9 ms·
Cyber Sleuths Track Hacker to China’s Military
- dogma1138 11y agoGoogle redirect: https://www.google.co.uk/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&ved=0CCIQqQIwAGoVChMI9pbzr-mPyAIVCG0UCh0eFwMP&url=http%3A%2F%2Fwww.wsj.com%2Farticles%2Fcyber-sleuths-track-hacker-to-chinas-military-1443042030&usg=AFQjCNGl6ZyioiIvQYcBbJMX5V7yj_Wnng&sig2=JvBSU8a9c6Gs9U6_-FwmFw https://www.google.co.uk/url?sa=t&rct=j&q=&esrc=s&source=web...
- jstanley 11y agoStill paywalled for me, even following that link.
- dogma1138 11y agotry opening it in a private tab, Google tracking cookies seem to break it for some reason.
- throwaway_97 11y agoThanks, don't know why but opening it in incognito mode broke the signup-wall
- stephengillie 11y agoSorry to tangent the tangent, but will we ever see adblockers hunted down the way torrenters were? The net effect is the same, but the scope (news articles) is much smaller.
- ionised 11y agoPossibly. If we do we will also see it to be equally as futile as trying to stop torrenters.
- deleted 11y ago[deleted]
- spuiszis 11y agoCopy and paste the article title into a Google Search and click the article link in the search results.
- at-fates-hands 11y agoIf you get the paywall, I'd advise downloading the actual report from ThreatConnect it's far more detailed: http://www.threatconnect.com/camerashy/ http://www.threatconnect.com/camerashy/
- striking 11y agoAnd if you want to get past the paywall, Google the link and open it from the search results.
- billyhoffman 11y agoWhy do companies, security companies even, do something like this... " Below are the document checksums for Project_CAMERASHY_ThreatConnect_Copyright_2015.pdf MD5: b12f118840d0aa0d5ab2fb9aa052ede3 SHA1: dbd710751a6c32ba91401fb5e5623f46b4d2475f SHA256: da6b105f1e58f860ce67b2ad2db7b15ff7b637cfb37f7d0680a20eb633bcc741" ... when you are then providing both the PDF, and the list of its supposed hashes, over an unencrypted connection! It renders it meaningless. I can't trust those hashes or that document. And creating megabyte long PDFs with colliding MD5 hashes is not even a difficult challenge anymore. The irony here is this page is say "hey open this document, it's safe, trust us" when the document is all about APT attack methods, which often involve compromising people's computers by opening untrustworthy documents! I doubt that's what's happening here, but still kind of silly when you think about it. Please, all the companies out there. Stop adding a list of hashes to appear more legitimate when you clearly don't know what you are doing.
- mizzao 11y ago> creating megabyte long PDFs with colliding MD5 hashes is not even a difficult challenge anymore. Source, please? Suppose the hashes and PDF were provided over HTTPS. How would it be easy to create another document that collided with all 3 hashes? Not trying to be facetious - just wondering.
- billyhoffman 11y agoahhh. Was mixing pre-image attacks with collision attacks in MD5. so ignore that. If its not over HTTPS, it doesn't matter there are 3 hashes. I change the doc. I generate the 3 hashes for my changed doc. I can serve those new hash values.
- antsar 11y agoWithout having read the full PDF report [0], the summarized version [1] makes the allegations seem quite weak. It comes down, seemingly, to the fact that a PLA domain name appears in the malware. Maybe I'm missing something. [0] http://cdn2.hubspot.net/hubfs/454298/Project_CAMERASHY_ThreatConnect_Copyright_2015.pdf http://cdn2.hubspot.net/hubfs/454298/Project_CAMERASHY_Threa... [1] http://www.threatconnect.com/camerashy-resources/ http://www.threatconnect.com/camerashy-resources/
- huac 11y agoLooks like PLA domain shares name with probable PLA employee social media handle. And the social media accounts were deleted immediately after the WSJ called the guy. It seems pretty likely there is some PLA connection, though not necessarily to this particular guy - no way of knowing that a buddy didn't steal his handle for use elsewhere (seriously, not sharing the same hacking handle and the same personal username should be Tradecraft 101)
- late2part 11y agoI wonder if China online newspapers have stories about tracking hackers to USA's military?
- halviti 11y agohttp://finance.qq.com/a/20130624/011309.htm http://finance.qq.com/a/20130624/011309.htm
- kposehn 11y agoI think it is very important to understand that the timing of this report is likely no coincidence. With Xi set to have discussions today with Obama, this is effectively a slap across the face to Xi right before an important visit that he can't back out of, and effectively puts china on a lower footing by showing them to be lying directly to the US about their intentions. Edit: this isn't to say publication/announcement was done at the administration's request, simply that the timing is extremely suspect. Other interests also want to see Xi brought down a few pegs. Politics :-/
- aNoob7000 11y agoI think Xi meeting with Silicon Valley business executives before meeting with Obama wasn't any better.
- pasbesoin 11y agoI have no doubt there is significant espionage going on. What the last some years have done, however, is to make me rather distrusting of both sides. I may be in the minority. But a democracy is in significant trouble when its own population no longer trusts and believes it, in the large. The leadership either turns increasingly autocratic, or it loses its power. The t-word wins again. The lies told ostensibly because t-word, are proving to be far worse than the original risk of t-word. And instead of effective oversight to harden our own systems, we have blindness, lack of accountability, and scapegoating. It's not just the data collection that makes me distrust the Feds. It's its gross mis-management, abuse, and the insistence that I can't know what is going on. So, pump out your stories about the Chinese. Many of you politicians sold us down the river, in that regard, years ago.
- bsder 11y ago> But a democracy is in significant trouble when its own population no longer trusts and believes it, in the large. Actually, democracy is safest when the people distrust it. The real problem is that we have far too many people who are either completely trusting or totally inert.
- mc32 11y ago
- webXL 11y ago"Grassroots" hacking isn't a good strategy for a state that wants to cover up its tracks. So I'm suspicious of these claims. Perhaps the government makes it worth the hackers' while to hack the USG instead of it. Just sad that so many intelligent people would rather be powerful/wealthy than free (not that the USG is a shining example of that sentiment).
- tellthetruth1 11y agoYou are Not free if you are poor and powerless!
- webXL 11y agoI'm not sure I understand your point. What does material possession and power (I assume over others) have to do with freedom? These hackers have power (their ability to obtain government data and subvert its power) and the Chinese government is perhaps wisely channeling it to its foreign adversaries.
- deleted 11y ago[deleted]
- mladenkovacevic 11y agoWSJ, CNN, Fortune all lining up this latest PR story line right on cue. It's embarrassing to see the flailing of the US intelligence apparatus trying to take attention away from their own abuses of power.
- jessaustin 11y agoIf USA journalists had any self-respect remaining, it would be embarrassing to see the agencies' puppet hand run up the media's ass like this.
- sandworm101 11y agoHaving read many of these reports over the years, this one seems more manifesto than security report. It is full of carefully controlled language meant to appease a very specific audience: politicians and members of various agencies. A huge amount of space is dedicated to tenuous ties between physical military activities and espionage on the assumption that all chinese agencies are coordinating with each other, that the Chinese are just better at conspiracy than any US operation. No actual intelligence officer would ever describe China in that way. It's a patchwork of poorly-connected operations all trying to put on a good show for the bosses, much the same as US intelligence agencies. Certain key phrases suggest political motive. As example, the phrase "China’s ... military grade signals intelligence Unit" caught my ear. "Military grade" doesn't mean much in infosec. It does mean something to lifelong service members who labour under the assumption that military structures just do things better than civilian organizations. In some fields "military grade" is actually a bad thing, a reference to products built to conform to rarely-updated procurement standards. It's like still selling floppy disks because the computer on the stealth bombers haven't been updated in 20 years. The phrase appears right at the start of the takeaways section, right where most senior officials will probably start reading. The drilling down upon a few people, to the point of tracking a man's movements and finding the bike he offered for sale, certainly plays into current US national security desires. Targeted killings based on poor intel is a big chip on the military shoulder these days. They aren't happy about it. So peppering a document with a few grains of seemingly accurate and specific intel about individuals is a good trick to win people over. The excessive reliance on google maps is just eyecandy. This gives the false impression of validity, a false suggestion that the rest of the report is based on equally detailed and reliable intel. if this were such intel, it wouldn't be released publicly. the pdf: http://cdn2.hubspot.net/hubfs/454298/Project_CAMERASHY_ThreatConnect_Copyright_2015.pdf http://cdn2.hubspot.net/hubfs/454298/Project_CAMERASHY_Threa...
- jgome 11y agoIt's as if China was the universal scapegoat for infosec people in the US... Wait, this is a known fact in infosec circles.
- 11y ago
- ChrisArchitect 11y agoCyber Sleuths cyberespionage cyberwarriors cyberspace cybersecurity cyberintrusions cybertheft cyberspying cyber operations
- pastycrinkles 11y agoYou forgot about the cyber military!
- jkrejci 11y agoChina is fucking shady.
- ldpg 11y agoThis sentiment is heard too often. It comes more from xenophobia and propaganda than from reality. In reality China is about as duplicitous as we are.
- godgod 11y agoChinese President is a liar: http://www.reuters.com/article/2015/09/22/us-usa-china-xi-cybersecurity-idUSKCN0RM08Q20150922 http://www.reuters.com/article/2015/09/22/us-usa-china-xi-cy...
- astaroth360 11y agoI mean isn't it already widely accepted that China has one of the world's largest and most active cyber warfare forces? When is the US going to get its shit together and start worrying about cyberdefenses?
- jgome 11y ago>I mean isn't it already widely accepted that China has one of the world's largest and most active cyber warfare forces? Do they? I thought the largest "cyber warfare force" (gotta love these buzzwords) was the NSA, and the US govt itself. The US practically controls the internet...
- astaroth360 11y agoWell yes, I imagine the US force dwarfs most others, however that doesn't change my being worried about China's activities. The whole world needs to start making protection of user data (private sphere) and citizen data (public sphere) a priority. Until that happens, there will continue to be massive hacks of sensitive data that end up hurting very large numbers of people. It's well past time that the world as a whole started taking the issue of cyber security seriously.
- w8rbt 11y agoOne of the most difficult aspects of cyber security is attribution. There's really no way to know for certain who did what. Also, it's easy and convenient (right now) for other nations to blame China as cover for their own cyber intrusions. Compromise a few systems in China, launch attacks from them then sit back and watch while others place blame.
- CDokolas 11y agoMore like "Chinese military cyber-warrior doxed by the WSJ." Bad guy or good guy, what I worry about is that man's fate... if he hasn't met it already :(