6 ms·

The cables indicate that the American government has been fighting a pitched battle with intruders who have been clearly identified as using Chinese-language ke

by jfager 16y ago

The cables indicate that the American government has been fighting a pitched battle with intruders who have been clearly identified as using Chinese-language keyboards and physically located in China. Does anyone have insight into how keyboard language and physical location get clearly identified? I can't think of how you'd do that reliably. Keyboard language: can you build timing signatures for how people type on different keyboards? Then set up a keylogger on a known compromised host or a honeypot, watch the intruder type for a while, and match the signature? That seems pretty easily defeatable: do as much as you can via scripts, and if you ever need to type something, pass all your keystrokes through a filter that knows how to mimic each timing signature. I can't come up with a plausible way to pin down physical location, but I'm sure someone on here has a better working knowledge of that kind of thing than I do.

riobard 16y ago
There is no such thing as “Chinese-language keyboards”. Well there used to be some experimental prototypes designed to facilitate inputs, but they never gained any traction. Now it's all standard US keyboards. But it would be rather easy to know the language based on keyboard input: most likely the typed string will contain more of the user's mother tongue I assume?
- shareme 16y ago
  the miss-spoke not language keyboards but maybe reading text output in Chinese
- jseliger 16y ago
  Well there used to be some experimental prototypes designed to facilitate inputs, but they never gained any traction. Now it's all standard US keyboards. This is interesting, and it's a problem I've never really thought about. Can you say more about it?
  - riobard 16y ago
    I cannot say much about those prototypes since I only heard about them long time ago and never touched a real one. In fact few people even know about those silly stuff anyway… Inputting Chinese on a keyboard is hard because of the sheer amount of characters. There is no feasible way to have enough physical keys mapping to even a very limited subset (think 2+k chars as the bottom line). So the way out is to use Input Method Editor (IME's) to map a sequence of keystrokes on an ordinary US keyboard to a single Chinese character or phrase. Currently in mainland China there are two families of IME's that are in wide use: Pinyin-based and Wubi-based. Pinyin-based IME's converts Pinyin, basically the sound of Chinese characters in Roman alphabet, to the corresponding chars. This family of IME's is the most popular one because almost any kid born after 70's knows Pinyin, and thus the learning curve to use Pinyin-based IME's is just mastering the keyboard itself. The shortcoming of Pinyin-based IME's is that a single sequence of Pinyin can translate into a lot more chars (1:50 ratio is quite common), and the user has to choose which one is intended. This is considered rather slow and error-prone. Most modern Pinyin-based IME's focus on NLP model to predict the correct chars, and I have to say it is now much much better than 10 years ago. Wubi-based IME's rely on a formal and rather complicated method to decompose Chinese chars into sub-components based on shape, then map the 26 alphabet keys on a standard US keyboard to these components. The user chooses the correct components to form the characters. The advantage is that a single char requires less than 4 keystrokes to input, which is considerably faster than Pinyin-based IME's which usually require more keystrokes. There is also much much less “hash collisions” in that a keystroke sequence usually maps to only one or two chars, thus no need to manually choose anymore. The downside though, is that the method to decompose chars into components must be memorized, which is very difficult, and the mapping of components on the keyboard must also be familiarized, which is even more confusion. Some keyboards come with extra labeling to help this, much like a typical Japanese keyboard. In addition, I have the feeling that this method is designed for professional typists instead of ordinary users because it is quite counter-intuitive to think how chars are written and then decompose them when you are just chatting with someone. Professional typists, on the other hand, are looking at existing documents and try to input them into a computer, which is quite different from the mental model of chatting. There are other less used IME's too. For example bank representatives used to use a method that map a 4~5 digit number into a char purely on the numpad because it is considerably faster once you master it. I don't think anyone is using this method anymore though. The learning curve is just insane. Other IME's try to combine both Pinyin and Wubi together with different tradeoffs, but few gain real traction. In Taiwan and Hongkong there exist different IME's because they use Traditional Chinese which have much more complex strokes than Simplified Chinese used in mainland. Also in Hongkong they speak Cantonese whose pronunciation is different than Mandarin, so normal Pinyin is not used there.
- jfager 16y ago
  most likely the typed string will contain more of the user's mother tongue I assume? It's not like an attacker is going to be writing emails on the compromised machine. Anything they'd actually be typing would probably just be standard Unix commands. I didn't realize the Chinese used standard US keyboards, thanks. That just reinforces my feeling that the claim of "clearly identified" is probably total bullshit.
kragen 16y ago
If you can install software on their computer that runs with their authority, you can look to see what keyboard layout is configured and who their ISP is. You can also take pictures of them with their webcam and steal copies of all the passwords they type.
- jfager 16y ago
  That seems like a pretty big if when dealing with sophisticated attackers.

by jfager 16y ago

riobard 16y ago

There is no such thing as “Chinese-language keyboards”. Well there used to be some experimental prototypes designed to facilitate inputs, but they never gained any traction. Now it's all standard US keyboards. But it would be rather easy to know the language based on keyboard input: most likely the typed string will contain more of the user's mother tongue I assume?

shareme 16y ago
the miss-spoke not language keyboards but maybe reading text output in Chinese
jseliger 16y ago
Well there used to be some experimental prototypes designed to facilitate inputs, but they never gained any traction. Now it's all standard US keyboards. This is interesting, and it's a problem I've never really thought about. Can you say more about it?
- riobard 16y ago
  I cannot say much about those prototypes since I only heard about them long time ago and never touched a real one. In fact few people even know about those silly stuff anyway… Inputting Chinese on a keyboard is hard because of the sheer amount of characters. There is no feasible way to have enough physical keys mapping to even a very limited subset (think 2+k chars as the bottom line). So the way out is to use Input Method Editor (IME's) to map a sequence of keystrokes on an ordinary US keyboard to a single Chinese character or phrase. Currently in mainland China there are two families of IME's that are in wide use: Pinyin-based and Wubi-based. Pinyin-based IME's converts Pinyin, basically the sound of Chinese characters in Roman alphabet, to the corresponding chars. This family of IME's is the most popular one because almost any kid born after 70's knows Pinyin, and thus the learning curve to use Pinyin-based IME's is just mastering the keyboard itself. The shortcoming of Pinyin-based IME's is that a single sequence of Pinyin can translate into a lot more chars (1:50 ratio is quite common), and the user has to choose which one is intended. This is considered rather slow and error-prone. Most modern Pinyin-based IME's focus on NLP model to predict the correct chars, and I have to say it is now much much better than 10 years ago. Wubi-based IME's rely on a formal and rather complicated method to decompose Chinese chars into sub-components based on shape, then map the 26 alphabet keys on a standard US keyboard to these components. The user chooses the correct components to form the characters. The advantage is that a single char requires less than 4 keystrokes to input, which is considerably faster than Pinyin-based IME's which usually require more keystrokes. There is also much much less “hash collisions” in that a keystroke sequence usually maps to only one or two chars, thus no need to manually choose anymore. The downside though, is that the method to decompose chars into components must be memorized, which is very difficult, and the mapping of components on the keyboard must also be familiarized, which is even more confusion. Some keyboards come with extra labeling to help this, much like a typical Japanese keyboard. In addition, I have the feeling that this method is designed for professional typists instead of ordinary users because it is quite counter-intuitive to think how chars are written and then decompose them when you are just chatting with someone. Professional typists, on the other hand, are looking at existing documents and try to input them into a computer, which is quite different from the mental model of chatting. There are other less used IME's too. For example bank representatives used to use a method that map a 4~5 digit number into a char purely on the numpad because it is considerably faster once you master it. I don't think anyone is using this method anymore though. The learning curve is just insane. Other IME's try to combine both Pinyin and Wubi together with different tradeoffs, but few gain real traction. In Taiwan and Hongkong there exist different IME's because they use Traditional Chinese which have much more complex strokes than Simplified Chinese used in mainland. Also in Hongkong they speak Cantonese whose pronunciation is different than Mandarin, so normal Pinyin is not used there.
jfager 16y ago
most likely the typed string will contain more of the user's mother tongue I assume? It's not like an attacker is going to be writing emails on the compromised machine. Anything they'd actually be typing would probably just be standard Unix commands. I didn't realize the Chinese used standard US keyboards, thanks. That just reinforces my feeling that the claim of "clearly identified" is probably total bullshit.

kragen 16y ago

If you can install software on their computer that runs with their authority, you can look to see what keyboard layout is configured and who their ISP is. You can also take pictures of them with their webcam and steal copies of all the passwords they type.

jfager 16y ago
That seems like a pretty big if when dealing with sophisticated attackers.