4 ms·

Due to the level of control the Chinese government imposes on all the corporations within it, is it fair to say that such acts can't be done without the cooper

Due to the level of control the Chinese government imposes on all the corporations within it, is it fair to say that such acts can't be done without the cooperation on some level of the govt? As opposed to many western countries where the companies might be patriotic, but they have minimal fear of taking on the government in general in the courts if they feel they are in the right. Perhaps Chinese companies have the same feeling of freedom, do they?

throwaway4good 5y ago
No. It is not. China is a big country and the Chinese government does not control everything that is going on. Most hacking is done by kids with computers and uses trivial exploits: easy to guess passwords or security holes that are left unpatched for years after they are documented. Fairly regularly I get a phone call from a guy with a strong accent claiming to be from Microsoft support. No one blames the Indian or Bangladeshi government for that. Yet it is different for Russia and China.
- Proven 5y ago
  > China is a big country and the Chinese government does not control everything that is going on. Yeah - just look at the sheer number of cyberattacks originating from mainland China targeting CCP and state owned enterprises! > Yet it is different for Russia and China. It's not, it's different only for mainland China. There are no indications Russia monitors outgoing Internet traffic nearly as closely as CCP.
- sidlls 5y ago
  You're being deliberately obtuse about this. The simplest explanation for cyberattacks against high-profile targets coming out of countries like China (or the US, for that matter) isn't "rando script-kiddies having a laugh ha ha!". It's that their government intelligence forces did it. This kind of attempted misdirection is really common from people defending/spreading propaganda for the Chinese government. It's also similar to the excuses made when business partners with heavy government influence conduct scans and do other questionable things against US infrastructure. Apparently they think westerners are all too stupid or blind to understand what's happening. It's ridiculous.
  - boomboomsubban 5y ago
    Why is it deliberately obtuse to think that some of China's billion people could be independent black hat hackers? Are they incapable of being evil or greedy?
    - sidlls 5y ago
      They're not incapable of either. Are they as motivated as the government? In general, no. Genocidal dictatorships are more motivated than random script kiddies and "evil" black hat hackers to go after high profile government and government-adjacent (infrastructure) targets.
      - boomboomsubban 5y ago
        As the other commenter pointed out, these weren't really high profile targets. Hell, security groups found evidence they were planning to mine crypto on some of the servers. You don't need to be purposefully ignorant to question if private hackers were involved.
  - aj3 5y ago
    What you're missing is that these attacks weren't targeted. They scanned internet and processed pretty much all accessible Exchange servers in the same manner. There were a few crews operating in parallel by the way which had access to same exploit chain but different exploits. Some had certain variables hardcoded, e.g. Administrator user's name and their exploits worked with higher success rate in anglosphere, but failed in localized environments. Others had more advanced exploits which queried parameters instead of assuming them - those where more successful around the globe. Another nuance missing from popular press is that most groups in China (and Russia) are operating independently, but share tradecraft among them and occasionally engage with politicized missions (either working on explicit orders from government handlers or simply defending their beliefs hacktivist-style). This is what FireEye means by "affiliation with Chinese government", NOT "operates strictly on government orders".
- dmhmr 5y ago
  APT 40 and 31 are well documented [1] [2]. [1] https://www.fireeye.com/blog/threat-research/2019/03/apt40-examining-a-china-nexus-espionage-actor.html https://www.fireeye.com/blog/threat-research/2019/03/apt40-e... [2] https://research.checkpoint.com/2021/the-story-of-jian/ https://research.checkpoint.com/2021/the-story-of-jian/
- wyuenho 5y ago
  Whether the Chinese government has control over these APTs, the crime originated on Chinese soil, and it's their responsibility to deal with these threats. What's so hard for you to understand?
  - sudosysgen 5y ago
    I don't think this makes much sense. We don't even know if the APTs actually do operate on Chinese soil, much less that the Chinese government condones them. All we know is that they used Chinese IPs at some point and Chinese configured computers, and that they went after military targets. And we don't even know that these are the same APTs.
    - wyuenho 5y ago
      Yes we do. https://www.justice.gov/opa/pr/four-chinese-nationals-working-ministry-state-security-charged-global-computer-intrusion https://www.justice.gov/opa/pr/four-chinese-nationals-workin...
- woah 5y ago
  Chinese citizens cannot even mention recent historical events on in private messages on the internet without approval from the government, and you're trying to tell us that some "kids with computers" were able to carry out a sophisticated years-long cyberattack? "Kids with computers" might be plausible in a free country, but not in China.
  - aj3 5y ago
    You obviously haven't met Chinese infosec researchers, have no knowledge about Chinese underground and are simply speaking from your biases.
godelski 5y ago
> Due to the level of control the Chinese government imposes on all the corporations within it, is it fair to say that such acts can't be done without the cooperation on some level of the govt? Honestly even without the government imposing so much control on corporations I believe it is fair to say that the acts can't be done without cooperation on some level of the government. If there's an elite group of hackers in your country attacking a country and generating ill will then a hands off approach is condoning the action. The only way to condemn the action is to work with said country to apprehend said hackers. But headlines aren't "US and China work together to apprehend rogue elite hacking group."

throwaway4good 5y ago

No. It is not. China is a big country and the Chinese government does not control everything that is going on. Most hacking is done by kids with computers and uses trivial exploits: easy to guess passwords or security holes that are left unpatched for years after they are documented. Fairly regularly I get a phone call from a guy with a strong accent claiming to be from Microsoft support. No one blames the Indian or Bangladeshi government for that. Yet it is different for Russia and China.

Proven 5y ago
> China is a big country and the Chinese government does not control everything that is going on. Yeah - just look at the sheer number of cyberattacks originating from mainland China targeting CCP and state owned enterprises! > Yet it is different for Russia and China. It's not, it's different only for mainland China. There are no indications Russia monitors outgoing Internet traffic nearly as closely as CCP.
sidlls 5y ago
You're being deliberately obtuse about this. The simplest explanation for cyberattacks against high-profile targets coming out of countries like China (or the US, for that matter) isn't "rando script-kiddies having a laugh ha ha!". It's that their government intelligence forces did it. This kind of attempted misdirection is really common from people defending/spreading propaganda for the Chinese government. It's also similar to the excuses made when business partners with heavy government influence conduct scans and do other questionable things against US infrastructure. Apparently they think westerners are all too stupid or blind to understand what's happening. It's ridiculous.
- boomboomsubban 5y ago
  Why is it deliberately obtuse to think that some of China's billion people could be independent black hat hackers? Are they incapable of being evil or greedy?
  - sidlls 5y ago
    They're not incapable of either. Are they as motivated as the government? In general, no. Genocidal dictatorships are more motivated than random script kiddies and "evil" black hat hackers to go after high profile government and government-adjacent (infrastructure) targets.
    - boomboomsubban 5y ago
      As the other commenter pointed out, these weren't really high profile targets. Hell, security groups found evidence they were planning to mine crypto on some of the servers. You don't need to be purposefully ignorant to question if private hackers were involved.
- aj3 5y ago
  What you're missing is that these attacks weren't targeted. They scanned internet and processed pretty much all accessible Exchange servers in the same manner. There were a few crews operating in parallel by the way which had access to same exploit chain but different exploits. Some had certain variables hardcoded, e.g. Administrator user's name and their exploits worked with higher success rate in anglosphere, but failed in localized environments. Others had more advanced exploits which queried parameters instead of assuming them - those where more successful around the globe. Another nuance missing from popular press is that most groups in China (and Russia) are operating independently, but share tradecraft among them and occasionally engage with politicized missions (either working on explicit orders from government handlers or simply defending their beliefs hacktivist-style). This is what FireEye means by "affiliation with Chinese government", NOT "operates strictly on government orders".
dmhmr 5y ago
APT 40 and 31 are well documented [1] [2]. [1] https://www.fireeye.com/blog/threat-research/2019/03/apt40-examining-a-china-nexus-espionage-actor.html https://www.fireeye.com/blog/threat-research/2019/03/apt40-e... [2] https://research.checkpoint.com/2021/the-story-of-jian/ https://research.checkpoint.com/2021/the-story-of-jian/
wyuenho 5y ago
Whether the Chinese government has control over these APTs, the crime originated on Chinese soil, and it's their responsibility to deal with these threats. What's so hard for you to understand?
- sudosysgen 5y ago
  I don't think this makes much sense. We don't even know if the APTs actually do operate on Chinese soil, much less that the Chinese government condones them. All we know is that they used Chinese IPs at some point and Chinese configured computers, and that they went after military targets. And we don't even know that these are the same APTs.
  - wyuenho 5y ago
    Yes we do. https://www.justice.gov/opa/pr/four-chinese-nationals-working-ministry-state-security-charged-global-computer-intrusion https://www.justice.gov/opa/pr/four-chinese-nationals-workin...
woah 5y ago
Chinese citizens cannot even mention recent historical events on in private messages on the internet without approval from the government, and you're trying to tell us that some "kids with computers" were able to carry out a sophisticated years-long cyberattack? "Kids with computers" might be plausible in a free country, but not in China.
- aj3 5y ago
  You obviously haven't met Chinese infosec researchers, have no knowledge about Chinese underground and are simply speaking from your biases.

godelski 5y ago

> Due to the level of control the Chinese government imposes on all the corporations within it, is it fair to say that such acts can't be done without the cooperation on some level of the govt? Honestly even without the government imposing so much control on corporations I believe it is fair to say that the acts can't be done without cooperation on some level of the government. If there's an elite group of hackers in your country attacking a country and generating ill will then a hands off approach is condoning the action. The only way to condemn the action is to work with said country to apprehend said hackers. But headlines aren't "US and China work together to apprehend rogue elite hacking group."