The Berkeley and Toronto researchers confirmed the suspicions about the origin of the attack, saying they believe there is compelling evidence that the Chinese government operates the cannon. They tested two international Internet links into China belonging to two different Chinese ISPs, and found that in both cases the Great Cannon was co-located with the Great Firewall. This strongly suggests a government actor, they said.
While DDoS attacks are quite crude, the Great Cannon can also be used in more sophisticated ways. A technically simple configuration change, switching the system to operating on traffic from a specific IP address rather than to a specific address, would allow Beijing to deliver malware to any computer outside of China that communicates with any Chinese server not employing cryptographic protections, they said.
A similar system used by the U.S. National Security Agency (NSA) and the U.K's GCHQ intelligence services to deliver exploits is called QUANTUM, the researchers said.
"The operational deployment of the Great Cannon represents a significant escalation in state-level information control: the normalization of widespread use of an attack tool to enforce censorship by weaponizing users," the researchers said, adding that the findings emphasize the urgency of replacing legacy Web protocols, like HTTP, with their cryptographically strong versions, like HTTPS.
Sign up for Computerworld eNewsletters.