12 ms·

Holy shit did not see that coming. Was sure it was some hackers out looking to sell info on dark web. Chinese government gives it a whole different motivation.

dx87 7y ago
Yep, it could be used for finding extortion targets. Just find someone with bad credit who also works for some sort of sensitive program, and now you have leverage over them.
- swiley 7y ago
  I don’t know what you mean by “sensitive program” but anything the federal government considers critical disqualifies people like this (even if their credit goes bad after they’re hired.) They’re very particular about this; particular meaning polygraphs and agents talking to your family members. I know because I almost took a job like this (and know a number of people who have) but the pay and location were crap.
  - Spooky23 7y ago
    That happens if you work with DoD programs. How much do you think legislative aides are scrutinized? Political party staff who aren't on the government payroll?
  - jvanderbot 7y ago
    This is oversimplified. Anything ITAR or EAR or commercial proprietary related to tech would be prime to extract but would be worked by million(s) US persons with no further background screen beyond basic employability checks. US Gov secret and above requires lots of checks ... but the breadth of the human attack surface for commercial or ITAR technology combined with the Equifax data would in fact be an ace in the hole.
    - kevin_thibedeau 7y ago
      Don't forget that China dumped the OPM database and can cross correlate individuals in important places with credit issues. Foolishly poking at them is the sort of inept strategic thinking this administration is so good at.
  - lokl 7y ago
    Are you sure that the standards applied to your background checks were also applied to those of relatives of the President? If the background check system is politicized, then this kind of hacking to discover sensitive information might become even more valuable.
deleted 7y ago
[deleted]
Spooky23 7y ago
It shouldn't be a surpise. The US has essentially on omnipotent traditional military force that can either engage or assure mutual destruction of any opponent on the earth. Nobody can compete successfully. But humans are crafty, and come up with ways to defeat irresistible force. As we've seen predicted for 20+ years and demonstrated in the public space for 10, our nation's weakest link is that election system and political finance system, particularly for legislators. The checks and balances that are supposed to prevent egregious behavior are broken (see what happened to most US Attorneys since 2016, the impeachment circus, and 100 other things at the state/local level). Building dossiers on Americans are a great, obvious way to wield this power and to target and enable espionage/influence activity. Recall that the federal agency that keeps records on background checks was breached a couple of years ago. So now you have a hostile nation state that knows everyone, and all of their background data, with security clearances. You can cross-walk that with Equifax information, health insurance breaches (Recall that Blue Cross was also breached), etc and do all sorts of interesting things.
- loceng 7y ago
  Re: breaches - just because it wasn't overtly stated: you can better know who is corruptible, more easily corruptible - and corrupt them leading locals to working for your opponents.
- Invictus0 7y ago
  China's military is growing rapidly and the US cannot expect its hegemony to last forever. See previous discussion: https://news.ycombinator.com/item?id=19802161 https://news.ycombinator.com/item?id=19802161
- ianleeclark 7y ago
  > The US has essentially on omnipotent traditional military force that can either engage or assure mutual destruction of any opponent on the earth. Nobody can compete successfully. How many times in the past two years have our boats crashed into one another? The F35 program is a complete failure. When we ran Hormuzi wargames, a rag-tag group that fought through guerilla warfare won until our Navy cried and made the other side "fight fair." In the past 80 years the only win we can claim is the Gulf War. This is seriously overstating our military capabilities.
yorwba 7y ago
It can be both. Plenty of Chinese "state sponsored" APTs are happy to sell to the highest bidder, even database dumps of Chinese companies. E.g. APT17: https://intrusiontruth.wordpress.com/2019/07/25/encore-apt17-hacked-chinese-targets-and-offered-the-data-for-sale/ https://intrusiontruth.wordpress.com/2019/07/25/encore-apt17...
paulmd 7y ago
I'm fairly sure this info has made it onto the darkweb regardless. A number of people have reported to me that they have been cold called by "their bank" from a spoofed number, given partial account information/address history/ssn last 4/etc, and asked to verify "security questions", and when they hang up and call the bank of course they aren't involved. It sounds exactly like attackers attempting to social engineer their way past the last bits of information they don't have from credit history reports.
- astura 7y ago
  "ID Theft as a Service" sites have been in operation since before the Equifax hack. https://krebsonsecurity.com/2014/03/who-built-the-id-theft-service-ssndob-ru/ https://krebsonsecurity.com/2014/03/who-built-the-id-theft-s...
  - ryanlol 7y ago
    Essentially all the data contained in the Equifax breach has been for sale a long time before this breach, the other breached entities stayed quiet so people unfamiliar with the business tend to just assume that Equifax is to blame for everything. Makes all the people talking about suing Equifax for subjecting them to identity theft look pretty silly.
mzs 7y ago
I think you and I will be surprised more often going forward. >"The FBI has about a thousand investigations involving China's attempted theft of U.S.-based technology in all 56 of our field offices and spanning just about every industry and sector," Wray said. >John Brown, FBI Assistant Director for the Counterintelligence Division, said the bureau has already made 19 arrests this fiscal year alone on charges of Chinese economic espionage. >In comparison, the FBI made 24 arrests all last fiscal year, and only 15, five years earlier, in 2014. https://www.zdnet.com/article/fbi-is-investigating-more-than-1000-cases-of-chinese-theft-of-us-technology/ https://www.zdnet.com/article/fbi-is-investigating-more-than...
vkou 7y ago
How do you know its true? The indictment insists that the defendants are responsible for the hack, and lists the things that they have allegedly done, but offers... Zero evidence for why these particular defendants were responsible. The evidence for why is sealed unless there's a trial. There's never going to be a trial, because those guys aren't going to show up to their court date. It's entirely possible that this has been fabricated for political purposes... It's not like the only people who could disprove the lie (the accused) have any interest in disproving it.
fma 7y ago
The OPM hack was supposedly done by the Chinese government, too. https://en.wikipedia.org/wiki/Office_of_Personnel_Management_data_breach https://en.wikipedia.org/wiki/Office_of_Personnel_Management... It would be easy to know who to bribe if you know who works in government, and which one has debt. As part of security clearance check, if you have substantial debt you're not suppose to be able to get a clearance...but I'm sure there are some who get exempt.
- mzs 7y ago
  also gamblers https://www.washingtonpost.com/news/innovations/wp/2017/07/21/how-a-fish-tank-helped-hack-a-casino/ https://www.washingtonpost.com/news/innovations/wp/2017/07/2... https://money.cnn.com/2015/02/27/technology/security/iran-hack-casino/index.html https://money.cnn.com/2015/02/27/technology/security/iran-ha... https://www.ft.com/content/1bc41d30-ecdb-11e5-888e-2eadd5fbc4a4 https://www.ft.com/content/1bc41d30-ecdb-11e5-888e-2eadd5fbc...
astura 7y ago
It shouldn't come as a surprise, after all, the OPM hack was also perpetrated by the Chinese government.
- sgift 7y ago
  Allegedly. Note that it looks much better for the OPM if they can say they got hacked by "cyber warfare units from China" than "sorry, we are bad at OpSec, a few script kiddies got us". From https://en.wikipedia.org/wiki/Office_of_Personnel_Management_data_breach#Perpetrators https://en.wikipedia.org/wiki/Office_of_Personnel_Management... I gather that only hearsay was provided to the public, no credible evidence.
dontbenebby 7y ago
It's very interesting when you also take into account the OPM breach: https://en.wikipedia.org/wiki/Office_of_Personnel_Management_data_breach https://en.wikipedia.org/wiki/Office_of_Personnel_Management... If you have a list of federal employees + a list of people's credit histories you can do things like spot people who have security clearances but no credit history. Jenna McLaughlin did a great piece on how breaches like this are making it almost impossible for intelligence agents to operate under traditional cover: https://news.yahoo.com/shattered-inside-the-secret-battle-to-save-americas-undercover-spies-in-the-digital-age-100029026.html https://news.yahoo.com/shattered-inside-the-secret-battle-to... The days of creating a SSN, issuing it a passport + an entry in OPM as a "cultural attaché" at some embassy are waning fast, if not gone already.
- mzs 7y ago
  also the Marriott breach - who's staying when/where and what CC do they use https://www.npr.org/2018/12/12/675983642/chinese-hackers-are-responsible-for-marriott-data-breach-reports-say https://www.npr.org/2018/12/12/675983642/chinese-hackers-are...
  - dontbenebby 7y ago
    I saw several people paying cash to settle their bills at a conference once, and thought it was odd since that hotel makes you at least supply a CC for incidentals (and show ID) Maybe it was to guard against generating useful metadata that could be later breached? Very interesting.
deleted 7y ago
[deleted]

dx87 7y ago

Yep, it could be used for finding extortion targets. Just find someone with bad credit who also works for some sort of sensitive program, and now you have leverage over them.

swiley 7y ago
I don’t know what you mean by “sensitive program” but anything the federal government considers critical disqualifies people like this (even if their credit goes bad after they’re hired.) They’re very particular about this; particular meaning polygraphs and agents talking to your family members. I know because I almost took a job like this (and know a number of people who have) but the pay and location were crap.
- Spooky23 7y ago
  That happens if you work with DoD programs. How much do you think legislative aides are scrutinized? Political party staff who aren't on the government payroll?
- jvanderbot 7y ago
  This is oversimplified. Anything ITAR or EAR or commercial proprietary related to tech would be prime to extract but would be worked by million(s) US persons with no further background screen beyond basic employability checks. US Gov secret and above requires lots of checks ... but the breadth of the human attack surface for commercial or ITAR technology combined with the Equifax data would in fact be an ace in the hole.
  - kevin_thibedeau 7y ago
    Don't forget that China dumped the OPM database and can cross correlate individuals in important places with credit issues. Foolishly poking at them is the sort of inept strategic thinking this administration is so good at.
- lokl 7y ago
  Are you sure that the standards applied to your background checks were also applied to those of relatives of the President? If the background check system is politicized, then this kind of hacking to discover sensitive information might become even more valuable.

deleted 7y ago

[deleted]

Spooky23 7y ago

It shouldn't be a surpise. The US has essentially on omnipotent traditional military force that can either engage or assure mutual destruction of any opponent on the earth. Nobody can compete successfully. But humans are crafty, and come up with ways to defeat irresistible force. As we've seen predicted for 20+ years and demonstrated in the public space for 10, our nation's weakest link is that election system and political finance system, particularly for legislators. The checks and balances that are supposed to prevent egregious behavior are broken (see what happened to most US Attorneys since 2016, the impeachment circus, and 100 other things at the state/local level). Building dossiers on Americans are a great, obvious way to wield this power and to target and enable espionage/influence activity. Recall that the federal agency that keeps records on background checks was breached a couple of years ago. So now you have a hostile nation state that knows everyone, and all of their background data, with security clearances. You can cross-walk that with Equifax information, health insurance breaches (Recall that Blue Cross was also breached), etc and do all sorts of interesting things.

loceng 7y ago
Re: breaches - just because it wasn't overtly stated: you can better know who is corruptible, more easily corruptible - and corrupt them leading locals to working for your opponents.
Invictus0 7y ago
China's military is growing rapidly and the US cannot expect its hegemony to last forever. See previous discussion: https://news.ycombinator.com/item?id=19802161 https://news.ycombinator.com/item?id=19802161
ianleeclark 7y ago
> The US has essentially on omnipotent traditional military force that can either engage or assure mutual destruction of any opponent on the earth. Nobody can compete successfully. How many times in the past two years have our boats crashed into one another? The F35 program is a complete failure. When we ran Hormuzi wargames, a rag-tag group that fought through guerilla warfare won until our Navy cried and made the other side "fight fair." In the past 80 years the only win we can claim is the Gulf War. This is seriously overstating our military capabilities.

yorwba 7y ago

It can be both. Plenty of Chinese "state sponsored" APTs are happy to sell to the highest bidder, even database dumps of Chinese companies. E.g. APT17: https://intrusiontruth.wordpress.com/2019/07/25/encore-apt17-hacked-chinese-targets-and-offered-the-data-for-sale/ https://intrusiontruth.wordpress.com/2019/07/25/encore-apt17...

paulmd 7y ago

I'm fairly sure this info has made it onto the darkweb regardless. A number of people have reported to me that they have been cold called by "their bank" from a spoofed number, given partial account information/address history/ssn last 4/etc, and asked to verify "security questions", and when they hang up and call the bank of course they aren't involved. It sounds exactly like attackers attempting to social engineer their way past the last bits of information they don't have from credit history reports.

astura 7y ago
"ID Theft as a Service" sites have been in operation since before the Equifax hack. https://krebsonsecurity.com/2014/03/who-built-the-id-theft-service-ssndob-ru/ https://krebsonsecurity.com/2014/03/who-built-the-id-theft-s...
- ryanlol 7y ago
  Essentially all the data contained in the Equifax breach has been for sale a long time before this breach, the other breached entities stayed quiet so people unfamiliar with the business tend to just assume that Equifax is to blame for everything. Makes all the people talking about suing Equifax for subjecting them to identity theft look pretty silly.

mzs 7y ago

I think you and I will be surprised more often going forward. >"The FBI has about a thousand investigations involving China's attempted theft of U.S.-based technology in all 56 of our field offices and spanning just about every industry and sector," Wray said. >John Brown, FBI Assistant Director for the Counterintelligence Division, said the bureau has already made 19 arrests this fiscal year alone on charges of Chinese economic espionage. >In comparison, the FBI made 24 arrests all last fiscal year, and only 15, five years earlier, in 2014. https://www.zdnet.com/article/fbi-is-investigating-more-than-1000-cases-of-chinese-theft-of-us-technology/ https://www.zdnet.com/article/fbi-is-investigating-more-than...

vkou 7y ago

How do you know its true? The indictment insists that the defendants are responsible for the hack, and lists the things that they have allegedly done, but offers... Zero evidence for why these particular defendants were responsible. The evidence for why is sealed unless there's a trial. There's never going to be a trial, because those guys aren't going to show up to their court date. It's entirely possible that this has been fabricated for political purposes... It's not like the only people who could disprove the lie (the accused) have any interest in disproving it.

fma 7y ago

The OPM hack was supposedly done by the Chinese government, too. https://en.wikipedia.org/wiki/Office_of_Personnel_Management_data_breach https://en.wikipedia.org/wiki/Office_of_Personnel_Management... It would be easy to know who to bribe if you know who works in government, and which one has debt. As part of security clearance check, if you have substantial debt you're not suppose to be able to get a clearance...but I'm sure there are some who get exempt.

mzs 7y ago
also gamblers https://www.washingtonpost.com/news/innovations/wp/2017/07/21/how-a-fish-tank-helped-hack-a-casino/ https://www.washingtonpost.com/news/innovations/wp/2017/07/2... https://money.cnn.com/2015/02/27/technology/security/iran-hack-casino/index.html https://money.cnn.com/2015/02/27/technology/security/iran-ha... https://www.ft.com/content/1bc41d30-ecdb-11e5-888e-2eadd5fbc4a4 https://www.ft.com/content/1bc41d30-ecdb-11e5-888e-2eadd5fbc...

astura 7y ago

It shouldn't come as a surprise, after all, the OPM hack was also perpetrated by the Chinese government.

sgift 7y ago
Allegedly. Note that it looks much better for the OPM if they can say they got hacked by "cyber warfare units from China" than "sorry, we are bad at OpSec, a few script kiddies got us". From https://en.wikipedia.org/wiki/Office_of_Personnel_Management_data_breach#Perpetrators https://en.wikipedia.org/wiki/Office_of_Personnel_Management... I gather that only hearsay was provided to the public, no credible evidence.

dontbenebby 7y ago

It's very interesting when you also take into account the OPM breach: https://en.wikipedia.org/wiki/Office_of_Personnel_Management_data_breach https://en.wikipedia.org/wiki/Office_of_Personnel_Management... If you have a list of federal employees + a list of people's credit histories you can do things like spot people who have security clearances but no credit history. Jenna McLaughlin did a great piece on how breaches like this are making it almost impossible for intelligence agents to operate under traditional cover: https://news.yahoo.com/shattered-inside-the-secret-battle-to-save-americas-undercover-spies-in-the-digital-age-100029026.html https://news.yahoo.com/shattered-inside-the-secret-battle-to... The days of creating a SSN, issuing it a passport + an entry in OPM as a "cultural attaché" at some embassy are waning fast, if not gone already.

mzs 7y ago
also the Marriott breach - who's staying when/where and what CC do they use https://www.npr.org/2018/12/12/675983642/chinese-hackers-are-responsible-for-marriott-data-breach-reports-say https://www.npr.org/2018/12/12/675983642/chinese-hackers-are...
- dontbenebby 7y ago
  I saw several people paying cash to settle their bills at a conference once, and thought it was odd since that hotel makes you at least supply a CC for incidentals (and show ID) Maybe it was to guard against generating useful metadata that could be later breached? Very interesting.

deleted 7y ago

[deleted]