13 ms·
China hacked HPE, IBM and then attacked clients
- mensetmanusman 8y agoCan’t blame them. Wall St. and their financied politicians cashed out technology leadership for short term gain.
- based2 8y agohttps://www.justice.gov/opa/pr/two-chinese-hackers-associated-ministry-state-security-charged-global-computer-intrusion https://www.justice.gov/opa/pr/two-chinese-hackers-associate... https://www.us-cert.gov/ncas/alerts/TA18-276B https://www.us-cert.gov/ncas/alerts/TA18-276B
- jammygit 8y agoThanks for the links. " FOR IMMEDIATE RELEASE Thursday, December 20, 2018 Two Chinese Hackers Associated With the Ministry of State Security Charged with Global Computer Intrusion Campaigns Targeting Intellectual Property and Confidential Business Information (...)"
- jsnell 8y ago> A British government spokeswoman declined to comment on the identities of companies affected by the Cloudhopper campaign or the impact of those breaches. > “A number of MSPs have been affected, and naming them would have potential commercial consequences for them, putting them at an unfair disadvantage to their competitors,” she said. Wait, what? These companies got repeatedly hacked, were apparently not able to re-secure the network, allowed themselves to be used as a springboard for further attacks to their customers, and then covered it up. And letting this be known would be an "unfair disadvantage"?
- ep103 8y agowe could pass laws making companies liable for their security (or at the minimum, remove current laws that shield companies from being sued for damages when they leak personally identifying information) But its easier to blame China, so let's do that.
- assblaster 8y agoYou prefer blaming the victim instead of the perpetrator of the crime?
- ecnahc515 8y agoI mean, the blame is somewhat shared. Blaming the perpetrator only helps so much. It's reactionary. It's similar to the reason you get insurance before bad things happen, not after. You can blame perpetrators all you want, but you still need to protect yourself.
- sgolestane 8y agoSo it's my fault if someone steals a package from my porch?
- flukus 8y agoNo, but if you borrow my stuff and it gets stolen off your porch then you're also to blame because you didn't protect it responsibly.
- deleted 8y ago[deleted]
- AnimalMuppet 8y agoMorally? No. It's the thief's fault, and the thief's fault only. But if you know that people steal packages off of porches in your neighborhood, and you leave a package out there for weeks, you're at least being pretty unwise. You're not morally at fault, but pragmatically, yes, you kind of are. [Edit: That is, your actions are not well-suited for the kind of world that we actually live in, and that you know that we live in.]
- timClicks 8y agoNot your fault in a moral sense, but it certainly is in a causal sense. You could have set up a different causal chain that would have prevented the theft. Of course that doesn't mean that society can't blame (and punish) the thief.
- trumped 8y agothe others companies have been hacked too... they say that because we don't know about it yet.... LOL... computer networks are still impossible to secure
- coliveira 8y agoSo the plan is to hide and not to disclose the problematic companies, and then blame everything on China... Absurd.
- mc32 8y agoIt reminds me of the Google China incident. except google pulled out and revamped their practices (though as outsiders we know little of what really happened),
- justinclift 8y ago> google pulled out and revamped their practices Give it 5 years. See if Google are just waiting for things to "cool down" before going back at it.
- Groxx 8y agoDragonfly implies they have been working towards that attempt for a while, and weren't too far away from it being launchable: https://en.wikipedia.org/wiki/Dragonfly_(search_engine) https://en.wikipedia.org/wiki/Dragonfly_(search_engine) So yea, already happened, will probably happen again.
- ineedasername 8y agoThis. Pichai's comments before congress didn't say it was cancelled. What he said ammounted to simply stating "we don't yet have a release date"
- cronix 8y ago> except google pulled out and revamped their practices All while working behind the scenes trying to make a Chinese controlled Google (Dragonfly) for China, complete with the censorship tools that any government that wants to control its people would love? Several large American companies seem to be chomping at the bit to do these types of projects and help repressive governments in order to profit, until the light of truth gets shown on them... Or were you referring to the time when they were already in China and pulled out over censorship issues? https://www.nytimes.com/2018/08/16/technology/google-employees-protest-search-censored-china.html https://www.nytimes.com/2018/08/16/technology/google-employe... I'm not even sure why China needs google, they've already stolen the source code years ago. Maybe they're after updates to the algorithms. > In a blog post, Google chief legal officer David Drummond said hackers stole the source code that powers Google’s vaunted search engine and also targeted the e-mail accounts of activists critical of China’s human rights abuses. https://www.washingtonpost.com/world/national-security/chinese-hackers-who-breached-google-gained-access-to-sensitive-data-us-officials-say/2013/05/20/51330428-be34-11e2-89c9-3be8095fe767_story.html https://www.washingtonpost.com/world/national-security/chine...
- rebuilder 8y agoWell, if everyone is probably compromised, then naming companies who just happen to be known to be compromised could arguably put them at an unfair disadvantage.
- justaman 8y agoWhen does this become an act of war?
- analogtsar 8y agoI'd rather see companies invest heavily into security. At the end it benefits a customer.
- x0rx0r 8y agoWhen human lives are threatened.
- perfmode 8y agoCurious: is this a legal statement? Disparate effects are the new norm. There very well may be lives threatened. death by a thousand cuts
- freehunter 8y agoThe US Government considers a cyber attack that threatens human life to be an act of war: https://www.wsj.com/articles/SB10001424052702304563104576355623135782718 https://www.wsj.com/articles/SB10001424052702304563104576355...
- beginningguava 8y agothe vast majority of the fentanyl that's killing 70,000+ people a year in the US is manufactured in China. The Chinese government has done next to nothing to prevent this
- RcouF1uZ4gsC 8y agoWhen the Chinese had a problem with a lot of their citizens becoming addicted to opiates and tried to curb it, the Western powers actually invaded them (see Opium War). This seems like karma.
- 8y ago
- peanutbuttter 8y agothis is an act of war
- krautt 8y agoThey are persistent. I see attacks from them on my company in the thousands every day. Some ip ranges have continued to hit us dozens of times after prolonged blocking.
- simonsays2 8y agoThat which can be asserted without evidence, can be dismissed without evidence.
- burtonator 8y agoRead the indictment: https://www.justice.gov/opa/press-release/file/1121706/download https://www.justice.gov/opa/press-release/file/1121706/downl... ... this still has to go in front of a judge of course but it's not like they're claiming there's no evidence.
- echevil 8y ago> International Business Machines Corp said it had no evidence that sensitive corporate data had been compromised. Hewlett Packard Enterprise (HPE) said it could not comment on the Cloudhopper campaign. > Both IBM and HPE declined to comment on the specific claims made by the sources. > DXC Technology declined to comment, saying in a statement that it does not comment on reports about specific cyber events and hacking groups. > Reuters was unable to confirm the names of other breached technology firms or identify any affected clients. I wonder why the title of the article sounds so certain while it seems none of the claims are confirmed
- xster 8y agoBecause there are no consequences of journalistic malpractice and no one will read retractions or revisions so the parent conglomerates can shape public opinion any way it wants.
- justinclift 8y ago> none of the claims are confirmed "None of the claims are confirmed" is probably due to IBM (etc) having an aggressive legal attitude + plenty of lawyers. eg If you try and force them to contact their customers, you're in for a long, drawn out legal process with a less than 100% chance of getting a decent result for their customers.
- roadkillon101 8y agoThis is an example of the "tail wagging the dog". Whether a "State Sponsored" organization hacked IBM or someone in their mothers garage, IBM and other companies ARE responsible for keeping their customers data safe. While it's true a state sponsored entity would have more resources than a kid in a basement, IBM has the resources to pay for full time IT security professionals and for the amount of money they charge for their products and services, they should have more than enough resources to pay for decent 3rd party Security products and services. They KNOW they have a target on their back, it's their responsibility.
- qaq 8y agoI doubt you can get to a state that will make your company unhackable. You can get to a state when you are able to discover a breach and remediate relatively quickly.
- roadkillon101 8y agoTrue, nothing is "unhackable" and it reminded me of Oracles corporations challenge about 10 years ago... they placed a billboards and marketed that they had an "Unbreakable" system...within hours they were "hacked" after doing this announcement. What these companies can do is change their premise for guarding their customers information. Instead of putting a singular firewall around their information system, they "compartmentalize" their customers info so they may get one or two customers info not hundreds or thousands at a time. Further, the critical info of each customer can be further "compartmentalized" to make the information difficult to access. This is how they approach Cardholder Information Security Program (CISP) with cardholder data. This approach ASSUMES the information at some point will be compromised, so with this assumption, when there is a breach, the damage will be limited not massive as it was the case with IBM and the other companies involved. They could have done something like that, however based on the media play they are doing now, I'm guessing there are hundreds if not thousands of companies involved.
- qaq 8y agoI agree a lot more can be done but if you look at how advanced some of the state level groups (like APT-29) are if you are truly a target it's tough even if you follow all the best practices.
- not_real_acct 8y agoOne afternoon I was doing some consulting work at one of HP's oldest offices. I needed to print something, so I had the printer produce a configuration page, so I could get the IP address. Lo and behold, it was a public IP. As in, this old-ass printer, sitting at an HP office, was sitting on the Internet. And it was connected to the office network. Really blew my mind. The office was very old, and there were things laying around the hallways that seemed to have been untouched for 20 or even 40 years. So I'm guessing that workhorse of a printer had been chugging away for decades, and was configured long before anyone had thought about information security. Also, if this sounds too crazy to be possible, you can test this for yourself. If you do a Google search on the welcome page of an HP printer, you will find hundreds with public IP addresses.
- justinclift 8y ago> Lo and behold, it was a public IP. As lousy as that sounds from your description (eg a valid globally routable IP), it would be very surprising if the printer (or even the office space) was accessible from outside HP. Firewalls (and more) are a thing. ;) > Also, if this sounds too crazy to be possible, you can test this for yourself. If you do a Google search on the welcome page of an HP printer, you will find hundreds with public IP addresses. Yeah. Certainly says something about the competence of some places. :( Relatedly, it sounds like Shodan might be of interest: https://www.shodan.io https://www.shodan.io
- viraptor 8y ago> it was a public IP. IP exposed to the internet, or an IP from the public range? HP has 2 /8s. Lots of things got public IPs in there since they can hand them out like candy. It doesn't mean though that they're available from the internet.
- freehunter 8y agoYeah, I've worked with plenty of companies who have a whole public range and use it internally, but the external firewall still stops them from being publicly routed. Simply having a public IP doesn't mean it's actually public.
- walrus01 8y agoMeanwhile, the CFO is Huawei is reported to have seven passports. https://www.bbc.com/news/world-asia-46507974 https://www.bbc.com/news/world-asia-46507974
- fbarriga 8y agofun fact: according to this article in Wikipedia you can have up to 10 valid german passports. https://en.m.wikipedia.org/wiki/German_passport https://en.m.wikipedia.org/wiki/German_passport
- verdverm 8y agoWhile I was at IBM, I deployed an sshkey to the internal Bluemix staging environment, called "Dr Worm" (it's my title :) About 3 months later they froze my account and called my manager, freaking out. Apparently it was not allowed. We were like, wait, if it's not allowed, they why was I able to? And why did it take 3 months?! They backed down and we laughed over beers. I'd be surprised if IBM even has the visibility into the situation... because that's just one of the war stories.
- shard972 8y agoI thought HPE was a majority owned Chinese company?
- AndyMcConachie 8y agoSure would be nice if there was some evidence.
- pollymolly 8y agoIt is really strange to see that, when a US company or one goverment department doing something, we call it by its name or its branch, but when a Chinese company or a department doing something affect copyright or anything wrong (there's no exuse for that I know) but we summerise it as "China". I am working in a Chinese company right now, this mentality really affects some good Chinese company out there to do some fair business.
- tk75x 8y agoThat's because the Chinese government has its thumbs in every pie in their country. If the government wanted, they could easily compel your company to do its bidding.
- friedman23 8y agoExactly, the seemingly good independent Chinese companies are simply the ones that haven't caught the attention of the thousand eyed spider. The company is in the web regardless.
- pollymolly 8y agoIs there a way to prove your counterpart arguement? Logically, it's much easier to prove your arguements than mine even if the truth favours mine.
- friedman23 8y agoThe only way the US has influence over business is via the judicial system. If a business takes issue with the outcome of the court cases they can even take the extreme step of shutting their business down as was done with Lavabit. The Chinese government has routinely stooped to using coercion such as blackmail and kidnapping of family members to control its citizens. It's really not comparable.
- pollymolly 8y agoWell, that's exactly the same how the Chinese people think about America --- if America wants, they can take away millions of citizens life from a previously rich middle east country with ease. And I dislike this idea and the way of generalization.
- systematical 8y agoI wonder if we are doing the same thing to China and it just doesn't get as much press here or China doesn't disclose it. From a layman view, things seem very one-sided.
- zwaps 8y agoAs long as there are no consequences, this will continue. 1. Hacked firms should be investigated for neglience. If opening a doc file can bonk the entire system, somewhere best practices were not followed. 2. The judicative should viciously go after the largest hostile actor, including state actors, they can get a hold of. 3. And lastly, politics should go after China. Every week there is a new story how China stole IP, hacked something or showed hostile behavior Compared with their rethoric and genocidial tendencies, it should become clear to every state that China is not an ally to anyone but the CCP, and no Chinese firm is at the end not owned by the CCP. The harshest consequences that are reasonable are approrpriate at this point, or Chinas behavior will just get worse Appeasement does not work anymore.
- Maryann0777 8y agoHonestly, i don't trust anyone anymore i am tired of been deceiving in a relationship it's sad when my wife was having an affairs with my friend, i noticed my wife is getting too much closer with my friend Derick, she is now chatting in private, her calls are in secret and she also changed her phone password, I was wondering what's going wrong, on till my colleague introduced me to a great hacker who helped me to hack her phone without having physical contact with the phone in less than 24hrs after her Phone was finally hacked, her messages coming into my phone instantly and i now have full access to her phone. Contact: KEVINMITNICK7410 @ GMAIL. COM
- lorenzorhoades 8y agoWhen someone says 'china' hacked these companies, what does that even mean? The chinese version of the NSA, or FBI hacked these companies? Can anyone shed some light on this?