14 ms·

Marriott Data Breach Traced to Chinese Hackers, US Readies Crackdown on Beijing

195 points by jumelles 8y ago

stcredzero 8y ago
Given the long history of nation-states engaging in false flag premises for both diplomacy and "diplomacy by other means," how much scrutiny should we give to nation-states claims of hacking? How easy or hard is it to fake such claims? I should think it's much easier to fake than hiding nuclear weapons or instances of armed violence.
- NegativeLatency 8y ago
  Could’ve contracted it out too. It’s not necessarily the Chinese State, could’ve been freelancers hired by someone else.
- mc32 8y ago
  People do this all the time when they don't want to believe. At one point people didn't want to believe North Korea was the perpetrator of the Sony Hack, for political reasons, but then for other political reasons people were sure it was North Korea. Just like the email hacks --people tend to believe or not believe depending a lot on their ideology and how it aligns with them, unfortunately.
  - colordrops 8y ago
    Typically these situations where belief follows political lines are an indicator that there isn't strong evidence to support either interpretation.
  - netsharc 8y ago
    I also wanted to mention the Sony hack, and on the Wikipedia page there's a section quoting experts who doubted that it was them who did it. Associating this with sanctions against Chinese networking companies makes me think that it's just too convenient of an excuse.
    - lawnchair_larry 8y ago
      Those "experts" were not experts in attribution, and the consensus is that they were wrong. One is from Norse, a widely discredited and now defunct security firm, ironically infamous for their false attributions. Two are journalists. Enough said. One is Seth Rogen the actor. Enough said. One is Sabu from LulzSec, a script kid turned FBI snitch, who is way out of his league commenting on this. One is Marc Rogers, who I don't know personally, but I doubt he maintains his skepticism today. In any case, a security expert to be certain, but not an expert in attribution and not privy to the evidence (only some of which has ever been made public). Worth noting that he published followup blog posts to the wikipedia-linked citation that walked back his skepticism quite a bit (http://marcrogers.org/2015/01/24/wrapping-up-the-whole-sony-thing-for-now/ http://marcrogers.org/2015/01/24/wrapping-up-the-whole-sony-... - "In my eyes, the preponderance of evidence definitely suggests North Korean involvement or someone trying very hard to make it look like North Korean involvement."). He basically settled on it being plausible, but concerning, and acknowledged that he wasn't privy to the evidence.
  - stcredzero 8y ago
    People do this all the time when they don't want to believe. I'm fine with the prospect of China hacking the US. It fits in just fine with my world view. However, there's also the sinking of the Maine, the Gulf of Tonkin incident, and Iraqi WMD. Skepticism is called for.
    - mc32 8y ago
      That skepticism is earned indeed. But despite that people will believe something along these lines (WMD[1], Sony Hack, Russia, etc.) if it aligns with their political view. And if it doesn't then they're even more skeptical than is healthy. [1]Although to be fair, Saddam _wanted_ his neighbors to believe he had WMDs. It was a sort of a reverse 'boy who cried wolf' and then not wanting to lose face kept playing games (which fooled many to believe more than they should have with flimsy independent evidence that he had WMDs (including many in the opposition parties).
      - freeflight 8y ago
        To be fair: Even the responsible UN weapons inspector, Scott Ritter [0] quite bluntly stated there was no evidence at all for the Iraqi WMD program. Not that anybody in the Bush administration would have cared, everybody there was well aware of this fact, that's also the reason why they tried to play up the fictitious "Saddam al-Qaeda" link [1] for a while and why the whole WMD thing just became a joke to them a mere year after the invasion [2]. [0] https://en.wikipedia.org/wiki/Scott_Ritter https://en.wikipedia.org/wiki/Scott_Ritter [1] https://en.wikipedia.org/wiki/Saddam_Hussein_and_al-Qaeda_link_allegations https://en.wikipedia.org/wiki/Saddam_Hussein_and_al-Qaeda_li... [2] https://www.youtube.com/watch?v=O35NA6TywAg https://www.youtube.com/watch?v=O35NA6TywAg
        mc32 8y ago
        That whole thing was a fiasco and a stupid mistake or undertaking. It really was a terrible thing to do (there was reason to unseat Saddam, but not at the cost it would take). However, it would be a mistake to think this was only a Bush thing. This was broadly bipartisan in the US. It was neoliberal politics and war hawks who thought they could shape the world in their neoliberal view. With the Soviets out of the way, they thought they could help make the rest of the world more like western democracies (obvs through force if necessary) We saw a continuation with the Arab spring enthusiasm which turned horribly wrong as well.
  - freeflight 8y ago
    > People do this all the time when they don't want to believe. People do this all the time because people working in the sector know [0] that attribution, with anything "cyber", is near impossible, if the attackers know what they are doing it actually is impossible. As such most attribution usually boils down to guessing games based on code samples and used attack vectors but rarely, if ever, on anything actually solid. [0] https://www.schneier.com/blog/archives/2015/01/attack_attribut.html https://www.schneier.com/blog/archives/2015/01/attack_attrib...
    - mc32 8y ago
      Right but on the other hand, with the same hedges people _will_ believe something despite all these qualifications that something was done by someone if it aligns with their politics to believe it.
      - freeflight 8y ago
        Accusations like this shouldn't be based on "hedges", as long as they do they only serve to do exactly what you describe: Lead people down predefined conclusions. That's why it's important to point out the difficulties of attribution or else people will simply take it as they see it, without even questioning it. In that context questioning it is not "hedging" anything, it's inquiring about actual evidence, which most rational people should be asking for instead of "hedging" based on political beliefs.
        mc32 8y ago
        I agree with your take but I disagree with hedging being inappropriate here. Hedging just means using qualifications and conditions given some uncertainty in a claim.
    - lawnchair_larry 8y ago
      People do this all the time because people working in the sector know [0] that attribution, with anything "cyber", is near impossible, if the attackers know what they are doing it actually is impossible. This is wrong. Schneier has no idea what he is talking about (as usual). The funny part is that he opens with skepticism about the North Korea/Sony hack, of which many were skeptical early on, but now is not disputed by anybody. So he was wrong about that too. So very wrong. Especially this line: More likely, the culprits are random hackers who have loved to hate Sony for over a decade, or possibly a disgruntled insider. I'll be honest, I was skeptical of that one too. But I knew what I didn't know, so instead of challenging experts or trying to get my uninformed opinion out in the public sphere, I kept that to myself. And when I heard someone who I know would know make the NK claim without hesitation, it made me re-evaluate some assumptions. When it turned out that they were correct, I knew it was not a lucky guess. Attribution is not easy, but it's absolutely not impossible in all cases, or even difficult in many cases. People who understand technology make a lot of assumptions about how attribution works, and then make assertions like this. Attribution isn't simply that the bad packets came from a Chinese IP address. A good rant on the topic is here: http://www.robertmlee.org/russian-election-meddling-grizzleysteppe-and-bananas/ http://www.robertmlee.org/russian-election-meddling-grizzley...
- adventured 8y ago
  For over a year there has been widespread reporting of a surge in Chinese hacking, since the trade conflict began with the Trump Administration. Before that, the Obama Administration managed to get a brief cease fire, during which reports of Chinese hacking plunged dramatically. So what exactly was the Obama Administration getting an agreement on? China was doing it before, stopped after a publicly acknowledged agreement with the Obama Admin, and then it's so far fetched that they'd start up again during an increasingly aggressive trade war as to be worthy of false flag considerations - I don't think so. If it was China in this case, it's nothing more than par for the course for how they've been behaving for the last decade plus. It's an invaluable tool in their arsenal for dealing with the US in a variety of regards.
deleted 8y ago
[deleted]
- nerdponx 8y ago
  Nothing, China paranoia was part of the current president's election campaign.
  - wybiral 8y ago
    I didn't vote for Trump and don't support him to this day. But I still think that China has gotten away with more than they should up until this point. There is nuance to this all.
varenc 8y ago
I'd be really interested in seeing the declassified intelligence the article mentions that points the finger at Chinese-intelligence. While proving that the attackers originate in China might be easy, clearly connecting this to a government-supported operation seems quite a challenge involving long chains of reasoning. It's probably not feasible to release all the info needed to independently verify this, but we'll see. I can also imagine how this line could be blurry... perhaps the government quietly permits more profit motivated blackhat operations in exchange for some intelligence sharing. And really the perfect "cyber attack" shouldn't be attributable at all.
- n-gatedotcom 8y ago
  Replace Chinese with Russian and ask yourself if you still want to see the declassified Intel.
  - i_cant_speel 8y ago
    I'm not sure what point you are trying to make with this comment.
  - pretendscholar 8y ago
    Why wouldn't we want to see the declassified intel on Russian hacking? What does that even mean?
    - paraditedc 8y ago
      My guess is that it's a reference to Hillary Clinton losing election due to hacked emails.
  - thanatos_dem 8y ago
    Yes, I would like to see all declassified intel indicative of any foreign power performing a cyber attack on us. Is that somehow controversial?
  - cyphar 8y ago
    You should always ask for evidence for claims. A quick reminder that the US intelligence community lied to the Bush administration about WMDs in Iraq, as well as about the existence of PRISM and related programs. Trusting the intelligence community, in the absence of evidence, is hardly a reasonable standpoint. Why would it matter if the claim were Russia, China, or North Korea?
elvirs 8y ago
im noticing a trend of our government offloading its responsibility to protect us and hiding its incompetence by pointing finger at foreign nations. -elections fucked up? -russia. -corporations dont protect consumer data? -china. -drugs and gang violence? -mexico and other south american nations. -unemployment? -canada and tarrifs. come on already.
- closeparen 8y ago
  Politicians have been blaming scapegoats as long as there have been politics.
- adventured 8y ago
  Unemployment is particularly an odd one to put in there. Nobody is complaining about macro unemployment due to Canada or tariffs. Tariffs aren't causing serious problems so far. In fact pretty much every report indicates they're helping the US, with China eating the bulk of the cost up to now. US steel companies are booming for the first time in decades. Steel & aluminum tariffs are also not harming the economy yet.[1] Employment is increasingly setting records on almost everything. Check out the job demand boom on durable goods manufacturing [2]: https://i.imgur.com/CViKovj.png https://i.imgur.com/CViKovj.png [1] https://www.cnbc.com/2018/12/11/steel-and-aluminum-tariffs-are-not-hurting-the-economy-study-says.html https://www.cnbc.com/2018/12/11/steel-and-aluminum-tariffs-a... [2] https://www.bnnbloomberg.ca/u-s-factories-are-posting-job-openings-like-never-before-1.1181053 https://www.bnnbloomberg.ca/u-s-factories-are-posting-job-op...
  - elvirs 8y ago
    unemployment numbers are distorted. they count all part time jobs and gig economy signups as employment. these arent jobs, you can afford a decent life with this kind 'employment'. people working as teachers, working as salesperson at an official car dealerships, working in retail cant afford to rent an apartment and are living from shared rooms.
  - Spooky23 8y ago
    My suppliers are facing extreme pricing pressure, and most are raising prices on many commodities. I’ve had more contract performance issues in the last 6 months than in the last decade. Employment is tough to measure. Acecdotally, my employer is attracting many mid/senior level people who are good who are taking entry/journeyman level gigs. That’s usually a forward indicator of bad times ahead, in my experience. Another factor is that tariffs are mechanisms that pick winners and losers. Automated steel and aluminum mills may be booming, but in contrast I just donated to a food drive for dairy farmers in my old hometown — many of whom will be bankrupt soon. They have to choose between heating the barn or buying food. Tariffs are also destroying small and midsize farmers in grain and other commodities.
mancerayder 8y ago
But while top administration officials insist that the trade talks are proceeding on a separate track, the broader crackdown on China could undermine Mr. Trump’s ability to reach an agreement with Mr. Xi. Mr. Trump, in an interview with Reuters on Tuesday, said that he would consider intervening in the Huawei case if it would help serve national security and help get a trade deal done with China. Such a move would essentially pit Mr. Trump against his own Justice Department, which coordinated with Canada to arrest Ms. Meng as she changed planes in Vancouver. I wonder if it's because Huawei's equipment or staff played a role, or if they just want to use Meng as a bargaining chip in the demands regarding cybersecurity and IP.
- jorblumesea 8y ago
  Meng's father, Ren Zhengfei, is an ex-PLA officer and has deep connections to the CCP. Her arrest and the timing of it are not coincidences. Notice the reaction of government media outlets in China. It's a direct method of pressuring China's political elite.
  - acct1771 8y ago
    Where would an English speaker be able to do this?
- mancerayder 8y ago
  Someone downvoted me, but I'd like to point out to the genius that did that, today's FT article titled, "Trump makes Huawei CFO a bargaining chip" (FT, Dec 13, 2018) which is what I was asking.
sonnyblarney 8y ago
It'd be nice to see better real evidence this time around than the weird Bloomberg story in October about malicious chips. That story had a serious credibility problem.
- chapium 8y ago
  This has nothing to do with that.
  - sonnyblarney 8y ago
    The issues are definitely related. That the government is in the middle of one of it's biggest negotiations in history, with it's largest trading partner - and there have been twice in that last few months indications of 'Chinese government spying' - would imply that they are quite related wether we want them to be or not. The first story was bizarre and didn't seem to have credibility, making one wonder how it came to be. This story comes at an even more sensitive time, and so more clarity, more information is better. Even the arrest of the Huawei rep. a few days ago - though maybe part of a separate investigation - will ultimately be viewed by 'the other side' as a tactic, ergo, it's part of the discussion wether we want it to be or not. FYI - just today, a few days after Huawei VP is nabbed in Canada, the Chinese have 'dissapeared' a former Canadian diplomat in China working for an NGO. [1] ... which is exactly the kind of thing that many predicted would happen. [1] https://nationalpost.com/news/canada/former-canadian-diplomat-working-for-non-profit-reported-missing-in-china https://nationalpost.com/news/canada/former-canadian-diploma...
wybiral 8y ago
People demanding to see evidence here have to realize that information like that tends to stay classified for some time as ongoing operations are put in jeopardy just by announcing this. It's also from the justice department, meaning multiple groups of eyes were on this decision, not a few anti-China hawks. China does have a history of this kind of behavior.
- King-Aaron 8y ago
  I honestly find it quite concerning how much pro-chinese-government support bubbles up on platforms like HN, etc. Nothing against individuals in China, but as an entity the government (as with all governments) should be heavily scrutinized. It's definitely the government's SOP to try and exfiltrate data from the west, and it's no small secret. I feel everyone is getting pretty nonchalant about it.
  - kochikame 8y ago
    Just yesterday some people were commenting how there has been a marked rise in ANTI-Chinese government comments on HN recently I think there might be a lot of confirmation bias going on
    - icebraining 8y ago
      Both could be true, at the expense of more neutral comments, if there's more polarization.
  - wybiral 8y ago
    I've noticed that too. Some of it might be suspicious but I suspect there's just a lot of misinformation, disinformation, and feelings floating around.
  - solotronics 8y ago
    I made a comment (that was the top comment on an article about fentanyl) criticising the Chinese for promoting labs making illegal and highly dangerous drugs such as fentanyl which they send to the west. My post was flagged and taken down!
duchenne 8y ago
Thanks to Snowden, we have hard proofs that the USA have been using hacking on a very large scale for multiple goals including industrial espionage. Now, they say that their #1 economic rival is using hacking to steal data. But, there is no evidence. At least, before the Irak invasion, the US made some efforts to forge some fake proofs that Sadam had weapons of mass destruction.
HillaryBriss 8y ago
what is it about China and Marriott hotels? there was also that time they made the company fire that employee https://news.ycombinator.com/item?id=16515274 https://news.ycombinator.com/item?id=16515274
jeklj 8y ago
Yeah it’s definitely China’s fault.
deleted 8y ago
[deleted]
deleted 8y ago
[deleted]
ArchD 8y ago
“China firmly opposes all forms of cyberattack and cracks down on it in accordance with the law” "In accordance with the law” is the sneaky part that lets them add all kinds of 'Chinese characteristics' to whatever topic is being discussed. Their 'law' is often phrased very broadly and interpreted with lots of freedom and in practice is whatever the CPC wants. This is how they say one thing and do another, always "according to the law".
- withhighprod 8y ago
  That might be an inherent Chinese cultural problem: convenience over rules. It could be so convenient for authorities to suppress people yet it could be also a huge tax exempt over one night as long as you commit to invest or build a factory. When doing right, it could be super effective but also come with huge risks sometimes(e.g the policy of letting a few become rich first since 1980s) Its classic philosophy is also very blurry, can be summarized as: A is right, B is not necessarily wrong.
- tamizhar 8y ago
  > This is how they say one thing and do another, always "according to the law". Wasn't there a country that alleged yellow cake, WMD and other things in order to facilitate a grand mess in the Middle East. All perfectly legal according to the law, right?
  - meowface 8y ago
    Yes, but there is not yet any proof that Bush or Cheney lied about these things to start the war. Many in the CIA were genuinely convinced that Saddam had WMDs and/or resources to create WMDs. They turned out to be completely wrong, but it was their belief at the time. I wouldn't exactly be flabbergasted or Bush or Cheney willfully lied, but just because that's a common narrative doesn't mean it's substantiated. Gulf of Tonkin would be a much better example.
jorblumesea 8y ago
I really hope the Western countries severely curtail China's ability to operate in the West. Ban their companies, ban party officials and employees operating in the West, completely lock them down and out of the rest of the world. They need to understand there are real consequences for these actions.
- golfer 8y ago
  Ban their companies, like Foxconn, that builds all iPhones? What about all the hundreds of billions of dollars in other goods that are manufactured there that the West is reliant on? I also want to see consequences for these actions, but the situation is more nuanced than you seem to realize.
  - abc-xyz 8y ago
    It's not like China is the only country capable of building iPhones and other goods. Taiwan, Thailand, Vietnam, etc all seem like good alternatives until the goods can be manufactured in democratic countries with the help of robots. Would the western countries, companies and consumers suffer economically? Sure, but sometimes it's necessary to make sacrifices for the greater good, and it would be very shortsighted to ignore the threat China poses to the world.
  - fiblye 8y ago
    Foxconn is a Taiwanese company. They'd be unable to export things from their Chinese factories, but I doubt it'd affect them much.
- ShorsHammer 8y ago
  Do you think the average voter cares more about this than being able to buy an iPhone?
- verroq 8y ago
  I doubt turning China into the next North Korea will help it develop into a modern democracy.
- zachguo 8y ago
joshfraser 8y ago
Anytime the government claims that a hack originated from a specific country, assume it's politically motivated.
- Angostura 8y ago
  ... or that they have evidence that the hack originated from the specific country. One or the other.
  - SmellyGeekBoy 8y ago
    Why not both?
    - Angostura 8y ago
      Sorry, that was indeed an inclusive or.
  - tremon 8y ago
    The decision to make the hack public is always political.
royalconcierge 8y ago
http://m.spiegel.de/international/europe/gchq-monitors-hotel-reservations-to-track-diplomats-a-933914.html http://m.spiegel.de/international/europe/gchq-monitors-hotel... did everyone forget the Snowden docs? NSA program ROYALCONCIERGE already hacked into Starwood hotels and stole their entire database of booking and guest dox. worst of all, the hack is persistent and tips off NSA in real time the moment Abu Bakr Baghdadi checks in. or what if this hack was oh say The Shadowbrokers using NSA'S backdoor to shame NSA and close the peep hole spying on every guest of every Starwood hotel in the world? how do we really know this hack wasn't NSA itself? who can you trust? trust no one. only believe what you have seen with your own 5eyes and certainly never let spooks who lie for a living trick you into going along with another Iraq war based on forged evidence with all the Intelligence chiefs and crooked FBI directors swearing to you on national TV that you just need to trust them, because the evidence is classified, so they can't prove it to you, but you need to get on board with believing in the new false flag Gulf of Tonkin and cheering for the new war. if you don't support the war, then you disrespect the troops and you should get the fuck out of America. by the way,the Mirai hotel in Hong Kong where Snowden escaped to is a Starwood hotel. isn't it funny that ROYALCONCEIRGE didn't tip off NSA as to exactly where Snowden was the whole time? or maybe it did work and they were watching him all along.
- diebeforei485 8y ago
  This make me curious about whether "national security letters" have been sent to Airbnb.
- lern_too_spel 8y ago
  > NSA program ROYALCONCIERGE already hacked into Starwood hotels and stole their entire database of booking and guest dox. Your linked article makes no such claim. The specified program mentions neither the NSA nor Starwood Hotels nor hacked databases. It's a GCHQ program that appears to work on email messages collected elsewhere.
- dsplittgerber 8y ago
  Sorry to be nit-picky, but that sounds conspiracy theory-ish. The link you provided does not back-up your claim of the NSA having hacked the Starwood database. The linked article makes it sound like as a by-product of massively vacuuming up internet traffic, GCHQ has been able to track hotel booking confirmations sent to gov.whatever addresses. Which is noteworthy but (legally and morally) not as sinister as active measures.
setquk 8y ago
I thought this was Marriott's fault? Perhaps US should crack down on Marriott...
- sgt 8y ago
  That was my thought as well. If this is due to gross negligence from Marriott's side, it's more their fault than the hackers. At least that's my personal opinion.
- craftyguy 8y ago
  Exactly. This is actually excellent news for Marriott since it firmly shifts the blame and attention away from them.
AzzieElbab 8y ago
An internet facing rdp with user name and pw creation guidelines should be "traced" back to Marriott 's IT.

195 points by jumelles 8y ago

Given the long history of nation-states engaging in false flag premises for both diplomacy and "diplomacy by other means," how much scrutiny should we give to nation-states claims of hacking? How easy or hard is it to fake such claims? I should think it's much easier to fake than hiding nuclear weapons or instances of armed violence.

NegativeLatency 8y ago
Could’ve contracted it out too. It’s not necessarily the Chinese State, could’ve been freelancers hired by someone else.
mc32 8y ago
People do this all the time when they don't want to believe. At one point people didn't want to believe North Korea was the perpetrator of the Sony Hack, for political reasons, but then for other political reasons people were sure it was North Korea. Just like the email hacks --people tend to believe or not believe depending a lot on their ideology and how it aligns with them, unfortunately.
- colordrops 8y ago
  Typically these situations where belief follows political lines are an indicator that there isn't strong evidence to support either interpretation.
- netsharc 8y ago
  I also wanted to mention the Sony hack, and on the Wikipedia page there's a section quoting experts who doubted that it was them who did it. Associating this with sanctions against Chinese networking companies makes me think that it's just too convenient of an excuse.
  - lawnchair_larry 8y ago
    Those "experts" were not experts in attribution, and the consensus is that they were wrong. One is from Norse, a widely discredited and now defunct security firm, ironically infamous for their false attributions. Two are journalists. Enough said. One is Seth Rogen the actor. Enough said. One is Sabu from LulzSec, a script kid turned FBI snitch, who is way out of his league commenting on this. One is Marc Rogers, who I don't know personally, but I doubt he maintains his skepticism today. In any case, a security expert to be certain, but not an expert in attribution and not privy to the evidence (only some of which has ever been made public). Worth noting that he published followup blog posts to the wikipedia-linked citation that walked back his skepticism quite a bit (http://marcrogers.org/2015/01/24/wrapping-up-the-whole-sony-thing-for-now/ http://marcrogers.org/2015/01/24/wrapping-up-the-whole-sony-... - "In my eyes, the preponderance of evidence definitely suggests North Korean involvement or someone trying very hard to make it look like North Korean involvement."). He basically settled on it being plausible, but concerning, and acknowledged that he wasn't privy to the evidence.
- stcredzero 8y ago
  People do this all the time when they don't want to believe. I'm fine with the prospect of China hacking the US. It fits in just fine with my world view. However, there's also the sinking of the Maine, the Gulf of Tonkin incident, and Iraqi WMD. Skepticism is called for.
  - mc32 8y ago
    That skepticism is earned indeed. But despite that people will believe something along these lines (WMD[1], Sony Hack, Russia, etc.) if it aligns with their political view. And if it doesn't then they're even more skeptical than is healthy. [1]Although to be fair, Saddam _wanted_ his neighbors to believe he had WMDs. It was a sort of a reverse 'boy who cried wolf' and then not wanting to lose face kept playing games (which fooled many to believe more than they should have with flimsy independent evidence that he had WMDs (including many in the opposition parties).
    - freeflight 8y ago
      To be fair: Even the responsible UN weapons inspector, Scott Ritter [0] quite bluntly stated there was no evidence at all for the Iraqi WMD program. Not that anybody in the Bush administration would have cared, everybody there was well aware of this fact, that's also the reason why they tried to play up the fictitious "Saddam al-Qaeda" link [1] for a while and why the whole WMD thing just became a joke to them a mere year after the invasion [2]. [0] https://en.wikipedia.org/wiki/Scott_Ritter https://en.wikipedia.org/wiki/Scott_Ritter [1] https://en.wikipedia.org/wiki/Saddam_Hussein_and_al-Qaeda_link_allegations https://en.wikipedia.org/wiki/Saddam_Hussein_and_al-Qaeda_li... [2] https://www.youtube.com/watch?v=O35NA6TywAg https://www.youtube.com/watch?v=O35NA6TywAg
      - mc32 8y ago
        That whole thing was a fiasco and a stupid mistake or undertaking. It really was a terrible thing to do (there was reason to unseat Saddam, but not at the cost it would take). However, it would be a mistake to think this was only a Bush thing. This was broadly bipartisan in the US. It was neoliberal politics and war hawks who thought they could shape the world in their neoliberal view. With the Soviets out of the way, they thought they could help make the rest of the world more like western democracies (obvs through force if necessary) We saw a continuation with the Arab spring enthusiasm which turned horribly wrong as well.
- freeflight 8y ago
  > People do this all the time when they don't want to believe. People do this all the time because people working in the sector know [0] that attribution, with anything "cyber", is near impossible, if the attackers know what they are doing it actually is impossible. As such most attribution usually boils down to guessing games based on code samples and used attack vectors but rarely, if ever, on anything actually solid. [0] https://www.schneier.com/blog/archives/2015/01/attack_attribut.html https://www.schneier.com/blog/archives/2015/01/attack_attrib...
  - mc32 8y ago
    Right but on the other hand, with the same hedges people _will_ believe something despite all these qualifications that something was done by someone if it aligns with their politics to believe it.
    - freeflight 8y ago
      Accusations like this shouldn't be based on "hedges", as long as they do they only serve to do exactly what you describe: Lead people down predefined conclusions. That's why it's important to point out the difficulties of attribution or else people will simply take it as they see it, without even questioning it. In that context questioning it is not "hedging" anything, it's inquiring about actual evidence, which most rational people should be asking for instead of "hedging" based on political beliefs.
      - mc32 8y ago
        I agree with your take but I disagree with hedging being inappropriate here. Hedging just means using qualifications and conditions given some uncertainty in a claim.
  - lawnchair_larry 8y ago
    People do this all the time because people working in the sector know [0] that attribution, with anything "cyber", is near impossible, if the attackers know what they are doing it actually is impossible. This is wrong. Schneier has no idea what he is talking about (as usual). The funny part is that he opens with skepticism about the North Korea/Sony hack, of which many were skeptical early on, but now is not disputed by anybody. So he was wrong about that too. So very wrong. Especially this line: More likely, the culprits are random hackers who have loved to hate Sony for over a decade, or possibly a disgruntled insider. I'll be honest, I was skeptical of that one too. But I knew what I didn't know, so instead of challenging experts or trying to get my uninformed opinion out in the public sphere, I kept that to myself. And when I heard someone who I know would know make the NK claim without hesitation, it made me re-evaluate some assumptions. When it turned out that they were correct, I knew it was not a lucky guess. Attribution is not easy, but it's absolutely not impossible in all cases, or even difficult in many cases. People who understand technology make a lot of assumptions about how attribution works, and then make assertions like this. Attribution isn't simply that the bad packets came from a Chinese IP address. A good rant on the topic is here: http://www.robertmlee.org/russian-election-meddling-grizzleysteppe-and-bananas/ http://www.robertmlee.org/russian-election-meddling-grizzley...
adventured 8y ago
For over a year there has been widespread reporting of a surge in Chinese hacking, since the trade conflict began with the Trump Administration. Before that, the Obama Administration managed to get a brief cease fire, during which reports of Chinese hacking plunged dramatically. So what exactly was the Obama Administration getting an agreement on? China was doing it before, stopped after a publicly acknowledged agreement with the Obama Admin, and then it's so far fetched that they'd start up again during an increasingly aggressive trade war as to be worthy of false flag considerations - I don't think so. If it was China in this case, it's nothing more than par for the course for how they've been behaving for the last decade plus. It's an invaluable tool in their arsenal for dealing with the US in a variety of regards.

deleted 8y ago

[deleted]

nerdponx 8y ago
Nothing, China paranoia was part of the current president's election campaign.
- wybiral 8y ago
  I didn't vote for Trump and don't support him to this day. But I still think that China has gotten away with more than they should up until this point. There is nuance to this all.

varenc 8y ago

I'd be really interested in seeing the declassified intelligence the article mentions that points the finger at Chinese-intelligence. While proving that the attackers originate in China might be easy, clearly connecting this to a government-supported operation seems quite a challenge involving long chains of reasoning. It's probably not feasible to release all the info needed to independently verify this, but we'll see. I can also imagine how this line could be blurry... perhaps the government quietly permits more profit motivated blackhat operations in exchange for some intelligence sharing. And really the perfect "cyber attack" shouldn't be attributable at all.

n-gatedotcom 8y ago
Replace Chinese with Russian and ask yourself if you still want to see the declassified Intel.
- i_cant_speel 8y ago
  I'm not sure what point you are trying to make with this comment.
- pretendscholar 8y ago
  Why wouldn't we want to see the declassified intel on Russian hacking? What does that even mean?
  - paraditedc 8y ago
    My guess is that it's a reference to Hillary Clinton losing election due to hacked emails.
- thanatos_dem 8y ago
  Yes, I would like to see all declassified intel indicative of any foreign power performing a cyber attack on us. Is that somehow controversial?
- cyphar 8y ago
  You should always ask for evidence for claims. A quick reminder that the US intelligence community lied to the Bush administration about WMDs in Iraq, as well as about the existence of PRISM and related programs. Trusting the intelligence community, in the absence of evidence, is hardly a reasonable standpoint. Why would it matter if the claim were Russia, China, or North Korea?

elvirs 8y ago

im noticing a trend of our government offloading its responsibility to protect us and hiding its incompetence by pointing finger at foreign nations. -elections fucked up? -russia. -corporations dont protect consumer data? -china. -drugs and gang violence? -mexico and other south american nations. -unemployment? -canada and tarrifs. come on already.

closeparen 8y ago
Politicians have been blaming scapegoats as long as there have been politics.
adventured 8y ago
Unemployment is particularly an odd one to put in there. Nobody is complaining about macro unemployment due to Canada or tariffs. Tariffs aren't causing serious problems so far. In fact pretty much every report indicates they're helping the US, with China eating the bulk of the cost up to now. US steel companies are booming for the first time in decades. Steel & aluminum tariffs are also not harming the economy yet.[1] Employment is increasingly setting records on almost everything. Check out the job demand boom on durable goods manufacturing [2]: https://i.imgur.com/CViKovj.png https://i.imgur.com/CViKovj.png [1] https://www.cnbc.com/2018/12/11/steel-and-aluminum-tariffs-are-not-hurting-the-economy-study-says.html https://www.cnbc.com/2018/12/11/steel-and-aluminum-tariffs-a... [2] https://www.bnnbloomberg.ca/u-s-factories-are-posting-job-openings-like-never-before-1.1181053 https://www.bnnbloomberg.ca/u-s-factories-are-posting-job-op...
- elvirs 8y ago
  unemployment numbers are distorted. they count all part time jobs and gig economy signups as employment. these arent jobs, you can afford a decent life with this kind 'employment'. people working as teachers, working as salesperson at an official car dealerships, working in retail cant afford to rent an apartment and are living from shared rooms.
- Spooky23 8y ago
  My suppliers are facing extreme pricing pressure, and most are raising prices on many commodities. I’ve had more contract performance issues in the last 6 months than in the last decade. Employment is tough to measure. Acecdotally, my employer is attracting many mid/senior level people who are good who are taking entry/journeyman level gigs. That’s usually a forward indicator of bad times ahead, in my experience. Another factor is that tariffs are mechanisms that pick winners and losers. Automated steel and aluminum mills may be booming, but in contrast I just donated to a food drive for dairy farmers in my old hometown — many of whom will be bankrupt soon. They have to choose between heating the barn or buying food. Tariffs are also destroying small and midsize farmers in grain and other commodities.

mancerayder 8y ago

But while top administration officials insist that the trade talks are proceeding on a separate track, the broader crackdown on China could undermine Mr. Trump’s ability to reach an agreement with Mr. Xi. Mr. Trump, in an interview with Reuters on Tuesday, said that he would consider intervening in the Huawei case if it would help serve national security and help get a trade deal done with China. Such a move would essentially pit Mr. Trump against his own Justice Department, which coordinated with Canada to arrest Ms. Meng as she changed planes in Vancouver. I wonder if it's because Huawei's equipment or staff played a role, or if they just want to use Meng as a bargaining chip in the demands regarding cybersecurity and IP.

jorblumesea 8y ago
Meng's father, Ren Zhengfei, is an ex-PLA officer and has deep connections to the CCP. Her arrest and the timing of it are not coincidences. Notice the reaction of government media outlets in China. It's a direct method of pressuring China's political elite.
- acct1771 8y ago
  Where would an English speaker be able to do this?
mancerayder 8y ago
Someone downvoted me, but I'd like to point out to the genius that did that, today's FT article titled, "Trump makes Huawei CFO a bargaining chip" (FT, Dec 13, 2018) which is what I was asking.

sonnyblarney 8y ago

It'd be nice to see better real evidence this time around than the weird Bloomberg story in October about malicious chips. That story had a serious credibility problem.

chapium 8y ago
This has nothing to do with that.
- sonnyblarney 8y ago
  The issues are definitely related. That the government is in the middle of one of it's biggest negotiations in history, with it's largest trading partner - and there have been twice in that last few months indications of 'Chinese government spying' - would imply that they are quite related wether we want them to be or not. The first story was bizarre and didn't seem to have credibility, making one wonder how it came to be. This story comes at an even more sensitive time, and so more clarity, more information is better. Even the arrest of the Huawei rep. a few days ago - though maybe part of a separate investigation - will ultimately be viewed by 'the other side' as a tactic, ergo, it's part of the discussion wether we want it to be or not. FYI - just today, a few days after Huawei VP is nabbed in Canada, the Chinese have 'dissapeared' a former Canadian diplomat in China working for an NGO. [1] ... which is exactly the kind of thing that many predicted would happen. [1] https://nationalpost.com/news/canada/former-canadian-diplomat-working-for-non-profit-reported-missing-in-china https://nationalpost.com/news/canada/former-canadian-diploma...

wybiral 8y ago

People demanding to see evidence here have to realize that information like that tends to stay classified for some time as ongoing operations are put in jeopardy just by announcing this. It's also from the justice department, meaning multiple groups of eyes were on this decision, not a few anti-China hawks. China does have a history of this kind of behavior.

King-Aaron 8y ago
I honestly find it quite concerning how much pro-chinese-government support bubbles up on platforms like HN, etc. Nothing against individuals in China, but as an entity the government (as with all governments) should be heavily scrutinized. It's definitely the government's SOP to try and exfiltrate data from the west, and it's no small secret. I feel everyone is getting pretty nonchalant about it.
- kochikame 8y ago
  Just yesterday some people were commenting how there has been a marked rise in ANTI-Chinese government comments on HN recently I think there might be a lot of confirmation bias going on
  - icebraining 8y ago
    Both could be true, at the expense of more neutral comments, if there's more polarization.
- wybiral 8y ago
  I've noticed that too. Some of it might be suspicious but I suspect there's just a lot of misinformation, disinformation, and feelings floating around.
- solotronics 8y ago
  I made a comment (that was the top comment on an article about fentanyl) criticising the Chinese for promoting labs making illegal and highly dangerous drugs such as fentanyl which they send to the west. My post was flagged and taken down!

duchenne 8y ago

Thanks to Snowden, we have hard proofs that the USA have been using hacking on a very large scale for multiple goals including industrial espionage. Now, they say that their #1 economic rival is using hacking to steal data. But, there is no evidence. At least, before the Irak invasion, the US made some efforts to forge some fake proofs that Sadam had weapons of mass destruction.

HillaryBriss 8y ago

what is it about China and Marriott hotels? there was also that time they made the company fire that employee https://news.ycombinator.com/item?id=16515274 https://news.ycombinator.com/item?id=16515274

jeklj 8y ago

Yeah it’s definitely China’s fault.

deleted 8y ago

[deleted]

deleted 8y ago

[deleted]

ArchD 8y ago

“China firmly opposes all forms of cyberattack and cracks down on it in accordance with the law” "In accordance with the law” is the sneaky part that lets them add all kinds of 'Chinese characteristics' to whatever topic is being discussed. Their 'law' is often phrased very broadly and interpreted with lots of freedom and in practice is whatever the CPC wants. This is how they say one thing and do another, always "according to the law".

withhighprod 8y ago
That might be an inherent Chinese cultural problem: convenience over rules. It could be so convenient for authorities to suppress people yet it could be also a huge tax exempt over one night as long as you commit to invest or build a factory. When doing right, it could be super effective but also come with huge risks sometimes(e.g the policy of letting a few become rich first since 1980s) Its classic philosophy is also very blurry, can be summarized as: A is right, B is not necessarily wrong.
tamizhar 8y ago
> This is how they say one thing and do another, always "according to the law". Wasn't there a country that alleged yellow cake, WMD and other things in order to facilitate a grand mess in the Middle East. All perfectly legal according to the law, right?
- meowface 8y ago
  Yes, but there is not yet any proof that Bush or Cheney lied about these things to start the war. Many in the CIA were genuinely convinced that Saddam had WMDs and/or resources to create WMDs. They turned out to be completely wrong, but it was their belief at the time. I wouldn't exactly be flabbergasted or Bush or Cheney willfully lied, but just because that's a common narrative doesn't mean it's substantiated. Gulf of Tonkin would be a much better example.

jorblumesea 8y ago

I really hope the Western countries severely curtail China's ability to operate in the West. Ban their companies, ban party officials and employees operating in the West, completely lock them down and out of the rest of the world. They need to understand there are real consequences for these actions.

golfer 8y ago
Ban their companies, like Foxconn, that builds all iPhones? What about all the hundreds of billions of dollars in other goods that are manufactured there that the West is reliant on? I also want to see consequences for these actions, but the situation is more nuanced than you seem to realize.
- abc-xyz 8y ago
  It's not like China is the only country capable of building iPhones and other goods. Taiwan, Thailand, Vietnam, etc all seem like good alternatives until the goods can be manufactured in democratic countries with the help of robots. Would the western countries, companies and consumers suffer economically? Sure, but sometimes it's necessary to make sacrifices for the greater good, and it would be very shortsighted to ignore the threat China poses to the world.
- fiblye 8y ago
  Foxconn is a Taiwanese company. They'd be unable to export things from their Chinese factories, but I doubt it'd affect them much.
ShorsHammer 8y ago
Do you think the average voter cares more about this than being able to buy an iPhone?
verroq 8y ago
I doubt turning China into the next North Korea will help it develop into a modern democracy.
zachguo 8y ago

joshfraser 8y ago

Anytime the government claims that a hack originated from a specific country, assume it's politically motivated.

Angostura 8y ago
... or that they have evidence that the hack originated from the specific country. One or the other.
- SmellyGeekBoy 8y ago
  Why not both?
  - Angostura 8y ago
    Sorry, that was indeed an inclusive or.
- tremon 8y ago
  The decision to make the hack public is always political.

royalconcierge 8y ago

http://m.spiegel.de/international/europe/gchq-monitors-hotel-reservations-to-track-diplomats-a-933914.html http://m.spiegel.de/international/europe/gchq-monitors-hotel... did everyone forget the Snowden docs? NSA program ROYALCONCIERGE already hacked into Starwood hotels and stole their entire database of booking and guest dox. worst of all, the hack is persistent and tips off NSA in real time the moment Abu Bakr Baghdadi checks in. or what if this hack was oh say The Shadowbrokers using NSA'S backdoor to shame NSA and close the peep hole spying on every guest of every Starwood hotel in the world? how do we really know this hack wasn't NSA itself? who can you trust? trust no one. only believe what you have seen with your own 5eyes and certainly never let spooks who lie for a living trick you into going along with another Iraq war based on forged evidence with all the Intelligence chiefs and crooked FBI directors swearing to you on national TV that you just need to trust them, because the evidence is classified, so they can't prove it to you, but you need to get on board with believing in the new false flag Gulf of Tonkin and cheering for the new war. if you don't support the war, then you disrespect the troops and you should get the fuck out of America. by the way,the Mirai hotel in Hong Kong where Snowden escaped to is a Starwood hotel. isn't it funny that ROYALCONCEIRGE didn't tip off NSA as to exactly where Snowden was the whole time? or maybe it did work and they were watching him all along.

diebeforei485 8y ago
This make me curious about whether "national security letters" have been sent to Airbnb.
lern_too_spel 8y ago
> NSA program ROYALCONCIERGE already hacked into Starwood hotels and stole their entire database of booking and guest dox. Your linked article makes no such claim. The specified program mentions neither the NSA nor Starwood Hotels nor hacked databases. It's a GCHQ program that appears to work on email messages collected elsewhere.
dsplittgerber 8y ago
Sorry to be nit-picky, but that sounds conspiracy theory-ish. The link you provided does not back-up your claim of the NSA having hacked the Starwood database. The linked article makes it sound like as a by-product of massively vacuuming up internet traffic, GCHQ has been able to track hotel booking confirmations sent to gov.whatever addresses. Which is noteworthy but (legally and morally) not as sinister as active measures.

setquk 8y ago

I thought this was Marriott's fault? Perhaps US should crack down on Marriott...

sgt 8y ago
That was my thought as well. If this is due to gross negligence from Marriott's side, it's more their fault than the hackers. At least that's my personal opinion.
craftyguy 8y ago
Exactly. This is actually excellent news for Marriott since it firmly shifts the blame and attention away from them.

AzzieElbab 8y ago

An internet facing rdp with user name and pw creation guidelines should be "traced" back to Marriott 's IT.