffic intended for Baidu, the Google of China, and redirecting it to bombard two pages run by GitHub. (Baidu denies involvement.) The targeted pages link to a copy of the Chinese-language edition of the New York Times and to a copy of Greatfire.org, a service that seeks to circumvent China’s “Great Firewall”. The redirection of Baidu's massive traffic flow is seemingly intended to overload the GitHub pages, making them unavailable to other readers. It is a form of what is known as a "denial-of-service" (DoS) attack. Such DoS onslaughts date back to the 1990s. They show no sign of abating, even as techniques to thwart them have improved. The attacks are embarrassing for a government and potentially financially crippling for a business. They can be the work of criminals, who hold sites to ransom or exploit weaknesses by overwhelming the servers, or of hackers operating as sovereign agents, as Russia was accused of perpetrating against Estonia in 2007. But how are such attacks carried out?
A website is technically a "service", a software-based system that responds in a particular way to incoming requests from client software—in this case a web browser. But a web browser's requests can be easily faked. A web server can only respond efficiently to a certain number of requests for pages, graphics and other website elements at once. Exceed that number, and it bogs down. Go too far, and the system may become entirely unresponsive. Huge floods of traffic, whether legitimate or not, can thus cripple a server. In recent years beefier hardware and better tools to distribute incoming requests among multiple servers have made things more difficult for attackers. DoS attacks once involved a single computer flooding a webserver. When that became ineffective, distributed DoS (DDoS) onslaughts conscripted thousands of virus-infected computers, known as zombies, to bombard the target system with bogus requests from many locations at once. This used to be impossible to block without severing the server's internet link altogether. But now specialised hardware can distinguish between real requests and those intended to harm a site, and block them before they form a tsunami of traffic.
