The “Great Cannon of China” is now a widespread term online, which has entered the lexicon of many people after the industry experts gave such a name to a new tool for Chinese censorship.

This tool was first noticed in use a couple weeks ago, when the coding site GitHub was flooded by traffic and as a result went offline for several days. This attack used a method known as “distributed denial of service” or DDoS and targeted Chinese anti-censorship outfits.

The researchers who noticed the attack came to a conclusion that it provided evidence of a new censorship tool used by Chinese government. They suggested that the cyber attack infrastructure was co-located with the “Great Firewall of China”, but carried out by a separate offensive system, so they decided to call it the “Great Cannon”. This instrument hijacks traffic to or from specific IP addresses, and is able to arbitrarily replace unencrypted content as a man-in-the-middle.

If used offensively, this new tool could turn ordinary and unsuspecting Internet users into a vector of attack. In that particular case, the Great Cannon of China appeared to intercept traffic sent to Baidu (largest search engine in the country) infrastructure servers. It turned out that in 1.75% cases it took that traffic and returned a malicious script, thus unwittingly enlisting the Internet user in the hacking campaign. Even this 1.75% of users managed to take GitHub down.

The researchers believe that the Chinese authorities operate the Great Cannon, as well as the Great Firewall, because both systems seem to be hosted on the same servers and share source code to intercept communications. This new weapon of cyberwar proved “exceptionally costly” to its targets, but can potentially be able to make even more damage. The researchers explained that technically simple change in its configuration could let it target specific individuals even if they didn’t reside in the country, as well as intercept their communications.

However, it is unclear why the Great Cannon of China was first deployed in such a publicly visible fashion, because this could set a dangerous precedent – this move was contrary to international norms and violated widespread domestic laws that prohibit the unauthorized use of computing and networked systems.