> series: anatomy_of_a_breach —— part: 076 —— target: github —— weapon: great_cannon —— purpose: censorship_enforcement<span class="cursor-blink">_</span>_
In late March 2015, GitHub was hit by the largest DDoS attack in its history — a sustained assault lasting five days that specifically targeted two repositories: GreatFire (a project monitoring Chinese internet censorship) and cn-nytimes (a Chinese-language mirror of the New York Times). The attack was sophisticated: rather than using a traditional botnet, it weaponised the web browsers of millions of unsuspecting internet users — primarily outside China — by intercepting and modifying their web traffic as it passed through Chinese internet infrastructure.
Researchers at the University of Toronto's Citizen Lab identified the weapon: the 'Great Cannon', a previously unknown offensive tool built alongside China's Great Firewall. When users anywhere in the world visited Chinese websites that loaded resources from Baidu (China's largest search engine), the Great Cannon intercepted the traffic and injected malicious JavaScript that redirected the user's browser to flood the targeted GitHub pages with requests. Millions of legitimate web users became the DDoS weapon — without their knowledge or consent.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping CallThe Great Cannon represented a qualitative escalation in nation-state cyber capabilities. Previous attacks — Aurora, Stuxnet, Shamoon — targeted specific organisations. The Great Cannon weaponised the internet infrastructure itself, turning millions of innocent users into an attack tool. For organisations that host content, provide services, or simply depend on internet availability, the Great Cannon demonstrated that nation-state adversaries can marshal resources beyond the capacity of any private organisation to absorb.
For UK organisations, the defensive implications include DDoS mitigation planning, HTTPS deployment to prevent traffic injection, and the recognition that internet availability is a threat surface. Our infrastructure testing assesses DDoS resilience. Cyber Essentials mandates HTTPS. SOC in a Box monitors for DDoS attack precursors. And UK Cyber Defence provides incident response during active attacks.
Our <a href="/penetration-testing/infrastructure">infrastructure testing</a> assesses DDoS resilience. <a href="/cyber-essentials">Cyber Essentials</a> mandates HTTPS. <a href="https://www.socinabox.co.uk">SOC in a Box</a> monitors for attack indicators.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping Call