page_title: Censorship of GitHub
section_title: Attack
hierarchical_section_title: Censorship of GitHub / China / MITM attack / Attack
caption_attribution_description: English: On January 26, 2013, GitHub users in China experienced a Man-in-the-middle attack. Because the SSL certificate was signed by an unknown authority, many browsers such as Safari showed users warnings.
context_page_description: GitHub has been the target of censorship from governments using methods ranging from local Internet service provider blocks, intermediary blocking using methods such as DNS hijacking and man-in-the-middle attacks, and denial-of-service attacks on GitHub's servers from countries including China, India, Russia, and Turkey. In all of these cases, GitHub has been eventually unblocked after backlash from users and technology businesses or compliance from GitHub.
context_section_description: On January 26, 2013, GitHub users in China experienced a man-in-the-middle attack in which attackers could have intercepted traffic between the site and its users in China. The mechanism of the attack was through a fake SSL certificate. Users attempting to access GitHub received a warning of an invalid SSL certificate, which, due to being signed by an unknown authority, was quickly detected. A spokesperson for GitHub said: "Early last week, it appeared that GitHub was being at least partially blocked by the Great Firewall of China... After a couple days, it appeared that GitHub was no longer being blocked." NETRESEC performed forensics of the attack and determined that it was indeed an attack, due to the large number of router hops involved (6) and because the user submitting the packet capture was from China. 
  This attack was performed again on March 26, 2020 on GitHub Pages and March 27, 2020 on GitHub.com.
caption: An example of the warning users in China received from browsers when trying to access GitHub with the self-signed certificate
exif: {}