8 ms·

Before It Was Hacked, Equifax Had a Different Fear: Chinese Spying

145 points by propman 8y ago

creaghpatr 8y ago
I wonder if this has to do with Jack Ma stepping down?
- beauzero 8y ago
  Curious...can you elaborate?
  - kevin_thibedeau 8y ago
    It is very suspicious that someone as motivated as Ma would just up and quit on his baby at such a young age. It is not outside the realm of possibility that he stepped over a party line and is being forced to retire as punishment.
    - azurezyq 8y ago
      Ha, you may need to read more about him. Jack has been doing hand-overs for a long period (longer than 5 years actually). The personality of him is more close to Larry Page rather than Elon Musk. He seems to like doing less ground-crunching management, focusing on long-term visionary things. And for the last few years he even not spoke often publicly for Alibaba and his social media account is full of NGO activities. Maybe it's just time for a new journey. Also Jack IS the god in Alibaba forever, no one can really change that.
      - creaghpatr 8y ago
        In fact, I have read his book. I'm not suggesting he is a part of some conspiracy. But it would be irresponsible to not notice one of the top 10 biggest CEOs of recent history stepping down at a noticeably young age within a week of one of his cornerstone companies being implicated in a breach of one of the largest owners of American financial data. >Also Jack IS the god in Alibaba forever, no one can really change that. Cmon, man.
394549 8y ago
Paywall bypass: http://archive.is/Visq4 http://archive.is/Visq4
- mk926 8y ago
  thanks
jstarfish 8y ago
The article is about Equifax, but based on the histories and subsequent employment of other suspect individuals they are far from the only target. Any FI or related should be concerned. The common goal seems to be to get their foot in the door within a subset of 3-5 American financial verticals (the "b-b-but I just work in marketing!" excuse as an obscenely common insider position that doesn't attract any scrutiny at all, unlike someone working in engineering or R&D. Seriously-- you want to find the spies in your company? Start with marketing), exfiltrate everything they can access and retreat to China for a cushy job and enjoyment of immunity against extradition. By the time the target catches on and law enforcement gets spun up, they've already finished their tour of duty with two to three other companies and are on a plane halfway across the Pacific. It's hard to do anything about it without either implementing literal racist policies or comprehensively overhauling an entire industry's security posture, but it is what it is.
- opportune 8y ago
  Special treatment against specific nations isn’t necessarily racist (depends on motives). I don’t think treating Chinese immigrants differently wrt private business information is racist, as long as the same rules don't apply to ethnically Chinese US citizens
  - qiqing 8y ago
    What about ethnically Chinese Canadian citizens in its Toronto office? It sounds a lot like the rules did apply to US citizens.
  - z2 8y ago
    Practically, how do you see this working? I get it that very senior management could work with HR on information/promotion discrimination. But do you expect the rest of the company to have discretion in executing information security when so much information flows freely inside divisions? By seeing who has the thickest accents? Or perhaps people could wear bands on their shoulders? Why stop there--maybe we can mandate it in the public sphere too. I don't mean to be sarcastic or insensitive, but motives and intentions can be blurry.
bmurray7jhu 8y ago
Some have suspected that a state actor may have been behind the breach, given the sophistication of the attack and the lack of reporting about fraudsters using the stolen data. https://www.bloomberg.com/news/features/2017-09-29/the-equifax-hack-has-all-the-hallmarks-of-state-sponsored-pros https://www.bloomberg.com/news/features/2017-09-29/the-equif...
chris_wot 8y ago
Didn't seem to make them tighten their security any.
- bdamm 8y ago
  Exactly; seems like they fell prey to a sort of decision paralysis (perhaps due to revenue lost in implementing protection). A lot of companies are having this problem. Regulation is inevitable & required.
- howard941 8y ago
  Its earlier fear was for _its own data_, where it had skin in the game: "Investigators from the company and the FBI came to view events at Equifax as potentially a huge theft of data—not of consumers’ personal data, as happened with the subsequent 2017 hacking of Equifax’s files, but of confidential business information." Loss of info it collected on the rest of us is no skin off its nose and falls under the Don't Care category.
- smolder 8y ago
  I understand that they hired some people to improve security. They didn't immediately overhaul everything, but how could you? You can't replace a whole organization at once. There's a lot of institutional knowledge and things in motion even at dysfunctional ones.
- rdtsc 8y ago
  I even think they are using it as an excuse: "We were so busy fighting off the Chinese it prevented us keep your data safe".
jacquesm 8y ago
The same goes for every other company in that line of business, in the US as well as in Europe. The data in their databases has immense value for state actors and allows them to help identify those that could be easily compromised.
wemdyjreichert 8y ago
Wow. China holding over 1mm Muslims in "re-education" camps, forcing them to eat pork and drink alcohol. China steals everyone's IP and knocks it off. China bullies the Philippines, a relatively poor country, out of some natural resources that might actually help it. Now China tries to steal the information of hundreds of millions of Americans. And today, the US proposed trade talks with China, rolling over for its money. Economic pressure stopped the Soviet Union, and we should try it on China too. Money is the only safe method of pressuring China into ending it's atrocities. We should use it.
- dis-sys 8y ago
  > Money is the only safe method of pressuring China into ending it's atrocities. We should use it. surely your congress can double the debt ceiling to borrow another 22 trillion USD. http://www.usdebtclock.org/ http://www.usdebtclock.org/
bryanrasmussen 8y ago
I guess they must have had really good security protocols in place if they were worried about being hacked by state actors.

145 points by propman 8y ago

creaghpatr 8y ago

I wonder if this has to do with Jack Ma stepping down?

beauzero 8y ago
Curious...can you elaborate?
- kevin_thibedeau 8y ago
  It is very suspicious that someone as motivated as Ma would just up and quit on his baby at such a young age. It is not outside the realm of possibility that he stepped over a party line and is being forced to retire as punishment.
  - azurezyq 8y ago
    Ha, you may need to read more about him. Jack has been doing hand-overs for a long period (longer than 5 years actually). The personality of him is more close to Larry Page rather than Elon Musk. He seems to like doing less ground-crunching management, focusing on long-term visionary things. And for the last few years he even not spoke often publicly for Alibaba and his social media account is full of NGO activities. Maybe it's just time for a new journey. Also Jack IS the god in Alibaba forever, no one can really change that.
    - creaghpatr 8y ago
      In fact, I have read his book. I'm not suggesting he is a part of some conspiracy. But it would be irresponsible to not notice one of the top 10 biggest CEOs of recent history stepping down at a noticeably young age within a week of one of his cornerstone companies being implicated in a breach of one of the largest owners of American financial data. >Also Jack IS the god in Alibaba forever, no one can really change that. Cmon, man.

394549 8y ago

Paywall bypass: http://archive.is/Visq4 http://archive.is/Visq4

mk926 8y ago
thanks

jstarfish 8y ago

The article is about Equifax, but based on the histories and subsequent employment of other suspect individuals they are far from the only target. Any FI or related should be concerned. The common goal seems to be to get their foot in the door within a subset of 3-5 American financial verticals (the "b-b-but I just work in marketing!" excuse as an obscenely common insider position that doesn't attract any scrutiny at all, unlike someone working in engineering or R&D. Seriously-- you want to find the spies in your company? Start with marketing), exfiltrate everything they can access and retreat to China for a cushy job and enjoyment of immunity against extradition. By the time the target catches on and law enforcement gets spun up, they've already finished their tour of duty with two to three other companies and are on a plane halfway across the Pacific. It's hard to do anything about it without either implementing literal racist policies or comprehensively overhauling an entire industry's security posture, but it is what it is.

opportune 8y ago
Special treatment against specific nations isn’t necessarily racist (depends on motives). I don’t think treating Chinese immigrants differently wrt private business information is racist, as long as the same rules don't apply to ethnically Chinese US citizens
- qiqing 8y ago
  What about ethnically Chinese Canadian citizens in its Toronto office? It sounds a lot like the rules did apply to US citizens.
- z2 8y ago
  Practically, how do you see this working? I get it that very senior management could work with HR on information/promotion discrimination. But do you expect the rest of the company to have discretion in executing information security when so much information flows freely inside divisions? By seeing who has the thickest accents? Or perhaps people could wear bands on their shoulders? Why stop there--maybe we can mandate it in the public sphere too. I don't mean to be sarcastic or insensitive, but motives and intentions can be blurry.

bmurray7jhu 8y ago

Some have suspected that a state actor may have been behind the breach, given the sophistication of the attack and the lack of reporting about fraudsters using the stolen data. https://www.bloomberg.com/news/features/2017-09-29/the-equifax-hack-has-all-the-hallmarks-of-state-sponsored-pros https://www.bloomberg.com/news/features/2017-09-29/the-equif...

chris_wot 8y ago

Didn't seem to make them tighten their security any.

bdamm 8y ago
Exactly; seems like they fell prey to a sort of decision paralysis (perhaps due to revenue lost in implementing protection). A lot of companies are having this problem. Regulation is inevitable & required.
howard941 8y ago
Its earlier fear was for _its own data_, where it had skin in the game: "Investigators from the company and the FBI came to view events at Equifax as potentially a huge theft of data—not of consumers’ personal data, as happened with the subsequent 2017 hacking of Equifax’s files, but of confidential business information." Loss of info it collected on the rest of us is no skin off its nose and falls under the Don't Care category.
smolder 8y ago
I understand that they hired some people to improve security. They didn't immediately overhaul everything, but how could you? You can't replace a whole organization at once. There's a lot of institutional knowledge and things in motion even at dysfunctional ones.
rdtsc 8y ago
I even think they are using it as an excuse: "We were so busy fighting off the Chinese it prevented us keep your data safe".

jacquesm 8y ago

The same goes for every other company in that line of business, in the US as well as in Europe. The data in their databases has immense value for state actors and allows them to help identify those that could be easily compromised.

wemdyjreichert 8y ago

Wow. China holding over 1mm Muslims in "re-education" camps, forcing them to eat pork and drink alcohol. China steals everyone's IP and knocks it off. China bullies the Philippines, a relatively poor country, out of some natural resources that might actually help it. Now China tries to steal the information of hundreds of millions of Americans. And today, the US proposed trade talks with China, rolling over for its money. Economic pressure stopped the Soviet Union, and we should try it on China too. Money is the only safe method of pressuring China into ending it's atrocities. We should use it.

dis-sys 8y ago
> Money is the only safe method of pressuring China into ending it's atrocities. We should use it. surely your congress can double the debt ceiling to borrow another 22 trillion USD. http://www.usdebtclock.org/ http://www.usdebtclock.org/

bryanrasmussen 8y ago

I guess they must have had really good security protocols in place if they were worried about being hacked by state actors.