text:
"The landscape we confront today is far more complex and diverse, less dominated by Chinese activity and increasingly populated by a range of other criminal and state actors," said the report by FireEye's iSIGHT Intelligence unit.
[…] It found that Chinese activity is markedly down overall — from more than 60 intrusions in February 2013 to a handful in April of this year. It also found that some activity has shifted away from the United States to targets in Asia, including Taiwan, India and Japan.
The shifts have coincided with ongoing political and military reforms in China, FireEye noted. Since taking power in late 2012, Chinese President Xi Jinping has worked to centralize China's cyber operations, turning them toward support of a greater range of activity, the firm said. That redirection takes place as the U.S. military is building up its Cyber Command in support of defensive and offensive operations to benefit regional military commands as well as protect the nation.
[…] "The volume has gone down so much that at least it's clear that there's a higher cost to operating in cyberspace" for the Chinese, Galante said. [Source]
At The New York Times, David E. Sanger looks at the nature of the decline in Chinese hacking activities, noting that Beijing has "already been modifying its approach to cyberoperations" since 2014, with a shift towards fewer attacks that are more focused and sophisticated.
Just how fundamentally the Chinese are changing is a matter of debate. There is some evidence, American intelligence officials say, that while the People's Liberation Army is not stealing as much on behalf of Chinese state-owned firms, much of the hacking activity has been shifted to the intelligence agencies, which can make the case that they are stealing national security secrets, not commercial information. Often, the difference is blurry, especially when the target is, say, the design of a satellite or a ship.
Even after Mr. Obama and Mr. Xi announced their agreement last fall, American officials have said they have discovered malware in power grids, cellphone networks and other purely civilian targets. But it is unclear whether that malicious software is intended to collect information about users, shut the system down or both.
[…] The study of 72 Chinese hacking groups showed a sharp drop-off in the volume of attacks. But as recently as March, FireEye saw efforts to obtain information on American military projects by stealing access credentials to a contractor, and there has been continual theft of personal information from health care providers. The Chinese hacking groups have also focused on non-American targets, including Russia, South Korea and Vietnam, and have sometimes aimed at targets related to the disputes over Chinese claims in the South China Sea.
The report concludes that Chinese attacks have decreased in volume, but increased in sophistication. The result is that Chinese hackers are now acting more like Russian hackers: They pick their targets more carefully, and cover their tracks. [Source]
At Lawfare, Jack Goldsmith writes that the reduction in Chinese hacking springs from President Xi Jinping's crackdown on corruption and consolidation of cyberoperations, with U.S. exposure of Chinese cyberespionage aiding in those efforts.
In an interview with The Wall Street Journal's Rebecca Blumenstein, deputy commander of the U.S. Cyber Command Lt. Gen. James K. McLaughlin spoke about the continued cyberthreat posed by China.
LT. GEN. MCLAUGHLIN: There are several large countries, like Russia and China, that are very, very capable cyber actors. We look at them seriously. You talked a little bit earlier about theft of intellectual property, which has been going on for a long time. The threat of them stealing the data on our employees is also something that's important.
But the types of threats that we worry most about today that are new are adversaries taking full control of our networks, losing control of our networks, having a hacker appear to be a trusted user.
On the military side, you can imagine the difficulty that would cause a commander, if he didn't trust his own network or his data.
But then the Sony incidents of last year show you [the threat of] destructive cyberattacks. A keystroke, and thousands of computers, they're broken. They no longer function. So we watch those adversaries very closely to make sure we know what they're doing in cyberspace. [Source]
Elsewhere, Kim Zetter at Wired writes that economic interests continue to drive the vast majority of Chinese cyber-espionage activities, citing a Chinese cyberespionage campaign against a consortium in Myanmar tied to Chinese oil and gas interests as the latest example of a commercially-motivated attack. On Twitter, Kaiser Kuo writes that Sinica Podcast will be discussing cyberespionage and related issues this Friday.
© cindyliuwenxin for China Digital Times (CDT), get_post_time('Y'). |
Permalink |
No comment |
Add to
Post tags: cyberattacks, cyberespionage, cybersecurity, economic espionage, hacking, U.S. relations
Download Tools to Circumvent the Great Firewall
It was the first meeting of the Senior Experts Group on International Norms and Related Issues, a mechanism agreed upon during Chinese President Xi Jinping's state visit to the United States last September.
The two sides held "positive, in-depth and constructive" discussions on issues concerning international norms of state behavior in cyberspace, as well as international law and confidence-building measures in the field, according to the Chinese delegation.
The two sides agreed to hold a second meeting within six months, it added.
The Chinese delegation was headed by Wang Qun, director-general of arms control at the Foreign Ministry. It also included officials from the Defense, Industry and Information Technology, Public Security ministries as well as the Cyberspace Administration of China. [Source]
Cybersecurity has long been a contentious issue for the two countries, with both sides engaging in regular accusations of hacking activities. Most recently, China-backed hackers were accused of orchestrating major data breaches at the U.S. government's Office of Personnel Management and health insurer Anthem. These episodes, which compromised the personal information of millions of U.S. individuals, were preceded by similar cyberattacks on The New York Times and other U.S. companies. A Mandiant report has since attributed the attacks to a hacking unit within the People's Liberation Army.
Despite reports suggesting that cyber-espionage activities originating from China have not entirely abated since last year's Xi-Obama summit, U.S. officials acknowledged that there have been noticeable changes in Chinese behavior since the agreement was struck. Nike Ching at Voice of America reports:
U.S. officials provided few details about the talks, and they declined to engage in "grading" China's follow-through on cyber commitments. However, the State Department called the meeting a "good indication that we stay engaged."
[…] But there may be signs that the U.S.-China cyber agreement may be having an impact. Harold said that private-sector companies that provide cybersecurity have indicated that the Chinese cyber-espionage groups they were tracking have changed their behavior and their targeting.
"Not entirely, not in every case, but in large enough numbers, it appears to be … that the agreement of last September actually carries consequences in the real world for Chinese behavior," he said. [Source]
© cindyliuwenxin for China Digital Times (CDT), get_post_time('Y'). |
Permalink |
No comment |
Add to
Post tags: cyberattacks, cyberespionage, cybersecurity, data security, diplomacy, economic espionage, hacking, U.S. China cooperation, U.S. relations
Download Tools to Circumvent the Great Firewall
China's official Xinhua news agency said on Wednesday an investigation into a massive U.S. computer breach last year that compromised data on more than 22 million federal workers found that the hacking attack was criminal, not state-sponsored.
In an article about a meeting in Washington between top U.S. and Chinese officials on cyber security issues, Xinhua said the breach at the U.S. Office of Personnel Management (OPM) was among the cases discussed.
The report did not give details of who conducted the investigation or whether both U.S. and Chinese officials agreed with the conclusion. [Source]
[…] The director of the National Security Agency, Adm. Michael S. Rogers, told Congress in September that there was no evidence that the exposed Social Security numbers or other financial information had been used for fraud. Criminal hackers do not usually sit on the material they steal, because financial data can have a short life span.
Moreover, investigators have said that the sophistication and length of the attack had the hallmarks of a state-sponsored operation. So did the targets of the attack, because the security information could be used to build a database of federal employees, including many working in the White House, the State Department and the military.
For years, analysts and security researchers have said that some of the most sophisticated cyberattacks against targets in the United States are orchestrated outside the People's Liberation Army, by Chinese hackers under contract at universities and technology companies. Though their targets — government agencies and Chinese activists — point to a probable intelligence goal, the exact nature of the relationship between China's private hackers and the state are not clear. [Source]
At The Washington Post, Ellen Nakashima reports that a number of hackers have been arrested by Chinese authorities in recent days for their alleged involvement in the OPM attack. The arrests follow the detention of several hackers ahead of President Xi Jinping's visit to the United States in October.
The Chinese government recently arrested a handful of hackers it says were connected to the breach of Office of Personnel Management's database earlier this year, a mammoth break-in that exposed the records of more than 22 million current and former federal employees.
[…] If the individuals detained were indeed the hackers, the arrests would mark the first measure of accountability for what has been characterized as one of the most devastating breaches of U.S. government data in history.
But officials said it has been difficult so far to independently confirm whether the people rounded up were actually connected to the OPM breach.
"We don't know that if the arrests the Chinese purported to have made are the guilty parties," said one U.S. official, who like others interviewed spoke on condition of anonymity because of the subject's sensitivity. "There is a history [in China] of people being arrested for things they didn't do or other 'crimes against the state.' " [Source]
Nevertheless, this week's talks between Chinese and US officials did help the two sides find common ground on the issue of cybersecurity, Andrea Chen at South China Morning Post reports. The gains build on a non-binding accord against hacking for commercial advantage—which did not cover strategic espionage like the OPM attack—reached during Xi Jinping's visit to the U.S. in September.
China and the US have agreed to a framework on managing their cybersecurity disputes at the highest-level talks on the issue since the leaders of the two nations sat down in September, Beijing said on Wednesday.
The discussions in Washington had yielded "positive outcomes", the Ministry of Public Security said, including an understanding that quick communication after perceived attacks was critical.
Ministry chief Guo Shengkun met Homeland Security Secretary Jeh Johnson and US Attorney General Loretta Lynch on Tuesday, according to a brief official statement from the Chinese side.
"[China and the US] should manage the disputes in a constructive fashion," Guo was quoted by Xinhua as saying. "We should offer timely and effective response to each other's concerns, taking the dialogue mechanism as our major channel for communication regarding the cybersecurity issues." [Source]
In any case, state-sponsored Chinese hackers have reportedly been busy elsewhere. Reuter's Clare Baldwin, James Pomfret, and Jeremy Wagstaff report that participants in last year's pro-democracy protests in Hong Kong have become the targets of sophisticated cyberattacks emanating from the mainland:
Almost a year after students ended pro-democracy street protests in Hong Kong, they face an online battle against what Western security experts say are China-sponsored hackers using techniques rarely seen elsewhere.
Hackers have expanded their attacks to parking malware on popular file-sharing services including Dropbox and Google Drive (GOOGL.O) to trap victims into downloading infected files and compromising sensitive information. They also use more sophisticated tactics, honing in on specific targets through so-called 'white lists' that only infect certain visitors to compromised websites.
Security experts say such techniques are only used by sophisticated hackers from China and Russia, usually for surveillance and information extraction.
The level of hacking is a sign, they say, of how important China views Hong Kong, where 79 days of protests late last year brought parts of the territory, a major regional financial hub, to a standstill. The scale of the protests raised concerns in Beijing about political unrest on China's periphery. [Source]
On Wednesday, Australia's Bureau of Meteorology reported that its system sustained a cyberattack that has been linked to China. Reuters' Matt Siegel reports:
The Bureau of Meteorology owns one of Australia's largest supercomputers and the attack, which the ABC said occurred in recent days, may have allowed those responsible access to the Department of Defence through a linked network.
The ABC, citing several unidentified sources with knowledge of the "massive" breach, placed the blame on China, which has in the past been accused of hacking sensitive Australian government computer systems.
"It's China," the ABC quoted one source as saying.
The Bureau of Meteorology said in a statement on its website that it did not comment on security matters, but that it was working closely with security agencies and that its computer systems were fully operational. [Source]
© cindyliuwenxin for China Digital Times (CDT), get_post_time('Y'). |
Permalink |
No comment |
Add to
Post tags: Australia relations, cyberespionage, cybersecurity, espionage, hacking, Hong Kong, Information Revolution, politics, United States
Download Tools to Circumvent the Great Firewall
On Monday, U.S. security firm CrowdStrike announced that it has thwarted a steady stream of apparently commercially motivated hacking attempts from China since the agreement. It has attributed these activities to "Deep Panda," a government-linked team previously blamed for major breaches of health insurer Anthem and the U.S. government's Office of Personnel Management. From CrowdStrike's Dmitri Alperovitch:
Over the last three weeks, CrowdStrike Falcon platform has detected and prevented a number of intrusions into our customers' systems from actors we have affiliated with the Chinese government. Seven of the companies are firms in the Technology or Pharmaceuticals sectors, where the primary benefit of the intrusions seems clearly aligned to facilitate theft of intellectual property and trade secrets, rather than to conduct traditional national-security related intelligence collection which the Cyber agreement does not prohibit.
[…] So does this evidence of ongoing intrusions into the commercial sector from China indicate the failure of the U.S.-China cyber agreement? That depends on what is done about it and how long the current situation persists. As George Kurtz stated on the date of the agreement, "even under the best of circumstances, industry is left to wonder how quickly China's bold intelligence gathering apparatus might be dismantled." The fact that there is some time delay between agreement and execution is not entirely unexpected. But, we need to know the parameters for success, and whether the parties to the agreement discussed a timeframe for implementation or, instead, expected it to be immediate.
[…] Call me an optimist, but I continue to have hope that meaningful progress can be made to turn the corner and establish norms of behavior for nation-states in cyberspace. […] [Source]
[Updated at 14:10 PDT on Oct 19, 2015: CrowdStrike's Alperovitch stressed to Foreign Policy that "we are not stating anywhere that the Chinese are violating the agreement. It is not up to us to draw that conclusion."]
From The Washington Post's Ellen Nakashima:
The U.S. intelligence community is also seeing continued signs of economic cyberespionage by Chinese hackers, according to a U.S. official, who spoke on the condition of anonymity because of the matter's sensitivity. But what it means at this point is not clear.
[…] A senior administration official said the White House is aware of CrowdStrike's report. "We'll decline comment on its specific conclusions," said the official, who spoke on the condition of anonymity because of the issue's sensitivity. "As we move forward, we will monitor China's cyber-activities closely and press China to abide by all of its commitments."
[…] Another threat-detection company, FireEye, also has observed activity from likely Chinese government hacker groups since Sept. 25. "But it is premature to conclude that activity during this short timeframe constitutes economic espionage," the firm's intelligence director, Laura Galante, said in an e-mail. "Assessing the complexity of changes in state-sanctioned economic espionage requires far more sufficient time, data and viewpoints," she said. [Source]
Chinese Foreign Ministry spokesperson Hua Chunying offered a familiar response to CrowdStrike's accusations at a press briefing on Monday:
Q: Hackers associated with the Chinese government have attacked at least seven US companies in the past three weeks, according to the US Cyber security firm Crowdstrike. What is China's comment?
A: On the issue of cyber security, the Chinese side has repeatedly clarified its principled position. China is a staunch advocate for cyber security, as well as a victim of cyber attacks. The Chinese government opposes all forms of cyber attacks and commercial espionage. This position is firm. The Chinese government will neither encourage companies to carry out cyber theft for commercial secrets, nor take part in such activities. It is hoped that relevant parties can uphold the spirit of mutual respect and mutual trust, and have more dialogue and cooperation in the field of cyber security in a constructive manner. [Source]
© Samuel Wade for China Digital Times (CDT), get_post_time('Y'). |
Permalink |
No comment |
Add to
Post tags: cyberattacks, cyberespionage, cybersecurity, economic espionage, espionage, hacking, United States
Download Tools to Circumvent the Great Firewall
While both sides hailed the agreement, initial reactions from other quarters were mixed. James Lewis of the Center for Strategic and International Studies had been dismissive of Xi's pledge to refrain from commercial theft earlier in the trip. But he described the subsequent deal as "a significant step forward," and praised the Obama administration's "clever" use of the threat of sanctions to gain leverage. At the Council on Foreign Relations, Robert Knake called it a "massive concession" from China, and "masterful diplomacy" by the U.S., adding that "the Obama Administration has been playing three dimensional chess and they won." His colleague David Fidler described the announcement as "gobsmacking" and "a remarkable result of cyber statesmanship by Presidents Obama and Xi" which, beyond the bilateral relationship, "gives the United States an opportunity to push more credibly for countries to accept this norm and anchor it in international law." Dmitri Alperovitch of security firm Crowdstrike similarly welcomed "a strategic inflection point," "a watershed moment," and "a tremendous victory for the Obama administration."
The Wall Street Journal, on the other hand, labeled the agreement a "mirage," and the official statements on it "an elaborate way of saying that the two sides agreed to nothing," pointing out that Xi had continued to deny any involvement in the forbidden activities. When asked if he believed that Chinese attacks would stop as a result, U.S. Director of National Intelligence James Clapper told the Senate Armed Services Committee, bluntly, "no." The U.S. should "trust but verify," he added, but "such malicious cyber activity will continue and probably accelerate until we establish and demonstrate the capability to deter malicious state-sponsored cyber activity."
On Friday, The Washington Post's Ellen Nakashima and Adam Goldman reported a possible sign of almost unprecedented action on China's part, with the detentions of several accused hackers ahead of the deal:
"We need to know that you're serious," was the way one individual familiar with the matter described the message. "So we gave them a list, and we said, 'Look, here's these guys. Round them up.'"
Now, administration officials are watching to see if China will follow through with prosecutions. A public trial is important not only because that would be consistent with established principles of criminal justice, but because it could discourage other would-be hackers and show that the arrests were not an empty gesture.
[…] Catherine Lotrionte, who teaches international law and cyberpolicy at Georgetown University and is a former CIA lawyer, said she had been skeptical that the pact was more than words. But China's arrests, she said, "makes the U.S. government look much smarter coming into this agreement" with Xi. "You want to see the Chinese do something," she said. "This would be one of those things that I want to see. It is a good-faith move by the Chinese."
She too, however, cautioned that there must be follow-through. "You want to watch over the next couple of months for action, for the cessation of attacks," she said.
[…] One complication, said a second individual familiar with the case, is that Chinese prosecution would entail the United States sharing evidence linking the cyberintrusions to the individuals. And to do so could compromise sensitive information on how the U.S. government tracked the suspects. [Source]
Chinese Foreign Ministry spokesperson Hua Chunying commented on Tuesday:
Q: It is reported that the Chinese side arrested in accordance with information offered by the US some hackers suspected of cyber espionage. Please confirm and give us more details. If it is true, is that an example of cyber security cooperation between China and the US, or is that just a quick fix to hold back US sanctions against China?
A: I have noted the relevant report. The Chinese government holds a clear-cut and consistent position on opposing cyber attacks and espionage and combating all forms of hacking activities in accordance with the law. Whoever commits cyber attacks and espionage at whatever time and whatever place in China violates China's national law and will face legal sanctions once caught.
Both China and the US are major internet users who enjoy broad shared interests and face common challenges in the field of cyber security. During President Xi Jinping's visit to the US, the two sides had thorough discussions and reached important consensus on the issue of cyber security. We hope that the two sides would work in concert to implement the consensus and make the issue of cyber security a new point of cooperation between China and the US instead of a source of friction. [Source]
While Hua evaded the matter of threatened sanctions, others suggested that they were likely decisive. From Yale Law School's Graham Webster in his U.S.-China Week newsletter, for example:
The revelation that the Chinese government detained alleged hackers identified by the U.S. government before Xi's visit likely suggests how far the Chinese side was willing to go in efforts to save the visit and at least temporarily avoid U.S. sanctions. Of course, secret detention does not send a message publicly within China, and the answer to Obama's question—"Are words followed by actions?"—hinges on whether public prosecutions follow on this or other cases and whether the subsequent parallel statement has any force. To me, news that such detentions preceded Xi's visit further calls into question whether China's government intends to follow through in enforcement and norm creation, rather than merely doing what was necessary to save the visit. If not for the joint language that emerged during the visit, you might think of the arrests as similar to pre-summit symbolic releases of political prisoners when human rights was higher on the U.S. agenda with China. [Source]
At Lawfare Blog, though, Harvard Law School's Jack Goldsmith argued that the threat of sanctions alone would not have been enough:
[… I]f China blinked, something more must have been threatened. Perhaps that something more was hinted at by President Obama ten days ago at a Business Roundtable speech:
"[I]ndustrial espionage and stealing trade secrets, stealing proprietary information from companies [is] an act of aggression that has to stop. And we are preparing a number of measures that will indicate to the Chinese that this is not just a matter of us being mildly upset, but is something that will put significant strains on the bilateral relationship if not resolved. … [I]f we wanted to go on offense, a whole bunch of countries would have some significant problems. And we don't want to see the Internet weaponized in that way."
This seems like a threat to use offensive cyber attacks in response to IP theft, which is a much more significant threat than mere selective economic sanctions. Such offensive actions would of course mark a dangerous escalation that would invite in-kind retaliation that could cause the United States much suffering. There's no way to know what the United States concretely threatened, or what risks it was willing to absorb. But if China really is pledging to accept the U.S. norm and change its behavior, the United States must have threatened much, much more than the selective economic sanctions that has dominated the headlines in the last few weeks. [Source]
Read more on Obama's speech and other recent statements via CDT.
At the American Enterprise Institute, Claude Barfield had previously argued that sanctions should still go ahead, even after the agreement:
While one can hope that the summit did indeed mark a turning point on Chinese cyber theft, there are two reason for going forward with the legal action: first, it would underscore the seriousness with which the US holds these incursions. Cliché or not, actions do speak louder than words. And second, without leveling any cheap shots against the diplomacy of the Obama administration, it is a fair point to note that the world has seen the US blow past a number of "red lines." In this case, after promising action, follow-through could help to redress that record. [Source]
Answering questions on the visit from a congressional subcommittee, Richard Bejtlich of security firm FireEye suggested that sanctions would not appear soon:
The last consequence that we appear to have available is sanctions. The President mentioned that in the event the Chinese don't appear to be upholding their end of this agreement, that the administration would pursue activities, possibly through U.S. trade rep, or through the WTO, through some mechanism … the executive order that they signed earlier this year gives them authority to impose sanctions as well. My personal opinion is we're not going to see sanctions anywhere within say a six month period, and honestly that starts to get towards the end of the Obama administration, and he may simply say "I'm going to hold off, just for the rest of my time." [Source]
On the subsequent news of the alleged hackers' detentions in China, Bejtlich commented at Brookings:
Overall, this development is significant because it is a concrete action by the Chinese government that moves beyond the words shared by Presidents Xi and Obama in late September. However, it does present some risks that perceptive American officials should consider before pressing for further action.
[…] It is easy for China-watchers to be cynical about developments in the digital arena, but this is a promising development. What matters now is how far the United States presses its position. It is important to welcome the news but be wary of reciprocal, asymmetric Chinese demands. [Source]
There has been widespread but unconfirmed speculation that the recent detainees, like the five suspected hackers indicted by the U.S. last year, are connected with China's military. Security expert The Grugq commented on this possibility:
China arrest hackers wanted by the US: it is a very strange world where army officers are arrested by their superiors for following orders.
— the grugq (@thegrugq) October 10, 2015
@yaelwrites yeah, we'll need to see what actually happened. But the US advocating arresting officers is very weird. Bad precedent
— the grugq (@thegrugq) October 10, 2015
In any case, the PLA, which is widely suspected of involvement in the kind of hacking at issue, presents something of a wildcard. FireEye's Bejtlich addressed the military issue in his congressional testimony:
First, consider President Xi's posture prior to the September 25th press conference. In written answers to questions posed by the Wall Street Journal, President Xi claimed "The Chinese government does not engage in theft of commercial secrets in any form, nor does it encourage or support Chinese companies to engage in such practices in any way." Combining this statement with his later declarations, it is possible President Xi is professing that the Chinese government does not hack, because he does not consider the People's Liberation Army, Ministry of State Security, or other organizations conducting hacking operations to be part of his definition of "Chinese government." Therefore, PLA units such as 61398, revealed by Mandiant in 2013, will continue to raid American companies, because Xi does not count them as government forces. [Source]
In the subsequent Q&A session, he added:
As far as the issue with the PLA, it's entirely possible that the Chinese government could rather than direct the PLA or the MSS to conduct these operations, they could sort of take a Thomas Becket approach, say "wouldn't it be great if someone could get us this information." Or "there is a need, the government has a need for this sort of information," and the military might pursue it on their own, or you may see a movement of people from those units into the Chinese private sector, where suddenly they become security companies or contractors who carry out this activity. We've called that the decentralized scenario at FireEye. Honestly, until the Chinese government changes its strategic decision to pursue Western technology and to abandon any sort of vulnerability or dependence on Western technology, they are going to continue to get this by any means necessary. [Source]
Similarly, from Adam Segal at the Council on Foreign Relations:
The other big issue is will the agreement increase, or reinforce, Beijing's reliance on proxies to conduct cyber espionage. As a recent investigation in the Wall Street Journal shows, there is overlap between PLA and freelance hacking groups. During their press conference, President Obama said that President Xi told him, "with 1.3 billion people, he can't guarantee the behavior of every single person on Chinese soil." But what portion of hacking is government controlled is already murky and now there are reasons to muddy the waters even further. [Source]
The Jamestown Foundation's Peter Mattis also commented at War On The Rocks:
[… T]he absence of the PLA in the agreement casts a shadow over the effectiveness of any mechanism to file requests about alleged violations of Chinese civilian and military intelligence collectors hacking foreign companies. The Ministry of Public Security and Ministry of State Security do not have the authority to enter PLA compounds to conduct investigations and make arrests. Other Chinese security organizations, like the State Secrets Bureau, have separate military elements and so also cannot access the PLA. The Ministry of National Defense is the PLA's mechanism for dealing with non-military organizations; yet, even they are not a part of the Sino–American committee to handle law enforcement issues dealing with cyberspace.
[…] If Xi Jinping and the Chinese government intend to stand by the cyber affirmation, then a dramatic drop-off in Chinese cyber espionage should be visible within weeks because the PLA would be the first of the Chinese agencies involved to draw down systematically and redirect its resources — unless foreign observers have profoundly misread the party–PLA relationship. If such a drop-off is not seen, then the most likely explanation is that Xi had no intention of abiding by the affirmation. [Source]
Mattis also warned that differences in the two sides' basic positions could set the agreement up to become "another broken promise":
As others have noted, China views its activities in cyberspace in the commercial, economic, and national security realm as a part of comprehensive national power and protecting China's developmental path. Accepting the U.S. interpretation requires Beijing to disaggregate its policy toolkit in unprecedented ways. Additionally, the vast scientific and industrial information complex in China serves to promote national development, not Chinese companies' competitive advantage. […]
[…] Moreover, the fine distinctions that Americans want to draw between supporting commercial companies and collecting intelligence on foreign scientific developments and their related economic base also ask Beijing to accept U.S. government support to defense-industrial companies that now increasingly compete internationally, including with some Chinese firms. This seems like a little too much trust to ask of two governments that increasingly mistrust the intentions of one another — or at least of a Chinese government fearful that the United States secretly intends to subvert and change the regime.
[…] Probably more than any other issue, cyber has poisoned the well of U.S.–China relations as reports and leaks confirmed each side's worst suspicions of the other's activity in cyberspace. [Source]
Whatever the success or otherwise of the agreement, its "fine distinctions" limit it to a very specific category of attacks, as The Washington Post's Henry Farrell explained:
The agreement does not address many of the more dramatic recent examples of Chinese spying, such as the apparent hack of the U.S. security clearance system, which led Washington to withdraw embassy personnel from Beijing for fear that the cover of CIA operatives has been blown. One excellent reason why the agreement doesn't address this kind of spying is that the United States does it too, is very good at it, and doesn't want to stop. US officials have expressed chagrin at the hacking of U.S. security clearances. They have also expressed some envy, and made it clear that if they could do the same to the Chinese government, they would.
Furthermore, the Chinese government can still hack U.S. companies, and steal their secrets with impunity. The only difference is that they cannot pass the secrets that they have learned to Chinese companies to give them competitive advantage. Gary Hufbauer at the Peterson Institute suggests that the "exact lines of demarcation" will mean that defense contractors remain fair game, while other companies, such as telecoms, might perhaps be off limits. This seems to misunderstand the agreement. The United States has not only been willing to hack into telecommunications companies, but also into energy companies, and, for that matter, universities and human rights organizations. It is unlikely that China's sensibilities are any daintier. The agreement limits the goals of spying, not the targets being spied upon. [Source]
The hacking of military contractors recently warned of by the FBI and reported by The Daily Beast; attacks on Hillary Clinton's email server reported by the Associated Press; and even the theft of data from mobile payment startup LoopPay for (the company claims) non-commercial purposes, reported by The New York Times, are all therefore exempt.
FireEye's Bejtlich also highlighted the broad sweep of exceptions:
A final consideration for this agreement requires considering who is left out. The focus on US and Chinese companies ignores many other targets. These include so-called civil society organizations (CSOs), as well-documented in the recent report by the University of Toronto's Citizen Lab titled Communities @ Risk. These CSOs include dissident groups inside and outside China, universities, think tanks, media organizations, lawyers, and human rights watchers. Companies in Europe, Asia, Africa, and elsewhere are not covered by the US-China agreement. Furthermore, the agreement mentioned the UN Group of Governmental Experts in the Field of Information and Telecommunications in the Context of International security, also known as the UN GGE, but it did not agree to implement its findings concerning critical infrastructure. Therefore, those systems continue to be held at risk, as will the government, military, intelligence, and law enforcement organizations of each country. [Source]
On Sunday, an extensive report in The Wall Street Journal placed the Sino-U.S. maneuvers in the context of "a frantic and destabilizing digital arms race" involving both state and non-state parties. The former were catalogued in a separate feature. For more on this wider context, see Eric Geller's recent account of "The global struggle to prevent cyberwar" at The Daily Dot.
© Samuel Wade for China Digital Times (CDT), get_post_time('Y'). |
Permalink |
No comment |
Add to
Post tags: Barack Obama, cyberespionage, data security, diplomacy, economic espionage, espionage, hackers, hacking, People's Liberation Army, Xi Jinping
Download Tools to Circumvent the Great Firewall
"It is most likely Chinese," said Bryce Boland, FireEye's chief technology office for Asia Pacific, in an interview. "We don't have a smoking gun, but all roads lead to China."
[…] The cyberespionage group sent targeted spear-phishing e-mails to its intended victims, with Microsoft Word attachments containing information on regional diplomatic issues, FireEye said.
The attachments contained a script called "WATERMAIN" that, if opened, could infect the user's computer, creating a "backdoor" that would allow the attacker access.
[… The WATERMAIN script appeared to have been designed for Chinese-speaking users, Boland said, and targeted information of interest to the Chinese government. Attacks were seen on government bodies as well as diplomatic, scientific and educational institutions in Asia.
In April, FireEye said it had identified another cyberespionage group, also suspected to be based in China, that has been running a decade-long campaign to spy on India and Southeast Asia. […] [Source]
FireEye's findings suggest that hackers in China have been targeting India-based Tibetan activist and exile groups for at least four years. James Griffiths reports at the South China Morning Post:
"Over the past four years, this threat group has [targeted] over 100 victims, approximately 70 per cent of which were in India," [FireEye…] said in a statement.
It "also targeted Tibetan activists and others in Southeast Asia, with a focus on governmental, diplomatic, scientific and educational organisations."
[…] Beijing has viewed Tibetan groups in India with suspicion ever since the Dalai Lama fled China in 1959 to establish the Central Tibetan Administration, more commonly known as the Tibetan government-in-exile, in Dharamsala.
[…] In April, FireEye reported that a separate Chinese hacking team, APT30, had been spying on governments and businesses in Southeast Asia and India uninterrupted for a decade, echoing claims made by researchers at US firm McAfee in 2011. [Source]
While the Chinese government has long been suspected of targeting exiled Tibetans and exiled Uyghur groups, Beijing has consistently denied any state-sponsored hacking. For more on this, see the short documentary "Tibet: Frontline of the New Cyberwar" from the Tibet Action Institute, or the Citizen Lab's 2009 report "Tracking GhostNet: Investigating a Cyber Espionage Network."
China faced (and denied) allegations of involvement in a high-profile hacking cases against U.S. government computer systems in June.
© josh rudolph for China Digital Times (CDT), get_post_time('Y'). |
Permalink |
No comment |
Add to
Post tags: Central Tibetan Authority, cyberattacks, cyberespionage, cybersecurity, hacking, India, Tibet, Tibetan exiles
Download Tools to Circumvent the Great Firewall
U.S. officials said the talks behind closed doors were "frank," but public comments Wednesday at the conclusion of the meetings were largely conciliatory. U.S. officials complained about China's behavior in the South China Sea and cyberspace, while emphasizing steps to narrow differences and find areas of common ground.
[…] "Our dialogue over the last 2½ days included a very frank discussion of some issues on which we have not always seen eye to eye," Mr. Kerry said. "The U.S. is deeply concerned about cyber incursions that have raised security questions and, frankly, harmed American businesses."
[…] Mr. Kerry said China had agreed to work with the U.S. to complete a code of conduct on cyber activities. "We believe very strongly that the U.S. and China should be working together to develop and implement a shared understanding of appropriate state behavior in cyberspace," Mr. Kerry said. [Source]
The Council on Foreign Relations' Adam Segal noted that no mention of the code is found in the State Department's 127-point list of "specific outcomes and areas for further cooperation." Nevertheless, he wrote, the pledge holds some promise:
While it was to be expected that official remarks at the conclusion of the meeting would be conciliatory—both sides want President Xi Jinping's visit to the United States in September to go well—Washington and Beijing made parallel calls for cooperation on cybersecurity that could lay the groundwork for future discussions. At the opening of the dialogue, State Councilor Yang Jiechi stated that China wanted to develop with the United States and other countries an "international code of conduct for cyber information sharing." though no details were offered on what that exactly means. […]
[…] Of course, the calls for cooperation may be nothing more than niceties, designed to reduce tensions in the run up to the September visit. From China's perspective, it has always been open to greater cooperation. When accused of hacking, Chinese officials typically deny the claim, question the motives of the accuser, and then ritualistically invoke the need for international cooperation. But the call for cyber information sharing is new, and Washington should push Beijing to clarify what it means by information and how it would like to see sharing work. Good diplomacy can spin opportunities out of the introduction of new ideas. [Source]
When the hacking of the U.S. government's Office of Personnel Management was first announced early this month, the number of employees affected was said to be around 4 million. With the subsequent discovery of another breach, estimates now reach as high as 18 million, including White House and congressional staff. Contrary to initial reports, the intruders had access to highly sensitive security clearance data for as long as a year. Such information would include "workers' sexual partners, drug and alcohol abuse, debts, gambling compulsions, marital troubles, and any criminal activity," which at the blunt end of the spectrum might leave them vulnerable to blackmail. More subtly, the data could be used to identify and then recruit potential intelligence sources through bribery or flattery, while providing a clear map of security clearance procedures and their possible weaknesses. Cross-referencing with data from other hacks might allow identification of staff who had failed to disclose information.
China denies any part in the attacks. But Michael Hayden, a former head of the National Security Agency and Central Intelligence Agency, has described the OPM's data as "a legitimate foreign intelligence target," adding that "this is not 'shame on China.' This is 'shame on us' for not protecting that kind of information."
The OPM's director offered a different interpretation during sustained congressional grilling over security failures at the agency. From Lisa Rein at The Washington Post:
"We have legacy systems that are very old," Katherine Archuleta, director of the Office of Personnel Management, told Senate lawmakers at a hearing on the intrusion. "It's an enterprise-wide problem. I don't believe anyone is personally responsible."
She then told Sen. Jerry Moran (R-Kan.), who pressed her repeatedly to take responsibility for failing to shore up the agency's computer security, that the attackers are the ones to blame.
[…] Archuleta said she is "working very hard on correcting decades of inattention" to weak computer security at her agency, and credited her efforts to add new security defenses for discovering the breach in the first place. But the OPM's inspector general described a history of failures by the agency to take basic security steps.
[…] Michael Esser, assistant inspector general for audit, testified that numerous recommendations to modernize aging systems and improve the security of modern ones have not been followed. He noted that a number of the systems that were breached in the hack disclosed in June were actually not "legacy systems," but modern ones. [Source]
The agency's initial efforts to notify affected employees also attracted criticism for encouraging behavior that could facilitate further attacks. Lax security at the OPM and beyond is described in detail in recent posts by Ars Technica's Sean Gallagher, who noted that some OPM contractors hired Chinese nationals. At least one of these, said to have had "direct access to every row of data in every database," was actually based in China.
Security failings at the OPM are hardly unique, The New York Times' David E. Sanger, Nicole Perlroth and Michael D. Shear reported last weekend:
The administration is urgently working to determine what other agencies are storing similarly sensitive information with weak protections. Officials would not identify their top concerns, but an audit issued early last year, before the Chinese attacks, harshly criticized lax security at the Internal Revenue Service, the Nuclear Regulatory Commission, the Energy Department, the Securities and Exchange Commission — and the Department of Homeland Security, which has responsibility for securing the nation's critical networks.
At the Nuclear Regulatory Commission, which regulates nuclear facilities, information about crucial components was left on unsecured network drives, and the agency lost track of laptops with critical data.
Computers at the I.R.S. allowed employees to use weak passwords like "password." One report detailed 7,329 "potential vulnerabilities" because software patches had not been installed. Auditors at the Department of Education, which stores information from millions of student loan applicants, were able to connect "rogue" computers and hardware to the network without being noticed. And at the Securities and Exchange Commission, part of the network had no firewall or intrusion protection for months. [Source]
CIA-linked data mining firm Recorded Future reported this week that it found login details for employees of 47 different government agencies posted online, and that 12 of these organizations failed to use two-factor authentication as an additional layer of security. Meanwhile, traces of malware that struck the OPM have been discovered on computers at the National Archives. ACLU technologist Christopher Soghoian commented:
Post OPM breach, no one can seriously believe that China didn't hack Clinton's unprotected personal email server, right?
— Christopher Soghoian (@csoghoian) June 22, 2015
The intrusions may go much deeper. As the OPM story developed, The Sunday Times reported anonymous British officials' claims that documents leaked by former NSA contractor Edward Snowden had fallen into Russian and Chinese hands. The article was immediately and widely mauled, particularly after its author told CNN that none of its specifics could be verified and that "we just publish what we believe to be the position of the British government at the moment." At Wired, security technologist Bruce Schneier wrote that Snowden's actions were probably beside the point anyway:
I believe that both China and Russia had access to all the files that Snowden took well before Snowden took them because they've penetrated the NSA networks where those files reside. After all, the NSA has been a prime target for decades.
[…] In general, it's far easier to attack a network than it is to defend the same network. This isn't a statement about willpower or budget; it's how computer and network security work today. A former NSA deputy director recently said that if we were to score cyber the way we score soccer, the tally would be 462–456 twenty minutes into the game. In other words, it's all offense and no defense.
In this kind of environment, we simply have to assume that even our classified networks have been penetrated. Remember that Snowden was able to wander through the NSA's networks with impunity, and that the agency had so few controls in place that the only way they can guess what has been taken is to extrapolate based on what has been published. Does anyone believe that Snowden was the first to take advantage of that lax security? I don't.
[…] I am reminded of a comment made to me in confidence by a US intelligence official. I asked him what he was most worried about, and he replied: "I know how deep we are in our enemies' networks without them having any idea that we're there. I'm worried that our networks are penetrated just as deeply." [Source]
While most have focused on the need for better defenses, some argue for counterattacks. Prospective Republican presidential candidate Mike Huckabee, for example, wrote that:
The response and retaliation to this behavior is simple-America should hack the Chinese government. We should hack the cell phones of some prominent Communist party leaders, hack the bank accounts of intelligence officials, publicly humiliate Chinese families for political corruption, or wipe-out a few critical Chinese computer systems. [Source]
UCLA's Kristen Eichensehr, examining the OPM breach in light of the Department of Defense's newly released Law of War Manual, wrote last week at Just Security that such bellicose rhetoric is unrealistic:
Debates are raging over just how damaging the two OPM hacks are. In the first of what are sure to be many congressional hearings on the breaches, Rep. Carolyn Maloney (D-NY) asserted that she "consider[s] this attack … a far more serious one to the national security" of the United States than the 9/11 attacks. Others have called the hacks the long-warned-about cyber 9/11 or cyber Pearl Harbor. But other commentators have pushed back. Robert Knake of CFR noted that he is "a bit blasé" about the hack because "if the Chinese government is indeed behind it, it's not by any stretch the most dastardly thing they have done in cyberspace." [Knake listed five worse cases attributed to China in a blog post at CFR.] Prof. Henry Farrell on the Washington Post's Monkey Cage blog similarly explained that "hacking into information on U.S. government employees, however sensitive, is not a Pearl Harbor attack," but rather "an (extremely worrying) exercise in espionage."
[…] Despite the debate over exactly how bad the OPM hacks are for national security, there is no doubt that they are a blow, the magnitude of which will become clearer over time. Where any US claim to the legal or moral high ground would be shaky at best, we should assume that spies are going to spy and act accordingly. This means that the government must better secure its sensitive information going forward and take steps to protect the individuals already put at risk. Beyond such responses, allusions to 9/11 and Pearl Harbor are misplaced and tend to frame these hacks in terms countenanced neither by realism in international relations nor by the rules of international law. [Source]
In any case, it remains unproven that China is the real culprit. The OPM hacks are thought to be the work of "Deep Panda," an outfit associated with China's Ministry of Public Security. But when Director of National Intelligence James Clapper said this week that China is "the leading suspect," it was the strongest such statement to date by a serving U.S. official on the record. Michael Rogers, NSA director and commander of U.S. Cyber Command, has emphasized the enduring uncertainty about attribution of the attacks. From Patrick Tucker at Defense One:
Rogers spoke in response to a question about how the National Security Agency was going about attributing the breach to the Chinese government. "You've put an assumption in your question," he said. "I'm not going to get into the specifics of attribution. It's a process that's ongoing."
[…] The cybersecurity group FireEye says it's "highly confident" that Chinese hackers did it, based on the kind of cables and telecommunications equipment involved, the type of data stolen, and the specific backdoors that the thieves used. "These backdoors, they're commonly used by Chinese threat actors," Michael Oppenheim, the intelligence operations manager at FireEye, told Defense One.
Oppenheim stopped short of formally accusing the Chinese government but added, "We believe that this aligns with Chinese interests."
Oppenheim said that he was sympathetic to Rogers's reluctance to formally attribute the breach to the Chinese government. "For someone in his position, you want to be 100-percent sure," he said. [Source]
Another recent hacking case showed attackers leaving false tracks meant to implicate China. Russian security company Kaspersky revealed this month that it had discovered malware dubbed "Duqu 2" within its own systems. The firm's technical paper on the intrusion refrained from explicit attribution (PDF), but noted:
[… T]he attackers have tried to include several false flags throughout the code, designed to send researchers in the wrong direction. For instance, one of the drivers contains the string "ugly.gorilla", which obviously refers to Wang Dong, a Chinese hacker believed to be associated with the APT1/Comment Crew. The usage of the Camellia cypher in the MSI VFSes, previously seen in APT1-associated Poison Ivy samples is another false flag planted by the attackers to make researchers believe they are dealing with APT1 related malware. […]
Nevertheless, such false flags are relatively easy to spot, especially when the attacker is extremely careful not to make any other mistakes. [Source (PDF)]
The attackers also used a digital certificate apparently stolen from Taiwan-based Foxconn, possibly for similar reasons. From Kim Zetter at Wired:
The Taiwanese firm makes hardware for most of the major tech players, including Apple, Dell, Google, and Microsoft, manufacturing the likes of iPhones, iPads and PlayStation 4s. Taiwanese companies have been fruitful for this hacking group, who many believe to be Israeli: This marks at least the fourth time they have used a digital certificate taken from a Taiwan-based firm to get their malware successfully onto systems.
It's unclear why the attackers focus on digital certificates from Taiwanese companies, but it may be to plant a false flag and misdirect investigators into thinking China is behind the malware attacks, says Costin Raiu, director of Kaspersky's Global Research and Analysis Team.
The strategy of stealing and corrupting otherwise-legitimate certificates is particularly galling to the security community because it undermines one of the crucial means for authenticating legitimate software. [Source]
Kaspersky found that Duqu 2 had been used to infiltrate hotels hosting Iran nuclear talks, allowing access to security cameras, microphones, Wi-Fi networks, phone communications, and hotel records. Coincidentally, reports last week indicated that the U.S. State Department will no longer use the Waldorf Astoria as a New York base for its staff following its acquisition by the Beijing-based Anbang Insurance Group last year.
© Samuel Wade for China Digital Times (CDT), get_post_time('Y'). |
Permalink |
No comment |
Add to
Post tags: blackmail, CIA, cyberattacks, cyberespionage, cybersecurity, Edward Snowden, espionage, hackers, hacking, National Security Agency, U.S. intelligence, United States
Download Tools to Circumvent the Great Firewall
There seemed to be little doubt among federal officials that the attack was launched from China, but it was unclear whether it might have been state sponsored. The administration did not publicly identify Chinese hackers as the culprits because it is difficult to definitively attribute the source of cyberattacks and to back up such an attribution without divulging classified data.
[… L]ast summer, the personnel office announced an intrusion in which hackers appeared to have targeted the files of tens of thousands of workers who had applied for top-secret security clearances.
In that case, the objective seemed clear: The information on security clearances could help identify covert agents, scientists and others with data of great interest to foreign governments. That breach also appeared to have involved Chinese hackers.
But because the breadth of the new attack was so much greater, the objective seemed less clear. [Source]
In a pair of articles at The Washington Post, Ellen Nakashima explored what data was taken, for what purpose, and by whom:
The intruders in the OPM case gained access to information that included employees' Social Security numbers, job assignments, performance ratings and training information, agency officials said. OPM officials declined to comment on whether payroll data was exposed other than to say that no direct-deposit information was compromised. They could not say for certain what data was taken, only what the hackers gained access to.
[…] In the current incident, the hackers targeted an OPM data center housed at the Interior Department. The database did not contain information on background investigations or employees applying for security clearances, officials said. [Reuters, though, reports that the data "included security clearance information and background checks dating back three decades," also citing U.S. officials.]
By contrast, in March 2014, OPM officials discovered that hackers had breached an OPM system that manages sensitive data on federal employees applying for clearances. That often includes financial data, information about family and other sensitive details. That breach, too, was attributed to China, other officials said. OPM officials declined to comment on whether the data affected in this incident was encrypted or had sensitive details masked. They said it appeared that the intruders are no longer in the system. [Source]
"They're definitely going after quite a bit of personnel information," said Rich Barger, chief intelligence officer of ThreatConnect, a Northern Virginia cybersecurity firm. "We suspect they're using it to understand more about who to target, whether electronically or via human recruitment [for espionage]."
[…] Once harvested, the data can be useful to glean details about key government personnel and potential spy recruits, or information useful for counterintelligence. Records in OPM's database of background investigations, for instance, could contain a complete history of where an individual has lived, and all of his or her foreign contacts in, say, China. "So now the Chinese counterintelligence authorities know which American officials are meeting with which Chinese," a China cyber and intelligence expert said.
[…] Though much Chinese cyberespionage is attributed to the People's Liberation Army, these hacks, Barger said, appear to be linked to the Ministry of State Security, which is a spy agency responsible for foreign espionage and domestic counterintelligence.
Other Chinese units, including the military, may also be involved in the campaign, analysts say. [Source]
White House press secretary Josh Earnest raised the possibility of sanctions against whoever was responsible for the breach, but would not directly confirm that China is a suspect, The Guardian's Dan Roberts reported:
"In April, the president, using his executive authority, signed an executive order giving the Treasury Department additional authority to use economic sanctions to punish or hold accountable those who are either responsible for a cyber intrusion or are benefiting from one," he said.
[…] "I can't get into any conclusions that have been reached about who or what country may be responsible for this particular incident," said Earnest.
"But when it comes to China, you all know that the president has frequently, including in every single meeting that he's conducted with the current Chinese president, raised China's activities in cyberspace as a significant source of concern."
[…] "Any time that these kinds of investigations are being conducted is that there is risk associated with making public what exactly our investigators have learned," said Earnest. "And the reason for that is that we're dealing with a persistent adversary, and in some cases, the less they know about what we know about what they did, the better. And so we're certainly mindful of that as we talk about this in public." [Source]
Robert Knakes of the Council on Foreign Relations commented that "while I'm not usually in the position of defending the Chinese, I'm skeptical that China is behind this incident":
The information has little intelligence value. Why the Chinese government would care about the social security numbers of every clerk in the Commerce Department is beyond me. The theory that it can be used in spear phishing campaigns doesn't make much sense. LinkedIn and Facebook have much more detailed information. So does the Plum Book and publicly available databases on federal employee salaries. Many close watchers of Chinese cyber activities have observed that Chinese actors have been less brazen since the Mandiant report and the PLA indictments. The fallout from getting caught isn't worth the intelligence gain.
[…] The information is more valuable to criminals. It doesn't make sense that the Chinese government would value the stolen information to this degree. Criminals are the more likely culprits. This is the same kind of information that was stolen in the Anthem and Carefirst breaches—it's information that you need to file fraudulent insurance claims or commit tax fraud. Senator Collins is the only official who may have had access to actual intelligence that has gone on the record. She has said the hackers are believed to be "based" in China, a far cry from direct attribution to the Chinese government. [Source]
An editorial from Chinese state news agency Xinhua described the reports and off-the-record accusations as part of a concerted American campaign against China:
People can also smell rat from some recent moves taken by the U. S. government, including the charges filed against some Chinese professors for so-called theft of trade secrets [background] and against a dozen of Chinese students in the U.S. for fraud and cheating on tests [background]. All the timings are subtly synchronized with the development of Washington's rift with China over the South China Sea.
[…] For too long time that the two countries have easily fell into the trap of political bias, ideological paranoia and lingering misunderstanding despite the flouring bilateral trade and people- to-people exchanges. This is evident in the recurrent fluctuation in the Sino-U.S. bilateral ties in the past four decades.
[…] Basically, Washington needs to stop its witch-hunt of China, tune down its criticism of China, and learn to accommodate China in an unbiased way. Otherwise, the rivalry between the two powers is destined to worsen and have a destabilizing effect on world peace and security. [Source]
Spokesman Hong Lei issued the Chinese Foreign Ministry's customary denial at a press conference on Friday:
[… R]ecently we have seen quite a lot of media reports or remarks of this kind. But are these reports or remarks scientific? Cyber attacks are usually conducted anonymously and across borders, making it hard to trace back. It is not responsible nor scientific to always use terms such as "likely" or "suspected" instead of conducting thorough investigations. It is the consistent position of China to firmly combat all forms of cyber attacks. China itself is a victim of cyber attacks. We are ready to carry out international cooperation on this issue and build a cyber space that is peaceful, secure, open and cooperative. We hope that the US side would discard suspicions, refrain from making groundless accusations, and show more trust and conduct more cooperation in this area. [Source]
Earlier this week, the Council on Foreign Relations' Adam Segal noted the publication of a new report backing up China's official complaints about incoming cyberattacks:
Last week, SkyEye, Qihoo 360's threat intelligence service, released a report entitled OceanLotus. The report describes the working of an APT (Advanced Persistent Threat) group engaged for at least three years in cyber espionage against Chinese targets, including ocean affairs agencies, the departments in charge of China's territorial waters, research institutes, and aviation, aeronautics, and shipping companies. Over 90 percent of the infections were in China, most in Beijing and Tianjin. According to SkyEye, the sophistication of OceanLotus suggests that it is a nation-state-backed group, though it does not name the country. The report does identify the locations of the IP addresses and command and control servers used in the attacks: Bahamas, United States, Ukraine, Nigeria, Israel and others.
Qihoo clearly is co-opting the language and techniques of the APT reports done by Mandiant, CrowdStrike, and other U.S. cybersecurity companies. The structure of Qihoo's report is very familiar to anyone who has read an English-language report, though it seems like they missed an opportunity to up with a name in the vein of Putter Panda or Volatile Cedar that implies the nation-state behind the attacks (Elegant Eagle?). The attempt to match the reports of the U.S. companies may be based on marketing and business needs, but it is also in the minds of some Chinese analysts a necessary step in the cybersecurity competition with the United States.
[…] It is easy to write this report off as propaganda, but that would be a mistake. […] [Source]
South China Morning Post, meanwhile, reported the hacking of state-owned Chinanews.cn in an apparent extortion attempt on Wednesday. The revelation of the OPM breach coincides with news on the NSA's efforts to combat foreign hackers, published by The New York Times and Pro Publica based on documents leaked by Edward Snowden. Also at The New York Times, Snowden himself reflected on Friday on developments since his public emergence in Hong Kong two years ago.
© Samuel Wade for China Digital Times (CDT), get_post_time('Y'). |
Permalink |
No comment |
Add to
Post tags: cyberattacks, cyberespionage, cybersecurity, espionage, hacking, United States
Download Tools to Circumvent the Great Firewall
On Friday, researchers based at the University of Toronto's Citizen Lab, the International Computer Science Institute, the University of California at Berkeley, and Princeton University reported that the attacks were conducted using a potent new tool, dubbed "the Great Cannon." They describe the weapon as separate from the Great Firewall, but say that the two systems' shared code and network location help compellingly link it to the Chinese government. From Nicole Perlroth at The New York Times:
China's new Internet weapon, the report says, is similar to one developed and used by the National Security Agency and its British counterpart, GCHQ, a system outlined in classified documents leaked by Edward J. Snowden, the former United States intelligence contractor. The American system, according to the documents, which were published by The Intercept, can deploy a system of programs that can intercept web traffic on a mass scale and redirect it to a site of their choosing. The N.S.A. and its partners appear to use the programs for targeted surveillance, whereas China appears to use the Great Cannon for an aggressive form of censorship.
[…] Still, the Chinese program illustrates how far officials in Beijing are willing to go to censor Internet content they deem hostile. "This is just one part of President Xi Jinping's push to gain tighter control over the Internet and remove any challenges to the party," said James A. Lewis, a cybersecurity expert at the Center for Strategic Studies in Washington.
[… Co-author Bill] Marczak said researchers' fear is that the state could use its new weapon to attack Internet users, particularly dissidents, without their knowledge. If they make a single request to a server inside China or even visit a non-Chinese website that contains an ad from a Chinese server, the Great Cannon could infect their web communications and those of everyone they communicate with and spy on them. [Source]
Co-author Nicholas Weaver explained his impressions of the findings on Twitter:
("Man in the Middle.")
U.S. law enforcement and intelligence officials, as well as those in other countries, have made repeated calls for measures to allow them access to encrypted data. Critics say this would leave privacy and security dangerously compromised. China has subsequently raised its own demands for "back door" access as a condition for doing business there, citing the U.S. example as justification.
At Krebs On Security, Brian Krebs quoted Weaver and Marczak at greater length on the protection that encryption offers against the Great Cannon:
Weaver said the attacks from the Great Cannon don't succeed when people are browsing Chinese sites with a Web address that begins with "https://", meaning that regular Internet users can limit their exposure to these attacks by insisting that all Internet communications are routed over "https" versus unencrypted "http://" connections in their browsers. A number of third-party browser plug-ins — such as https-everywhere — can help people accomplish this goal.
"The lesson here is encrypt all the things all the time always," Weaver said. "If you have to worry about a nation state adversary and if they can see an unencrypted web request that they can tie to your identity, they can use that as a vehicle for attack. This has always been the case, but it's now practice."
But Bill Marczak, a research fellow with Citizen Lab, said relying on an always-on encryption strategy is not a foolproof counter to this attack, because plug-ins like https-everywhere will still serve regular unencrypted content when Web sites refuse to or don't offer the same content over an encrypted connection. What's more, many Web sites draw content from a variety of sources online, meaning that the Great Cannon attack could succeed merely by drawing on resources provided by online ad networks that serve ads on a variety of Web sites from a dizzying array of sources. [Source]
HTTPS encryption depends on digital certificates issued by bodies including the government-supervised China Internet Network Information Center (CNNIC). In another cybercontroversy last month, CNNIC certificates were blocked by Google and Mozilla, developers of the Chrome and Firefox web browsers, after the Center "delegated their substantial authority to an organization that was not fit to hold it." (CNNIC denounced Google's decision as "unacceptable and unintelligible," urged the company to "take users' rights and interests into full consideration," and censored related news online.)
CNNIC's role in the certification system would in theory allow it to compromise HTTPS' protection against the Great Cannon. The cost and likelihood of detection, however, would be high:
@ncweaver doesn't encryption fail to stop MITM if the injector has a valid cert, as could be the case in China? Honest question.
— Richard Bejtlich (@taosecurity) April 10, 2015
("Certificate Authority.")
@ncweaver Ok, so it's technically possible to MITM HTTPS, but, once detected and addressed by the browsers, it's a bad long-term idea. Tks!
— Richard Bejtlich (@taosecurity) April 10, 2015
Weaver continued:
The attack's apparent brazenness might conceivably not have been a top-level decision. China's cyber forces appear extremely diverse in terms of organization, discipline, and skill. (Weaver himself commented on "stupidities" in the Great Cannon's design.) Their actions are not always closely coordinated, and their identities not always effectively concealed.
On the other hand, Israeli cybersecurity expert Yael Shahar told The National Journal in 2013 that China's hackers are "very careful not to cover their tracks very well. It's a projection of power." The Great Cannon report argues that the scale and significance of the attack suggest high-level approval for what may have been a deliberately public signal: if, as GitHub suspected, "the intent of this attack is to convince us to remove a specific class of content," then clear attribution would make the message louder and more widely heard, while still officially deniable. From the Citizen Lab report:
It is likely that this attack, with its potential for political backlash, would require the approval of high-level authorities within the Chinese government. […]
The government's reasoning for deploying the GC here is unclear, but it may wish to confront the threat presented to the Communist Party of China's (CPC) ideological control by the "collateral freedom" strategy advanced by GreatFire.org and others. The attack was exceptionally costly to GreatFire, according to their public statements, as well as disruptive to the companies that hosted GreatFire content. Such a disruption could be both an attempt to block the operations of an undesirable resource, and a signal sent to other organizations of the potential price tag for this kind of activity. Deployment of the GC may also reflect a desire to counter what the Chinese government perceives as US hegemony in cyberspace.
[…] We remain puzzled as to why the GC's operator chose to first employ its capabilities in such a publicly visible fashion. Conducting such a widespread attack clearly demonstrates the weaponization of the Chinese Internet to co-opt arbitrary computers across the web and outside of China to achieve China's policy ends. The repurposing of the devices of unwitting users in foreign jurisdictions for covert attacks in the interests of one country's national priorities is a dangerous precedent — contrary to international norms and in violation of widespread domestic laws prohibiting the unauthorized use of computing and networked systems. [Source]
At Foreign Policy, Oxford University and China Copyright and Media's Rogier Creemers commented on the attack's context in the long-running Sino-U.S. cyberfeud:
At the heart of this attack lie two fundamentally conflicting views of legitimate governance and security in cyberspace. From the Chinese point of view, the Great Firewall is a critical piece of national security infrastructure that protects against relentless attempts by "foreign hostile powers" to undermine the stability of the regime. The avowed mission of GreatFire.org to unblock censored websites is, in that sense, an act of sabotage that impinges on China's sovereign right of self-determination.
From the Western point of view, GreatFire.org, which not only monitors censorship trends on the Chinese Internet, but also seeks to unblock censored information, is a courageous defender of the online rights and liberties of China's citizens, as well as of the integrity of the global Internet. From this angle, China's tactics undermine trust in Chinese businesses and regulators and risk the Balkanization of the web.
[…] One inconvenient truth that the Western side must face is that China has a better bargaining position. Its chief objective is clearly spelled out in its drive for what it calls Internet sovereignty: to ensure that everything that might affect the Chinese Internet is under Beijing's control. China's government doesn't care whether the Internet balkanizes; in fact, China has no overall transformative goal for the global Internet. Rather, it seeks to govern the international aspects of cyberspace on the basis of 19th century diplomatic principles. Instead of trying to develop a highly complex and new multi-stakeholder model for cybergovernance, it simply assumes a statist model. This defensive posture means that its objectives are much more closely matched to its abilities than the transformative views espoused in the global Internet governance community, which lacks the tools to bring non-compliant countries or organizations into the fold. And China has been able to buttress its position by leveraging its huge domestic market, requiring that global multinationals play by the government's rules, or not at all. [Source]
© Samuel Wade for China Digital Times (CDT), get_post_time('Y'). |
Permalink |
No comment |
Add to
Post tags: cyberattacks, cybersecurity, Edward Snowden, encryption, Great Cannon, Great Firewall, hacking, NSA, United States, Xi Jinping
Download Tools to Circumvent the Great Firewall
We are currently experiencing the largest DDoS (distributed denial of service) attack in github.com's history. The attack began around 2AM UTC on Thursday, March 26, and involves a wide combination of attack vectors. These include every vector we've seen in previous attacks as well as some sophisticated new techniques that use the web browsers of unsuspecting, uninvolved people to flood github.com with high levels of traffic. Based on reports we've received, we believe the intent of this attack is to convince us to remove a specific class of content. [Source]
The specific content targeted was a pair of GitHub pages run by the censorship monitoring project GreatFire.org: its own page, and another for a mirror of the Chinese-language New York Times site. In late 2013, GreatFire began to create mirrored copies of blocked websites such as Reuters Chinese and its own FreeWeibo.com using Google and Amazon web services. This approach, dubbed "collateral freedom," effectively dares Chinese authorities to block the entire platforms on which the mirrors are hosted. Although Google services were comprehensively blocked ahead of last year's 25th anniversary of the 1989 June 4th crackdown, the project has diversified and expanded to provide access to ten blocked websites including CDT, with another nine covered by media freedom organization Reporters Without Borders.
The GitHub attackers hijacked tracking code from Chinese search giant Baidu, embedded in hundreds of thousands of Chinese sites, to recruit any visitors from outside China as unwitting accomplices. As long as these visitors remained on an affected site, their browsers would direct a stream of requests in the background to the two GitHub pages:
The Washington Post's Andrea Peterson put the attack in context:
GitHub was briefly blocked inside China in 2013, but reinstated after an outcry from programmers. Because GitHub uses encryption to hide specific parts of the site, the Chinese government cannot selectively block only some of GitHub's content. But blocking the site wholesale could be damaging to China's economy because it is so widely used by the tech industry.
Forcing GitHub site to take down GreatFire's pages, as Newland suggested is the attackers' goal, would solve this dilemma. Peterson also addressed the question of attribution:
While determining the entities behind these types of attacks is difficult, the Chinese government would be an obvious culprit, said James A. Lewis, a senior fellow at the Center for Strategic and International Studies. "The only people who would really benefit from it would be China," he said. Using such a bold tactic to attack content it dislikes seems to be either a way for the government to send a message or test out new capabilities, he said. [Source]
Security expert Mikko Hypponen similarly told Motherboard that "I have no proof it's the Chinese government. But who else would have the motive? Who else would have the capability to hijack traffic like this?" On Twitter, he added:
The DDoS attacks against Github and AWS (both done with hijacked Baidu traffic) are meant to silence the great work done by @GreatFireChina.
— Mikko Hypponen (@mikko) March 27, 2015
The Amazon Web Services attack Hypponen refers to took place soon after the publication of a Wall Street Journal article on the project earlier this month. Buoyed by a flood of up to 2.6 billion server requests per hour, GreatFire's bandwidth costs rose to $30,000 per day, which the group dryly noted could "put a significant squeeze on our operations." It was already on China's radar before the WSJ article appeared: in January, as Chinese authorities stepped up efforts to block censorship circumvention, the Cyberspace Administration of China labeled GreatFire.org "an anti-China website set up by an anti-China overseas organization, which has for a long time carried out unprovoked attacks on the Chinese government."
After falling victim to an apparently random DDoS from China in January, Iconfactory's Craig Hockenberry commented that "at the end of the day, every machine in China has the potential be a part of a massive DDOS attack on innocent sites. As my colleague Sean quipped, 'They have weaponized their entire population.'" Observing the GitHub attack on Friday, Insight Labs' Anthr@x wrote that "even people outside China are being weaponized to target things the Chinese government does not like, for example, freedom of speech."
The attack, meanwhile, continues:
The ongoing DDoS attack has adjusted tactics again. We are continuing to adapt and mitigate it.
— GitHub Status (@githubstatus) March 28, 2015
© Samuel Wade for China Digital Times (CDT), get_post_time('Y'). |
Permalink |
No comment |
Add to
Post tags: Cyberspace Administration of China, Great Firewall, hacking, Internet censorship, Internet control
Download Tools to Circumvent the Great Firewall
Now it appears that China has dropped the charade. "This is the first time we've seen an explicit acknowledgement of the existence of China's secretive cyber-warfare forces from the Chinese side," says Joe McReynolds, who researches the country's network warfare strategy, doctrine, and capabilities at the Center for Intelligence Research and Analysis.
[…] "It means that the Chinese have discarded their fig leaf of quasi-plausible deniability," McReynolds said. "As recently as 2013, official PLA [People's Liberation Army] publications have issued blanket denials such as, 'The Chinese military has never supported any hacker attack or hacking activities.' They can't make that claim anymore."
[…] "When asked, the Chinese as recently as a month ago denied they had a cyber command," James Lewis, a senior fellow at the Center for Strategic Studies and a leading expert on China's cyber capabilities, told The Daily Beast. Lewis said that the new revelations won't come as "earth-shattering" to analysts and experts who closely follow statements by Chinese officials, because "we all assumed they were lying." […][Source]
The Daily Beast report continues to quote McReynolds on the division of cyber forces into military, civilian, and nongovernmental operational units.
Last week, CNN reported statements made in a speech by former NSA director Mike McConnell on the breadth and potential implications of Chinese industrial cyberespionage:
"The Chinese have penetrated every major corporation of any consequence in the United States and taken information," he said. "We've never, ever not found Chinese malware."
He said the malware lets Chinese spies extract information whenever they want. McConnell, who also led the NSA from 1992 until 1996, continues to investigate hacks as a high-ranking adviser to Booz Allen Hamilton (BAH).
[…] McConnell listed what the Chinese are stealing: "planning information for advanced concepts, windmills, automobiles, airplanes, space ships, manufacturing design, software."
"If they can take that, before we can take it to market – for free – and it's unchecked for 15, 20 years, I would say that has strategic consequences for the United States," he said. [Source]
CNN does note that other intelligence professionals are skeptical of McConnell's statements.
Read more about hacking, cyberespionage, or industrial espionage via CDT.
© josh rudolph for China Digital Times (CDT), get_post_time('Y'). |
Permalink |
No comment |
Add to
Post tags: cyberespionage, cybersecurity, economic espionage, hacking, Internet surveillance, military, People's Liberation Army, trade secrets, United States
Download Tools to Circumvent the Great Firewall
The attack appears to follow a pattern of thefts of medical data by foreigners seeking a pathway into the personal lives and computers of a select group – defense contractors, government workers and others, according to a U.S. government official familiar with a more than year-long investigation into the evidence of a broader campaign.
[…] In the past year, Chinese-sponsored hackers have taken prescription drug and health records and other information that could be used to create profiles of possible spy targets, according to Adam Meyers, vice president of intelligence at Crowdstrike, an Irvine, Califorinia-based cybersecurity firm. He declined to name any of the companies affected.
[…] Meyers said the breach fits the pattern of a hacking unit that Crowdstrike calls Deep Panda, which over the last several months has targeted both defense contractors and the health care industry. China appears to be putting together huge databases of individuals who might be intelligence targets, he said. Another example was the theft last year from a government agency of data on tens of thousands of employees who had applied for top-secret clearances, he said. [Source]
Crowdstrike's Shawn Henry told Bloomberg in a video interview that the usual suspect in a case of this kind would be a criminal organization, but that having looked "at some of the tactics and techniques that were utilized […] we believe that there is a degree of confidence that China is involved."
At The Intercept, meanwhile, Glenn Greenwald reports that even as Western governments condemn cyberattacks, their intelligence agencies are "riding on the coattails of hackers" by capturing and mining the information they obtain. China is not named as a target of this hacker-hacking, but a list of material gathered suggests a strong possibility.
The hackers targeted a wide range of diplomatic corps, human rights and democracy activists and even journalists:
INTOLERANT traffic is very organized. Each event is labeled to identify and categorize victims. Cyber attacks commonly apply descriptors to each victim – it helps herd victims and track which attacks succeed and which fail. Victim categories make INTOLERANT interesting:
A = Indian Diplomatic & Indian Navy
B = Central Asian diplomatic
C = Chinese Human Rights Defenders
D = Tibetan Pro-Democracy Personalities
E = Uighur Activists
F = European Special Rep to Afghanistan and Indian photo-journalism
G = Tibetan Government in Exile
In those cases, the NSA and its partner agencies in the United Kingdom and Canada were unable to determine the identity of the hackers who collected the data, but suspect a state sponsor "based on the level of sophistication and the victim set." [Source]
Read more on hacking and the regular exchange of accusations between China and the U.S. via CDT.
© Samuel Wade for China Digital Times (CDT), get_post_time('Y'). |
Permalink |
No comment |
Add to
Post tags: cyberattacks, cyberespionage, cybersecurity, espionage, hacking, health care, United States
Download Tools to Circumvent the Great Firewall
"Attachment can lead you to all sort of trouble and we Buddhists believe that non-attachment alone can lead you to happiness," 30-year-old monk Jamyang Palden told The Associated Press at a cafe in the Indian hill town of Dharamsala, before giving the philosophy its Information Age twist: "We have to learn to be suspicious of email attachments."
The Internet safety slogan, one of several messages championed by digital security group Tibet Action Institute, is an example of how human rights defenders are seeking creative ways to protect activists from electronic espionage.
"It's cheesy, but it's memorable," said Freya Putt, a Vancouver-based activist.
There's little doubt that groups like Tibet Action need protection. A major study published Tuesday by Internet watchdog Citizen Lab shows that it and other civil society organizations have been penetrated by cyberspies, many of them linked to China. And the report says that those behind the compromises are the same hackers responsible for high-profile attacks on major multinationals and Western governments.
"They're using the same weaponry, the same arsenal — indiscriminately," said Citizen Lab director Ronald Deibert. […] [Source]
Dharamsala-based Tibetans and exiled Uyghur groups have been frequent targets of state-sponsored Chinese hacking attacks, and exiled Tibetan government-in-exile leader Lobsang Sangay has previously employed the Buddhist doctrine of non-attachment in describing his efforts to remain digitally secure.
Amid a crackdown on civil society organizations in China, international human rights organizations urged U.S. President Barack Obama to pressure Beijing during his ongoing trip to China.
For more on exiled Tibetans, China's Tibetan community, or cyberespionage, see prior CDT coverage.
© josh rudolph for China Digital Times (CDT), get_post_time('Y'). |
Permalink |
No comment |
Add to
Post tags: Buddhism, cyberespionage, cybersecurity, hacking, Tibet, Tibet Internet, tibetan buddhism, Tibetans
Download Tools to Circumvent the Great Firewall
China's internet tsar has lashed out at US cyber hacking allegations against his country, saying it was in fact the "world's largest victim" of the practice.
[…] "There are some who accuse China of hacking, and here I must stress that we do not permit hacking of others' networks to attain information," said Mr Lu, adding: "China is the world's main victim of cyber hacking." [Source]
Nevertheless, Lu told the audience that Sino-American talks on cyber security cooperation had not stalled as previously reported. From Reuters' Gerry Shih:
Lu Wei, head of the State Internet Information Office, condemned the use of "superior technology to attack or steal secrets". But he described U.S.-China dialogue on cybersecurity as "unhindered", less than a week after the talks appeared to have stalled.
Chinese state councillor Yang Jiechi told U.S. Secretary of State John Kerry this month that resuming cybersecurity cooperation between China and the United State would be difficult because of "mistaken U.S. practices".
Speaking to reporters at a Beijing news conference on Thursday to publicize an Internet conference, Lu said the two countries had "differences but also commonalities", and he hoped they could find common ground. [Source]
The latest hacking accusations against China involve a group of allegedly government-backed hackers dubbed "Axiom" that is said to target foreign companies, government agencies, and dissidents both inside and outside China. Ellen Nakashima at Washington Post reports:
In a report to be issued Tuesday, the researchers said Axiom is going after intelligence benefiting Chinese domestic and international policies — an across-the-waterfront approach that combines commercial cyberespionage, foreign intelligence and counterintelligence with the monitoring of dissidents.
Axiom's work, the FBI said in an industry alert this month, is more sophisticated than that of Unit 61398, a People's Liberation Army hacker unit that was highlighted in a report last year. Five of the unit's members were indicted this year by a U.S. grand jury. The researchers concur with the FBI's conclusion, noting that, unlike Unit 61398, Axiom is focused on spying on dissidents as well as on industrial espionage and theft of intellectual property.
"Axiom's activities appear to be supported by a nation state to steal trade secrets and to target dissidents, pro-democracy organizations and governments," said Peter LaMontagne, chief executive of Novetta Solutions, a Northern Virginia cybersecurity firm that heads the coalition. "These are the most sophisticated cyberespionage tactics we've seen out of China." [Source]
At Bloomberg News, Chris Strohm and Michael Riley report that a number of private sector firms in the US are now forming coalitions to combat Chinese hacking assaults in new and innovative ways:
A coalition of technology companies says it has disrupted a hacking campaign linked to Chinese intelligence, demonstrating for the first time a private-sector model that they believe can move faster than investigations by law enforcement agencies.
[…] The take-down largely bypassed traditional law enforcement tools, relying instead on cooperation between companies that are normally fierce competitors. Coalition members — which include Microsoft Corp. (MSFT), Cisco Inc. (CSCO) and Symantec Corp. (SYMC) — say they can act faster than governments because they operate global Internet systems and have business relationships with tens of thousands of companies.
"We believe this is a first-of-its-kind effort," said Peter LaMontagne, chief executive officer of Novetta Solutions LLC, a cybersecurity company based in McLean, Virginia, that is part of the coalition. "The security industry is starting to raise the bar, or hopefully forcing hostile actors to have to spend more of their resources" to continue attacks. [Source]
A recent study found that China and the U.S. were both implicated in thousands of attacks on a "honeypot" decoy computer.
© cindyliuwenxin for China Digital Times (CDT), get_post_time('Y'). |
Permalink |
No comment |
Add to
Post tags: Apple, censorship, cybersecurity, Facebook, foreign, Great Firewall, hacking, Lu Wei, state council's information office, tech companies, technology regulations
Download Tools to Circumvent the Great Firewall
"I have no information of this report yet," Chinese Foreign Ministry spokeswoman Hua Chunying said at a daily news briefing.
"China is resolutely opposed to hacker attacks in all forms and China itself is a major victim of cyber attacks," she said.
[…] The spokeswoman said "wild guesses and malicious blemish" will not help solve cyber issues. [Source]
The latter comment follows senior diplomat Yang Jiechi's admonition to Secretary of State John Kerry that "due to mistaken U.S. practices, it is difficult at this juncture to resume Sino-U.S. cyber security dialogue and cooperation." Last week, People's Daily Online accused the U.S. of using "gimmicks" to demonize China on cybersecurity:
The documents leaked by Edward Snowden show that US National Security agency has tried to gain access to sensitive data in the global communications industry. The documents describe a range of clandestine field activities that are among the agency's "core secrets" when it comes to computer network attacks. This clearly reveals the true colors of the US for all its posturing as the world's policeman.
[…] China defends its cyberspace security resolutely. The Chinese government and military have never launched any cyber attacks. Confronted with threats of internet attack, China remains committed to combating cyberspace crime. The US can smear China all it wants; it will not succeed in erasing its image as a network attacker. [Source]
But many security experts agreed with GreatFire.org's conclusion that Chinese authorities are strongly implicated in the iCloud attack. From Paul Mozur, Nicole Perlroth And Brian X. Chen at The New York Times:
"All signs point to the Chinese government's involvement," said Michael Sutton, vice president for threat research at Zscaler, a San Jose, Calif., security company. "Evidence suggests this attack originated in the core backbone of the Chinese Internet and would be hard to pull off if it was not done by a central authority like the Chinese government."
The targeting of Yahoo, Google and Apple also potentially reveals a new Chinese government effort to adapt to initiatives by Internet companies — most notably new encryption techniques — to protect user data from government spying.
"The Chinese government could no longer sniff traffic, so they intercepted that traffic between the browser and the iCloud server," Mr. Sutton said.
[…] "As more sites move to encryption by default — which prevents the censorship authorities from selectively blocking access to content — the Chinese authorities will grow increasingly frustrated with their ability to censor that content," said [a] GreatFire spokesman. [Source]
Others quoted by the BBC and The Wall Street Journal agreed, though the consensus was not quite complete. From Scott Thurm:
[… S]ome security analysts raised skepticism that Beijing, with sizable resources at its disposal, would order an attack that is so easily detected.
"This doesn't seem like the sort of attack an adversary with the resources of a government would attempt, since connecting users would see a very obvious security warning from their browser. It's more likely the sort of attack you'd see from someone with limited resources," said Kevin Milner, a researcher working on Internet infrastructure security at Oxford University. [Source]
The Intercept's Morgan Marquis-Boire suggested to Motherboard that the attack's extreme bluntness could be a deliberate message.
Without specifically referring to China or the GreatFire.org report, Apple published a new support document on verifying browser connections to iCloud.com. "Apple is deeply committed to protecting our customers' privacy and security," it said. "We're aware of intermittent organized network attacks using insecure certificates to obtain user information, and we take this very seriously. These attacks don't compromise iCloud servers, and they don't impact iCloud sign in on iOS devices or Macs running OS X Yosemite using the Safari browser."
© Samuel Wade for China Digital Times (CDT), get_post_time('Y'). |
Permalink |
No comment |
Add to
Post tags: Apple, cybersecurity, digital security, encryption, hacking, United States, Yang Jiechi
Download Tools to Circumvent the Great Firewall