19 ms·

U.S. and key allies accuse China of Microsoft Exchange cyberattacks

286 points by jimmy2020 5y ago

aww_dang 5y ago
Will someone accuse Microsoft of publishing vulnerable software?
- ChemSpider 5y ago
  The issue is not that a random guy on the internet hacks the software, but a _state_ actor.
  - aww_dang 5y ago
    The solution is the same in both cases. Don't use vulnerable software. The problem starts with the same actor in both cases, Microsoft. I feel bad for the admins who are stuck with these systems.
    - ChemSpider 5y ago
      So you think that a Linux mail server is unhackable for a state actor?
      - apercu 5y ago
        Lol. Love it. Don't use Microsoft, instead become an expert in cisco OS and Linux and don't spend ay time generating anything of economic value but instead spend all your time securing your infrastructure and doing pen tests. (yes, if you are expert open source is easier top secure maybe, at least that was my experience 20+ years ago. Now I mostly pay companies like microsoft to host my stuff so I can do billable shit).
      - aww_dang 5y ago
        Nothing is perfect. I'm sure nobody here is proposing that. However the lack of perfect alternatives doesn't excuse Microsoft's or specifically MS Exchange's reputation. https://en.wikipedia.org/wiki/Nirvana_fallacy https://en.wikipedia.org/wiki/Nirvana_fallacy https://www.cvedetails.com/product/194/Microsoft-Exchange-Server.html?vendor_id=26 https://www.cvedetails.com/product/194/Microsoft-Exchange-Se...
    - ahiknsr 5y ago
      > Don't use vulnerable software Is there any widely used software that doesn't have any vulnerabilities?
    - AnIdiotOnTheNet 5y ago
      > The solution is the same in both cases. Don't use vulnerable software. So, basically, don't use software. Actually, given the horrific state of modern software, I can get behind that.
      - aww_dang 5y ago
        You digress, but you're onto something here. I suspect I'm not the only one who cringes at bloated packages and sometimes rolls my own alternative.
        therealEleix 5y ago
        This is sadly true. We need to return back to the Unix Philosophy of do one thing and do it well. None of these multi-purpose tools that have terrible feature creep and try to take over everything cough systemd cough. In all seriousness though, a lot of software that should be simple and easy to audit ends up having all these dependencies that are ether no longer maintained or doesn't get the necessary code reviews and it isn't until stuff like this happens that it actually comes to light. I'm all for re-using code when rebuilding the wheel would be a hassle but it has to be balanced with proper code review before it should be included. Developers are much too quick to include outside code with the assumption that other people have already done the necessary reviews and this is where a lot of devs are getting bit.
        maximus-decimus 5y ago
        They're not digressing. There is no such thing as not vulnerable software. Especially if the attacker is the government of one of the most powerful nations on Earth.
  - aj3 5y ago
    Eh, the issue was found by a random (Chinese) guy on the internet. And it was reported to Microsoft in the beginning of January. It got leaked and once you have the exploit chain - yeah, pretty much any random guy on the internet could use it for hacking. A few days after MS disclosure there were in fact independently produced exploits by other random guys.
- jimmy2020 5y ago
  If someone robbed your apartment would it be convenient to accuse you of low-security procedures instead of condemning the bad actors
  - aww_dang 5y ago
    If the property management company demanded that I use Insecure Brand locks on my front door, I'd have an issue with that. Of course that wouldn't excuse the robbers, but continuing to use Insecure Brand locks wouldn't be advisable. I'd also take exception if IB Locks or the property management company marketed themselves as a security oriented company.
    - jimmy2020 5y ago
      > continuing to use Insecure Brand locks wouldn't be advisable. Agreed. Microsoft should clarify how this happened and what measurements will take to prevent this incident from happening again. Still, the problem is with robbery and it should be condemned. Why changing the subject to Microsoft? I don't think whataboutism is the valid argument here.
      - A4ET8a8uTh0 5y ago
        It is not whataboutism. It is about 3 decades of seemingly intentional inability to deliver secure product on the mildly evil calculation that the subscriber will need 'security updates' and 'support'. There is a good argument to be made that Windows is a big target, but they should at least try not making it so easy.
        jimmy2020 5y ago
        > It is about 3 decades of seemingly intentional inability to deliver secure product. This is a consumer choice. You don't trust Microsoft, you don't use its services. On the government level, you ask for regulations if the situation is escalated (if necessary). But dealing with global cyberattacks is not Microsoft problem and it's not connected to one company or one service. It's an international responsibility to act and establish a framework that prevents such attacks.
- blackbear_ 5y ago
  Microsoft will be accused of inserting backdoors that are accessible to non US-affiliated actors /s
1cvmask 5y ago
They are making accusations on China based on "educated" guesswork. The smoking gun is missing to "prove" provenance and attribution. In fact that is incredibly hard to prove. In Stuxnet for example, the alleged perpetrators hinted that they were behind it. Will the same countries and allies now condemn known, disclosed and proven cyberattacks sourced from other countries (with known state involvement and complicity) on activists and journalists that lead to imprisonment and death? And Microsoft has a very long history of vulnerabilities and hiding it. And then they will refuse to patch known vulnerabilities in lower versioned software trying to force large customers to do unwanted version upgrades and to adopt the more expensive SaaS offerings. They are now trying to force all customers off of the already paid for and cheaper on-prem Microsoft Exchange which is still the dominant software in the directory services market and trying to get all corporates onto Azure AD.
dmix 5y ago
> Following Microsoft’s original disclosure in early March 2021, the United States Government also identified other vulnerabilities in the Exchange Server software. > Rather than withholding them, the United States Government recognized that these vulnerabilities could pose systemic risk and the National Security Agency notified Microsoft to ensure patches were developed and released to the private sector. Finally they seem to be starting to take the defence of citizens and private industry seriously - in a far more public forum. Instead of just hearing the odd story of this happening through back channels. From the linked press release: https://www.whitehouse.gov/briefing-room/statements-releases/2021/07/19/the-united-states-joined-by-allies-and-partners-attributes-malicious-cyber-activity-and-irresponsible-state-behavior-to-the-peoples-republic-of-china/ https://www.whitehouse.gov/briefing-room/statements-releases...
- deepstack 5y ago
  >> Rather than withholding them, the United States Government recognized that these vulnerabilities could pose systemic risk and the National Security Agency notified Microsoft to ensure patches were developed and released to the private sector. It is amazing that NSA had to notify Microsoft. You would thing a company with that much money like MS, they would have drop several millions on a few pen test, and independent security audit companies. Digital security will never be trust unless these things are addressed in an open transparent way.
  - pletsch 5y ago
    > You would thing a company with that much money like MS, they would have drop several millions on a few pen test, and independent security audit companies. Are you under the impression that MS doesn't spend millions on security? They're currently spending roughly $1b/year. This isn't going to be fixed by "a few pen test"
    - sandworm101 5y ago
      If they are spending a billion, these flaws show that obviously isn't enough.
throwaway4good 5y ago
The EU does not accuse the Chinese government of being behind the attacks. This is the EU press statement: https://www.consilium.europa.eu/en/press/press-releases/2021/07/19/declaration-by-the-high-representative-on-behalf-of-the-eu-urging-china-to-take-action-against-malicious-cyber-activities-undertaken-from-its-territory/ https://www.consilium.europa.eu/en/press/press-releases/2021... China: Declaration by the High Representative on behalf of the European Union urging Chinese authorities to take action against malicious cyber activities undertaken from its territory
- throwaway4good 5y ago
  An indication that the EU does not believe the probably American intelligence assessment that these hackers operate on behalf of the Chinese government.
  - krageon 5y ago
    When the US was angry with Russia everything was suddenly Russians. Now they're being difficult at China, and suddenly China is the country doing everything wrong. That anyone still takes them seriously is to my mind an incredible miracle.
    - apercu 5y ago
      Not suggesting at all that the USA is some benign superpower, but Russia is run by a criminal gang and China by a despot and a corrupt communist party. Note that I am a US citizen than expatriated after the second gulf war. So I am not a fan if the US gvmt, but if you think for a second that the Chinese and Russian governments AREN'T doing the things they are accused you are naive.
      - hungryhobo 5y ago
        just curious, have you visited china before? or seen first hand what's it actually like? you seem to have a very strong opinion, yet i'm not sure if they are based on reality or not.
_rmrf 5y ago
Why does the article use the flag of vietnam?
- codetrotter 5y ago
  My guess would be that the illustrator decided to zoom in on the biggest star in the Chinese flag and was unaware that this made it look like the flag of Vietnam.
nabla9 5y ago
This is messy article. There are multiple things happening at once. Attack vs. espionage are treated differently. Espionage is done with the intention is to steal information. Espionage is relatively normal between states. Condemn, file charges, then do the same back a them. Attack is when the intention is to cause harm or coerce. Ransomware, intentionally disrupting or destroying systems. Attacks from foreign government or entities acting behalf of an government are essentially acts of war. The West is condemning together "mixing" where Chinese government sanctioned groups are doing attacks for financial gain on the side. China should spy responsibly and stop attacks.
endisneigh 5y ago
why impose sanctions on Russia and not China? The article implies that allies would not agree to sanctions which is fair enough, but the USA can still do something alone, no?
- pletsch 5y ago
  China will probably deny it regardless of what other countries say. Beyond that, attribution isn't made by IP addresses.
- dangerface 5y ago
  Useually they get some of the hackers tools / code and analyse that to discover the origin. They look for strings in a foreign language but mostly the grammer of the language is used as hackers will often write comments in a foreign language to try and make it difficult to originate.
- dragonelite 5y ago
  Didn't vault 7 revealed the NSA had tooling to make hacks look like Russian and Chinese hacks Umbrage and the marble framework. Wouldn't be surprised they will use these hacking threats to create a western great fire wall. Pompeo already talked about it with the Clean network Initiative.
john579 5y ago
Microsoft Exchange crashes when encountering Unicode Chinese fonts. Trust Bill Gates with your data security, he's a jew.
protontorpedo 5y ago
It looks like cyber warfare, as well as espionage, is considered pretty much fair game in geopolitics nowadays. I wonder where the line is drawn that would make it an act of war. In any case, a direct attack from the Chinese government towards it's main trade partners (US, Germany and Japan among them) sounds crazy to me.
- DaftDank 5y ago
  I don't think it's crazy at all. We (i.e. the US) use our SIGINT abilities to spy on allies all the time, or at least according to numerous books and leaks. With that said, I'm not sure that the US government considers China an ally.
  - tasogare 5y ago
    Yes, and that includes stealing trade secrets from European companies, which are nominally US allies.
  - pmcollins 5y ago
    espionage != cyber warfare > attack crippled thousands of computers around the world
    - dalbasal 5y ago
      Technology has a tendency of merging realms. Whether you compromise a system to get information or to cripple it is pretty much a detail.
- sidlls 5y ago
  Why? China wants to build an empire and views the US as an enemy. They will use their military and intelligence forces to achieve that, just like any other country does to achieve their respective goals.
- saddata 5y ago
  China goes down, so does aapl and tsla and our entire economy. Until the American voter is more powerful that the collected business interests of those mega-corps, China will be our most favored trade partner, even as they commit war crimes against the American people (in theory :)
whoknowswhat11 5y ago
The amount of hot air on this topic is incredible. The US has denounced, accused, etc Russia on cyber attacks It is now calling out and accusing China of cyber attacks. My guess - ZERO concrete action. Meanwhile, China says relatively little and focuses on actual power - trade ties, threats etc.
- jollybean 5y ago
  There will probably big new military investments in cyber security and it will be a bigger branch of the military.
- singularity2001 5y ago
  knowledge IS real power, especially knowledge of how to control your opponents infrastructure
roenxi 5y ago
The US intelligence services have specific tools to fake the source of a cyberattack. I really don't know what anyone thinks "...accuse China..." means in such headlines. It could be anyone.
ppeetteerr 5y ago
There is so much doubt in this comment section around the validity of the accusations. We have a number of countries putting forward the knowledge they have mutually agreed upon. What is shared is known to a high degree of certainty. Any details that are questionable would not have been shared prematurely.
- Leparamour 5y ago
  China is just the bogeyman of the hour. If it were more politically convenient to blame Russia or Iran you'd suddenly find the same evidence pointing a different way.
  - adflux 5y ago
    The bogeyman of the hour which is putting people into concentration camps. Would you say Nazi Germany was the bogeyman of the (then) hour aswell? IMO these are some very valid concerns...
    - curiousgal 5y ago
      Oh please. If the U.S. was so concerned about human rights violations they would stop funding Israel. Sorry dang.
      - hirako2000 5y ago
        They would also stop big bunch of other things.
      - pokot0 5y ago
        The US has too many internal problem to be the world savior. Every time the US looks outside its border, it's for its sole selfish interests. Human rights enforcement around the world is (unfortunately) not something we can reasonaly expect from US. Also the U in US is extremely optimistic. Different states would act completely differently if allowed to. The world need to look for a different hero: any proposal? (For a good laugh, I reccomend watching the excellent "When the Yogurt took over" on Netflix)
Leparamour 5y ago
Is this damage control to distract from Israeli companies NSO and Candiru being caught running malware for despots to target journalists and activists? The timing surely is peculiar.
- irobeth 5y ago
  This is maybe the fifth time this year I've seen Israel used as an immediate deflection subject in China-related cybersecurity news posts; is that a trend anyone else has picked up on? just me?
  - adflux 5y ago
    Classic whataboutism, happens when news articles criticise Russia, China or the US very frequently.
  - Leparamour 5y ago
    No, it's just you. Yesterday we had worldwide coordinated reports of shady Israeli companies getting innocent people killed and suddenly there's haphazard "breaking news" report on big bad CHHHIIIINNNAAA.
- bmsd_0923 5y ago
  I completely fail to see why this post was flagged. This is a legitimate question that every thinking person needs to be asking themselves right now.
ivanstame 5y ago
Go to hell with the US, this statement is just way to hypocritical.
chmod775 5y ago
I can't help but think "accuse" is a peculiar choice of words, because it implies that the accuser has any basis to feel wronged. If they had any integrity they'd say: "I guess you got us back, huh!". Entertaining to watch nonetheless.
boringg 5y ago
Would this be the first full scale assault by Chinese hackers in the supply chain that we know of? If so, it is notable that they are aggressively acting in that way (and breached).
- aj3 5y ago
  To my knowledge this is the first attack of this sort (shadily) attributed to China, but they have been implicated in much more important attacks, such as OPM breach ( https://en.wikipedia.org/wiki/Office_of_Personnel_Management_data_breach https://en.wikipedia.org/wiki/Office_of_Personnel_Management... ).
fqye 5y ago
The USA hasn't yet provided evidence of Huwei spying for Chinese government.
- mthoms 5y ago
  They’ve been caught spying to further their own business interests.
- programmer_dude 5y ago
  They don't need to it is a reasonable assumption that all Chinese companies are hand in glove with the Chinese military.
  - justicezyx 5y ago
    If there was never evidence to anything, then it's reasonable to assume?
    - programmer_dude 5y ago
      The CCP/PLA can force any company operating within China to do its bidding. This is Chinese law. And this is common knowledge. Watch this: https://www.youtube.com/watch?v=ZrsOM8ww8ug https://www.youtube.com/watch?v=ZrsOM8ww8ug
      - DiogenesKynikos 5y ago
        First, just saying that something is legally possible does not mean that that's what occurred. Second, this isn't something China-specific. The US Federal government also has enormous power to compel companies to cooperate in surveillance. Just recall when the US government ordered Lavabit to turn over its SSL keys, so that the government could intercept Snowden's emails.
    - tablespoon 5y ago
      > If there was never evidence to anything, then it's reasonable to assume? In some cases, yes. For instance, I'm sure China wouldn't build its nuclear deterrent around some hypothetical US-made COTS "Nuclear Weapon Control System," even if there was zero evidence that system was compromised. Absence of evidence is not evidence of absence. Ditto with Huawei. IMHO, if its decision-making wasn't so addled by wishful thinking and capitalism, the US would use far less Chinese technology for this reason.
cs702 5y ago
China has been accused of hacking and/or electronic spying by other states. Russia has been accused of hacking and/or electronic spying by other states. North Korea has been accused of hacking and/or electronic spying by other states. And yes, the US and quite a few European states -- and many other countries -- have also been accused of hacking and/or electronic spying by other states[a]. All these governments are playing with explosives: The right spark at the wrong place at the wrong time can start a fire. Seemingly "minor" incidents have triggered wars in the past.[b] -- [a] Including via highly-targeted malware such as https://en.wikipedia.org/wiki/Stuxnet https://en.wikipedia.org/wiki/Stuxnet [b] For example, https://en.wikipedia.org/wiki/Pig_War_(1859) https://en.wikipedia.org/wiki/Pig_War_(1859) , https://en.wikipedia.org/wiki/Marco_Polo_Bridge_Incident https://en.wikipedia.org/wiki/Marco_Polo_Bridge_Incident , https://en.wikipedia.org/wiki/Football_War https://en.wikipedia.org/wiki/Football_War , https://en.wikipedia.org/wiki/Assassination_of_Archduke_Fran https://en.wikipedia.org/wiki/Assassination_of_Archduke_Fran... -- to name a few off the top of my head.
- matheusmoreira 5y ago
  Interesting to see the USA complaining about the cyberwarfare activities of other countries. As if it didn't have an entire government agency and even military branches dedicated to nothing but this.
  - adventured 5y ago
    Is there any evidence the US has directed the intentional sabotage of critical energy providers and food providers in Russia or China in recent years? Russia appears to be waging an all-out cyber war against the US at this point. Putin admitted as much in the hour-long interview with NBC a month ago. He declared as openly as he possibly could have that the US would be targeted until it came to the negotiating table (they want sanctions etc. removed in exchange for stopping the attacks). So far the US appears to have been exceptionally reserved in its response, given it's a clear declaration of war by Russia to be intentionally targeting critical US infrastructure with attacks.
    - 5y ago
GaltMidas 5y ago
I don't think Chinese cyber spying is really news to anyone. What's different about this now is that the U.S., a few others and notably, NATO are specifically calling out China for it. That's a pretty heavy diplomatic change. Especially the inclusion of NATO.
- jollybean 5y ago
  That's the important take from this, that it's NATO meaning 1) It's national security and 2) NATO countries are acting in unison on this.
jb775 5y ago
Is anyone else sick of all this forced "connected cloud" crap? My wife just got a new Windows laptop and the amount of dark patterns they use to push people towards the Windows cloud is insane. I haven't used Windows in years, but it's glaringly clear that the entire modern Windows OS is designed around recurring monetization of users. Nowadays, Windows machines are essentially one big trojan horse waiting to either be hacked or tapped into by 3-letter agencies.
samuelizdat 5y ago
And? U.S. and key allies install backdoors in device firmware and imbedded chips from manufacturers to spy on their own citizens. Why should we care at this point? We've had over 20 years to have this conversation, too late now. lol
2OEH8eoCRo0 5y ago
Entire free world: China is hacking us. Entire comment section: b-b-but the US.
- dalbasal 5y ago
  ...and both are relevant. China probably is "hacking us." US/NATO credibility is suspect.
  - deleted 5y ago
    [deleted]
  - godelski 5y ago
    That's not the problem. We shit on the US all day every day. There's also not a problem with this. The problem is that when we're talking about someone else it's being used as a defense. Honestly it doesn't even matter if the US is doing the same thing. If something is wrong it is wrong, no matter who does it. Responding to "China is hacking the US" with "But the US hacks China" doesn't accomplish anything except create arguments nor is it logically consistent because both can be bad. The "but they did it" implies the action is not bad in the first place and that a double standard is an excuse. The problem is that there is not a double standard. People are also critical of the US's use of hacking both nationally and globally. So if you're concerned with the US hacking people it is logically obvious that you'd also be concerned with China (or anyone else!) hacking people. I'm tired of this argument because it just serves the propagandists. It eliminates a real conversation happening because we can't even start one because we don't even agree on a basic premise of that things can be judged independently. Comparisons can be great, but independent judgement/criticism is also necessary.
    - dalbasal 5y ago
      What would you like to have discussed and/or judged independently? I agree that a lot of the comments here are shitposting or making reactionary equivocations. Others though, are making valid points... which you may agree with, or not. IMO, for example, the most important part of this to pay attention to is NATO. Cybersecurity & China seem to be the new focus of the alliance. To me, this seems like the most potentially impactful aspect.. and probably a key reason why this announcement was made in the way that it was made. IE, I think that what NATO do in the coming few years will make the history books, rather than Chinese cyberattacks. I may be wrong, but this isn't a disingenuous equivocation. It's just my judgement on this, at this point.
HaloZero 5y ago
I recommend reading "The Perfect Weapon: How the Cyber Arms Race Set the World Afire" if you're interested in learning more about cyberattacks over the past decade and the geopolitics of it cyberattacks.
- deleted 5y ago
  [deleted]
futevolei 5y ago
Are there similar stories in China about Chinese companies being hacked by the US gov? Do Chinese people get outraged over them or does game recognize game? Do Chinese companies have hacking divisions?
LatteLazy 5y ago
Let's assume this is true for a moment. Now what? China have: * crushed protest at home and moved deeper into dictatorship * shat all over the 1 country 2 systems agreement and strangled what little democracy there was in HK * started a mini ground war with their nuclear armed neighbour India * launched multiple pandemics, the latest costing the world trillions in lost output and millions of deaths * started a Genocide internally And were not willing to do anything are we? No so much as a sanction or an embargo except for Australia, who've been left to twist in the wind. So now China hacked some shit? Great. What are we gonna do? Nothing because no one wants to pay interest on their borrowing or 3p more for pointless plastic shit they don't need from amazon. /Rant.
Seb-C 5y ago
http://webcache.googleusercontent.com/search?q=cache:https://www.axios.com/china-cyberattacks-nato-181e71d2-7414-45f3-9463-c8b1d46392c1.html http://webcache.googleusercontent.com/search?q=cache:https:/...

286 points by jimmy2020 5y ago

aww_dang 5y ago

Will someone accuse Microsoft of publishing vulnerable software?

ChemSpider 5y ago
The issue is not that a random guy on the internet hacks the software, but a _state_ actor.
- aww_dang 5y ago
  The solution is the same in both cases. Don't use vulnerable software. The problem starts with the same actor in both cases, Microsoft. I feel bad for the admins who are stuck with these systems.
  - ChemSpider 5y ago
    So you think that a Linux mail server is unhackable for a state actor?
    - apercu 5y ago
      Lol. Love it. Don't use Microsoft, instead become an expert in cisco OS and Linux and don't spend ay time generating anything of economic value but instead spend all your time securing your infrastructure and doing pen tests. (yes, if you are expert open source is easier top secure maybe, at least that was my experience 20+ years ago. Now I mostly pay companies like microsoft to host my stuff so I can do billable shit).
    - aww_dang 5y ago
      Nothing is perfect. I'm sure nobody here is proposing that. However the lack of perfect alternatives doesn't excuse Microsoft's or specifically MS Exchange's reputation. https://en.wikipedia.org/wiki/Nirvana_fallacy https://en.wikipedia.org/wiki/Nirvana_fallacy https://www.cvedetails.com/product/194/Microsoft-Exchange-Server.html?vendor_id=26 https://www.cvedetails.com/product/194/Microsoft-Exchange-Se...
  - ahiknsr 5y ago
    > Don't use vulnerable software Is there any widely used software that doesn't have any vulnerabilities?
  - AnIdiotOnTheNet 5y ago
    > The solution is the same in both cases. Don't use vulnerable software. So, basically, don't use software. Actually, given the horrific state of modern software, I can get behind that.
    - aww_dang 5y ago
      You digress, but you're onto something here. I suspect I'm not the only one who cringes at bloated packages and sometimes rolls my own alternative.
      - therealEleix 5y ago
        This is sadly true. We need to return back to the Unix Philosophy of do one thing and do it well. None of these multi-purpose tools that have terrible feature creep and try to take over everything cough systemd cough. In all seriousness though, a lot of software that should be simple and easy to audit ends up having all these dependencies that are ether no longer maintained or doesn't get the necessary code reviews and it isn't until stuff like this happens that it actually comes to light. I'm all for re-using code when rebuilding the wheel would be a hassle but it has to be balanced with proper code review before it should be included. Developers are much too quick to include outside code with the assumption that other people have already done the necessary reviews and this is where a lot of devs are getting bit.
      - maximus-decimus 5y ago
        They're not digressing. There is no such thing as not vulnerable software. Especially if the attacker is the government of one of the most powerful nations on Earth.
- aj3 5y ago
  Eh, the issue was found by a random (Chinese) guy on the internet. And it was reported to Microsoft in the beginning of January. It got leaked and once you have the exploit chain - yeah, pretty much any random guy on the internet could use it for hacking. A few days after MS disclosure there were in fact independently produced exploits by other random guys.
jimmy2020 5y ago
If someone robbed your apartment would it be convenient to accuse you of low-security procedures instead of condemning the bad actors
- aww_dang 5y ago
  If the property management company demanded that I use Insecure Brand locks on my front door, I'd have an issue with that. Of course that wouldn't excuse the robbers, but continuing to use Insecure Brand locks wouldn't be advisable. I'd also take exception if IB Locks or the property management company marketed themselves as a security oriented company.
  - jimmy2020 5y ago
    > continuing to use Insecure Brand locks wouldn't be advisable. Agreed. Microsoft should clarify how this happened and what measurements will take to prevent this incident from happening again. Still, the problem is with robbery and it should be condemned. Why changing the subject to Microsoft? I don't think whataboutism is the valid argument here.
    - A4ET8a8uTh0 5y ago
      It is not whataboutism. It is about 3 decades of seemingly intentional inability to deliver secure product on the mildly evil calculation that the subscriber will need 'security updates' and 'support'. There is a good argument to be made that Windows is a big target, but they should at least try not making it so easy.
      - jimmy2020 5y ago
        > It is about 3 decades of seemingly intentional inability to deliver secure product. This is a consumer choice. You don't trust Microsoft, you don't use its services. On the government level, you ask for regulations if the situation is escalated (if necessary). But dealing with global cyberattacks is not Microsoft problem and it's not connected to one company or one service. It's an international responsibility to act and establish a framework that prevents such attacks.
blackbear_ 5y ago
Microsoft will be accused of inserting backdoors that are accessible to non US-affiliated actors /s

1cvmask 5y ago

They are making accusations on China based on "educated" guesswork. The smoking gun is missing to "prove" provenance and attribution. In fact that is incredibly hard to prove. In Stuxnet for example, the alleged perpetrators hinted that they were behind it. Will the same countries and allies now condemn known, disclosed and proven cyberattacks sourced from other countries (with known state involvement and complicity) on activists and journalists that lead to imprisonment and death? And Microsoft has a very long history of vulnerabilities and hiding it. And then they will refuse to patch known vulnerabilities in lower versioned software trying to force large customers to do unwanted version upgrades and to adopt the more expensive SaaS offerings. They are now trying to force all customers off of the already paid for and cheaper on-prem Microsoft Exchange which is still the dominant software in the directory services market and trying to get all corporates onto Azure AD.

dmix 5y ago

> Following Microsoft’s original disclosure in early March 2021, the United States Government also identified other vulnerabilities in the Exchange Server software. > Rather than withholding them, the United States Government recognized that these vulnerabilities could pose systemic risk and the National Security Agency notified Microsoft to ensure patches were developed and released to the private sector. Finally they seem to be starting to take the defence of citizens and private industry seriously - in a far more public forum. Instead of just hearing the odd story of this happening through back channels. From the linked press release: https://www.whitehouse.gov/briefing-room/statements-releases/2021/07/19/the-united-states-joined-by-allies-and-partners-attributes-malicious-cyber-activity-and-irresponsible-state-behavior-to-the-peoples-republic-of-china/ https://www.whitehouse.gov/briefing-room/statements-releases...

deepstack 5y ago
>> Rather than withholding them, the United States Government recognized that these vulnerabilities could pose systemic risk and the National Security Agency notified Microsoft to ensure patches were developed and released to the private sector. It is amazing that NSA had to notify Microsoft. You would thing a company with that much money like MS, they would have drop several millions on a few pen test, and independent security audit companies. Digital security will never be trust unless these things are addressed in an open transparent way.
- pletsch 5y ago
  > You would thing a company with that much money like MS, they would have drop several millions on a few pen test, and independent security audit companies. Are you under the impression that MS doesn't spend millions on security? They're currently spending roughly $1b/year. This isn't going to be fixed by "a few pen test"
  - sandworm101 5y ago
    If they are spending a billion, these flaws show that obviously isn't enough.

throwaway4good 5y ago

The EU does not accuse the Chinese government of being behind the attacks. This is the EU press statement: https://www.consilium.europa.eu/en/press/press-releases/2021/07/19/declaration-by-the-high-representative-on-behalf-of-the-eu-urging-china-to-take-action-against-malicious-cyber-activities-undertaken-from-its-territory/ https://www.consilium.europa.eu/en/press/press-releases/2021... China: Declaration by the High Representative on behalf of the European Union urging Chinese authorities to take action against malicious cyber activities undertaken from its territory

throwaway4good 5y ago
An indication that the EU does not believe the probably American intelligence assessment that these hackers operate on behalf of the Chinese government.
- krageon 5y ago
  When the US was angry with Russia everything was suddenly Russians. Now they're being difficult at China, and suddenly China is the country doing everything wrong. That anyone still takes them seriously is to my mind an incredible miracle.
  - apercu 5y ago
    Not suggesting at all that the USA is some benign superpower, but Russia is run by a criminal gang and China by a despot and a corrupt communist party. Note that I am a US citizen than expatriated after the second gulf war. So I am not a fan if the US gvmt, but if you think for a second that the Chinese and Russian governments AREN'T doing the things they are accused you are naive.
    - hungryhobo 5y ago
      just curious, have you visited china before? or seen first hand what's it actually like? you seem to have a very strong opinion, yet i'm not sure if they are based on reality or not.

_rmrf 5y ago

Why does the article use the flag of vietnam?

codetrotter 5y ago
My guess would be that the illustrator decided to zoom in on the biggest star in the Chinese flag and was unaware that this made it look like the flag of Vietnam.

nabla9 5y ago

This is messy article. There are multiple things happening at once. Attack vs. espionage are treated differently. Espionage is done with the intention is to steal information. Espionage is relatively normal between states. Condemn, file charges, then do the same back a them. Attack is when the intention is to cause harm or coerce. Ransomware, intentionally disrupting or destroying systems. Attacks from foreign government or entities acting behalf of an government are essentially acts of war. The West is condemning together "mixing" where Chinese government sanctioned groups are doing attacks for financial gain on the side. China should spy responsibly and stop attacks.

endisneigh 5y ago

why impose sanctions on Russia and not China? The article implies that allies would not agree to sanctions which is fair enough, but the USA can still do something alone, no?

pletsch 5y ago
China will probably deny it regardless of what other countries say. Beyond that, attribution isn't made by IP addresses.
dangerface 5y ago
Useually they get some of the hackers tools / code and analyse that to discover the origin. They look for strings in a foreign language but mostly the grammer of the language is used as hackers will often write comments in a foreign language to try and make it difficult to originate.
dragonelite 5y ago
Didn't vault 7 revealed the NSA had tooling to make hacks look like Russian and Chinese hacks Umbrage and the marble framework. Wouldn't be surprised they will use these hacking threats to create a western great fire wall. Pompeo already talked about it with the Clean network Initiative.

john579 5y ago

Microsoft Exchange crashes when encountering Unicode Chinese fonts. Trust Bill Gates with your data security, he's a jew.

protontorpedo 5y ago

It looks like cyber warfare, as well as espionage, is considered pretty much fair game in geopolitics nowadays. I wonder where the line is drawn that would make it an act of war. In any case, a direct attack from the Chinese government towards it's main trade partners (US, Germany and Japan among them) sounds crazy to me.

DaftDank 5y ago
I don't think it's crazy at all. We (i.e. the US) use our SIGINT abilities to spy on allies all the time, or at least according to numerous books and leaks. With that said, I'm not sure that the US government considers China an ally.
- tasogare 5y ago
  Yes, and that includes stealing trade secrets from European companies, which are nominally US allies.
- pmcollins 5y ago
  espionage != cyber warfare > attack crippled thousands of computers around the world
  - dalbasal 5y ago
    Technology has a tendency of merging realms. Whether you compromise a system to get information or to cripple it is pretty much a detail.
sidlls 5y ago
Why? China wants to build an empire and views the US as an enemy. They will use their military and intelligence forces to achieve that, just like any other country does to achieve their respective goals.
saddata 5y ago
China goes down, so does aapl and tsla and our entire economy. Until the American voter is more powerful that the collected business interests of those mega-corps, China will be our most favored trade partner, even as they commit war crimes against the American people (in theory :)

whoknowswhat11 5y ago

The amount of hot air on this topic is incredible. The US has denounced, accused, etc Russia on cyber attacks It is now calling out and accusing China of cyber attacks. My guess - ZERO concrete action. Meanwhile, China says relatively little and focuses on actual power - trade ties, threats etc.

jollybean 5y ago
There will probably big new military investments in cyber security and it will be a bigger branch of the military.
singularity2001 5y ago
knowledge IS real power, especially knowledge of how to control your opponents infrastructure

roenxi 5y ago

The US intelligence services have specific tools to fake the source of a cyberattack. I really don't know what anyone thinks "...accuse China..." means in such headlines. It could be anyone.

ppeetteerr 5y ago

There is so much doubt in this comment section around the validity of the accusations. We have a number of countries putting forward the knowledge they have mutually agreed upon. What is shared is known to a high degree of certainty. Any details that are questionable would not have been shared prematurely.

Leparamour 5y ago
China is just the bogeyman of the hour. If it were more politically convenient to blame Russia or Iran you'd suddenly find the same evidence pointing a different way.
- adflux 5y ago
  The bogeyman of the hour which is putting people into concentration camps. Would you say Nazi Germany was the bogeyman of the (then) hour aswell? IMO these are some very valid concerns...
  - curiousgal 5y ago
    Oh please. If the U.S. was so concerned about human rights violations they would stop funding Israel. Sorry dang.
    - hirako2000 5y ago
      They would also stop big bunch of other things.
    - pokot0 5y ago
      The US has too many internal problem to be the world savior. Every time the US looks outside its border, it's for its sole selfish interests. Human rights enforcement around the world is (unfortunately) not something we can reasonaly expect from US. Also the U in US is extremely optimistic. Different states would act completely differently if allowed to. The world need to look for a different hero: any proposal? (For a good laugh, I reccomend watching the excellent "When the Yogurt took over" on Netflix)

Leparamour 5y ago

Is this damage control to distract from Israeli companies NSO and Candiru being caught running malware for despots to target journalists and activists? The timing surely is peculiar.

irobeth 5y ago
This is maybe the fifth time this year I've seen Israel used as an immediate deflection subject in China-related cybersecurity news posts; is that a trend anyone else has picked up on? just me?
- adflux 5y ago
  Classic whataboutism, happens when news articles criticise Russia, China or the US very frequently.
- Leparamour 5y ago
  No, it's just you. Yesterday we had worldwide coordinated reports of shady Israeli companies getting innocent people killed and suddenly there's haphazard "breaking news" report on big bad CHHHIIIINNNAAA.
bmsd_0923 5y ago
I completely fail to see why this post was flagged. This is a legitimate question that every thinking person needs to be asking themselves right now.

ivanstame 5y ago

Go to hell with the US, this statement is just way to hypocritical.

chmod775 5y ago

I can't help but think "accuse" is a peculiar choice of words, because it implies that the accuser has any basis to feel wronged. If they had any integrity they'd say: "I guess you got us back, huh!". Entertaining to watch nonetheless.

boringg 5y ago

Would this be the first full scale assault by Chinese hackers in the supply chain that we know of? If so, it is notable that they are aggressively acting in that way (and breached).

aj3 5y ago
To my knowledge this is the first attack of this sort (shadily) attributed to China, but they have been implicated in much more important attacks, such as OPM breach ( https://en.wikipedia.org/wiki/Office_of_Personnel_Management_data_breach https://en.wikipedia.org/wiki/Office_of_Personnel_Management... ).

fqye 5y ago

The USA hasn't yet provided evidence of Huwei spying for Chinese government.

mthoms 5y ago
They’ve been caught spying to further their own business interests.
programmer_dude 5y ago
They don't need to it is a reasonable assumption that all Chinese companies are hand in glove with the Chinese military.
- justicezyx 5y ago
  If there was never evidence to anything, then it's reasonable to assume?
  - programmer_dude 5y ago
    The CCP/PLA can force any company operating within China to do its bidding. This is Chinese law. And this is common knowledge. Watch this: https://www.youtube.com/watch?v=ZrsOM8ww8ug https://www.youtube.com/watch?v=ZrsOM8ww8ug
    - DiogenesKynikos 5y ago
      First, just saying that something is legally possible does not mean that that's what occurred. Second, this isn't something China-specific. The US Federal government also has enormous power to compel companies to cooperate in surveillance. Just recall when the US government ordered Lavabit to turn over its SSL keys, so that the government could intercept Snowden's emails.
  - tablespoon 5y ago
    > If there was never evidence to anything, then it's reasonable to assume? In some cases, yes. For instance, I'm sure China wouldn't build its nuclear deterrent around some hypothetical US-made COTS "Nuclear Weapon Control System," even if there was zero evidence that system was compromised. Absence of evidence is not evidence of absence. Ditto with Huawei. IMHO, if its decision-making wasn't so addled by wishful thinking and capitalism, the US would use far less Chinese technology for this reason.

cs702 5y ago

China has been accused of hacking and/or electronic spying by other states. Russia has been accused of hacking and/or electronic spying by other states. North Korea has been accused of hacking and/or electronic spying by other states. And yes, the US and quite a few European states -- and many other countries -- have also been accused of hacking and/or electronic spying by other states[a]. All these governments are playing with explosives: The right spark at the wrong place at the wrong time can start a fire. Seemingly "minor" incidents have triggered wars in the past.[b] -- [a] Including via highly-targeted malware such as https://en.wikipedia.org/wiki/Stuxnet https://en.wikipedia.org/wiki/Stuxnet [b] For example, https://en.wikipedia.org/wiki/Pig_War_(1859) https://en.wikipedia.org/wiki/Pig_War_(1859) , https://en.wikipedia.org/wiki/Marco_Polo_Bridge_Incident https://en.wikipedia.org/wiki/Marco_Polo_Bridge_Incident , https://en.wikipedia.org/wiki/Football_War https://en.wikipedia.org/wiki/Football_War , https://en.wikipedia.org/wiki/Assassination_of_Archduke_Fran https://en.wikipedia.org/wiki/Assassination_of_Archduke_Fran... -- to name a few off the top of my head.

matheusmoreira 5y ago
Interesting to see the USA complaining about the cyberwarfare activities of other countries. As if it didn't have an entire government agency and even military branches dedicated to nothing but this.
- adventured 5y ago
  Is there any evidence the US has directed the intentional sabotage of critical energy providers and food providers in Russia or China in recent years? Russia appears to be waging an all-out cyber war against the US at this point. Putin admitted as much in the hour-long interview with NBC a month ago. He declared as openly as he possibly could have that the US would be targeted until it came to the negotiating table (they want sanctions etc. removed in exchange for stopping the attacks). So far the US appears to have been exceptionally reserved in its response, given it's a clear declaration of war by Russia to be intentionally targeting critical US infrastructure with attacks.
  - 5y ago

GaltMidas 5y ago

I don't think Chinese cyber spying is really news to anyone. What's different about this now is that the U.S., a few others and notably, NATO are specifically calling out China for it. That's a pretty heavy diplomatic change. Especially the inclusion of NATO.

jollybean 5y ago
That's the important take from this, that it's NATO meaning 1) It's national security and 2) NATO countries are acting in unison on this.

jb775 5y ago

Is anyone else sick of all this forced "connected cloud" crap? My wife just got a new Windows laptop and the amount of dark patterns they use to push people towards the Windows cloud is insane. I haven't used Windows in years, but it's glaringly clear that the entire modern Windows OS is designed around recurring monetization of users. Nowadays, Windows machines are essentially one big trojan horse waiting to either be hacked or tapped into by 3-letter agencies.

samuelizdat 5y ago

And? U.S. and key allies install backdoors in device firmware and imbedded chips from manufacturers to spy on their own citizens. Why should we care at this point? We've had over 20 years to have this conversation, too late now. lol

2OEH8eoCRo0 5y ago

Entire free world: China is hacking us. Entire comment section: b-b-but the US.

dalbasal 5y ago
...and both are relevant. China probably is "hacking us." US/NATO credibility is suspect.
- deleted 5y ago
  [deleted]
- godelski 5y ago
  That's not the problem. We shit on the US all day every day. There's also not a problem with this. The problem is that when we're talking about someone else it's being used as a defense. Honestly it doesn't even matter if the US is doing the same thing. If something is wrong it is wrong, no matter who does it. Responding to "China is hacking the US" with "But the US hacks China" doesn't accomplish anything except create arguments nor is it logically consistent because both can be bad. The "but they did it" implies the action is not bad in the first place and that a double standard is an excuse. The problem is that there is not a double standard. People are also critical of the US's use of hacking both nationally and globally. So if you're concerned with the US hacking people it is logically obvious that you'd also be concerned with China (or anyone else!) hacking people. I'm tired of this argument because it just serves the propagandists. It eliminates a real conversation happening because we can't even start one because we don't even agree on a basic premise of that things can be judged independently. Comparisons can be great, but independent judgement/criticism is also necessary.
  - dalbasal 5y ago
    What would you like to have discussed and/or judged independently? I agree that a lot of the comments here are shitposting or making reactionary equivocations. Others though, are making valid points... which you may agree with, or not. IMO, for example, the most important part of this to pay attention to is NATO. Cybersecurity & China seem to be the new focus of the alliance. To me, this seems like the most potentially impactful aspect.. and probably a key reason why this announcement was made in the way that it was made. IE, I think that what NATO do in the coming few years will make the history books, rather than Chinese cyberattacks. I may be wrong, but this isn't a disingenuous equivocation. It's just my judgement on this, at this point.

HaloZero 5y ago

I recommend reading "The Perfect Weapon: How the Cyber Arms Race Set the World Afire" if you're interested in learning more about cyberattacks over the past decade and the geopolitics of it cyberattacks.

deleted 5y ago
[deleted]

futevolei 5y ago

Are there similar stories in China about Chinese companies being hacked by the US gov? Do Chinese people get outraged over them or does game recognize game? Do Chinese companies have hacking divisions?

LatteLazy 5y ago

Let's assume this is true for a moment. Now what? China have: * crushed protest at home and moved deeper into dictatorship * shat all over the 1 country 2 systems agreement and strangled what little democracy there was in HK * started a mini ground war with their nuclear armed neighbour India * launched multiple pandemics, the latest costing the world trillions in lost output and millions of deaths * started a Genocide internally And were not willing to do anything are we? No so much as a sanction or an embargo except for Australia, who've been left to twist in the wind. So now China hacked some shit? Great. What are we gonna do? Nothing because no one wants to pay interest on their borrowing or 3p more for pointless plastic shit they don't need from amazon. /Rant.

Seb-C 5y ago

http://webcache.googleusercontent.com/search?q=cache:https://www.axios.com/china-cyberattacks-nato-181e71d2-7414-45f3-9463-c8b1d46392c1.html http://webcache.googleusercontent.com/search?q=cache:https:/...