7 ms·

CISA, NSA, FBI Release Advisory Warning of BlackTech, PRC-Linked Cyber Activity

165 points by fortran77 3y ago

diogenes4 3y ago
What evidence do they have?
- creato 3y ago
  If you don’t believe them, you’re free to ignore the advisory.
  - marricks 3y ago
    Surely you see how evidence is necessary for something to be believed right
    - foota 3y ago
      It's a warning, you don't even have to believe it to take action. If someone told me a missile was going to hit my apartment I probably wouldn't believe them, but I might go grab coffee
      - sebastiennight 3y ago
        I can tell you with full sincerity that no missile is going to hit the one of these two places (home and coffee shop) where you won't be at 8PM. Now maybe I'm with the NSA and I know where you'll be. Maybe I'm just an informant and I know where the NSA thinks you'll be. What will you do?
      - CamperBob2 3y ago
        Foota, a missile is going to hit your apartment. Really! You can believe me! Unlike the NSA, I have no history of lying to you! Hope there's a 24-hour Starbucks close by (but not too close).
    - creato 3y ago
      That depends on what is being asked of me as a consequence. Read the actual advisory: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-270a https://www.cisa.gov/news-events/cybersecurity-advisories/aa... If I administered commercial routers, the request would seem reasonable to me.
    - theultdev 3y ago
      One if by land, two if by sea. Either way, let's wait for the video, I don't believe Paul that the Brits are here.
    - huytersd 3y ago
      Not necessarily. That’s where trust and reputation comes in and in this case I’m willing to believe the agencies.
      - shmde 3y ago
        > Trust and Reputation > 3 Letter Agencies Pick one.
        threeseed 3y ago
        The world isn't black or white.
    - bitshiftfaced 3y ago
      Depending on how we model a system, we don't necessarily need direct evidence in order for indirect events to influence our beliefs (see: abductive reasoning).
- rockskon 3y ago
  For something like this - the NSA and FBI have been trying to gain industry trust by releasing these advisories. The NSA at least has publicly admitted to this being one of the big reasons they do so given they've not managed to regain trust post-Snowden. They have no incentive to lie here. But see this for what it is: An attempt at gaining trust so more people will voluntarily work with them and give them data.
  - boomboomsubban 3y ago
    I do not understand your position. "The trust they gain from making this unsourced claim is a clear benefit, so they have no incentive to lie about it." Wouldn't the gained trust be an incentive? You could argue if they lied the incentive wouldn't be worth the risk, but proving they lied about this would be difficult and that's a seperate argument from the one you made.
    - rockskon 3y ago
      I am arguing the incentive to lie isn't worth the risk in this case. And they're not likely to give sources because of the whole "protecting sources and methods" bias they have to not reveal how they know what they know. I'm making an argument about their motive here. The damage they'd face from lying is great (what if another leak comes out? What if a backdoor is found in the patch communicating with NSA infrastructure?) and the possible benefit relatively small.
      - roenxi 3y ago
        These people lie professionally. It is their job to conceal and misrepresent their activities. They've lied to everyone already at some point. They certainly lie to people outside the US, they've lied to people in the US, they've lied to their oversight committees in Congress and they've lied to the president. It seems likely they're lying to each other for office politics reasons. How are they supposed to take damage from lying? They have no credibility to lose. The NSA Wikipedia page takes a while to scroll through and is a saga of backdoors and skullduggery. "Spies lied, news at 11" will read the headline. I'm not saying this specific thing is true or not, what do I know. But if it turned out to be a lie, who could claim to be surprised? It has entered the public record that they developed tech to pretend to be foreigners like the PRC when conducting their cybercrime activities.
- kube-system 3y ago
  The link at the bottom of the article has a pretty good explanation of how it works and how to mitigate it. What part of it exactly do you need evidence for?
- 2OEH8eoCRo0 3y ago
  If you were actually interested in evidence you'd be able to find it, as I have, in a minute or two of following links. For example: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-270a https://www.cisa.gov/news-events/cybersecurity-advisories/aa... https://attack.mitre.org/versions/v13/techniques/T1021/004/ https://attack.mitre.org/versions/v13/techniques/T1021/004/ > G0098 BlackTech BlackTech has used Putty for remote access.[2] https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/palmerworm-blacktech-espionage-apt https://symantec-enterprise-blogs.security.com/blogs/threat-... > The Threat Hunter Team at Symantec, a division of Broadcom (NASDAQ: AVGO), has uncovered a new espionage campaign carried out by the Palmerworm group (aka BlackTech) involving a brand new suite of custom malware, targeting organizations in Japan, Taiwan, the U.S., and China.
ksec 3y ago
>Advisory helps organizations protect against PRC-linked actors hiding in router firmware The most popular router brand is TP-Link which is a Chinese Brand. Both Eero and Nest from Amazon to Google aren't available worldwide. Netgear and Linksys has poor Firmware update frequency. That is pretty much left with ASUS which I have a decade old unfix bug with my ISP that randomly fails to get new IP. I only wish Apple would come back with new AirPort Extreme.
- nubinetwork 3y ago
  Mikrotik?
  - godzillabrennus 3y ago
    Do those things come setup for a normal smb out of the box yet or is it build your own NAT still to use one?
    - webdoodle 3y ago
      Almost nothing about MicroTik can be described as "out of the box" or easy, but they can be configured to do SMB using the onboard USB connector. https://www.youtube.com/watch?v=YDdTSswDu8I https://www.youtube.com/watch?v=YDdTSswDu8I
    - nullify88 3y ago
      They have a default configuration applied when they are first powered on after a reset which includes wan, lan and nat setup. Possibly some basic firewall setup though I cant recall.
- ruined 3y ago
  the linked documents indicate several brands, none of which are tp-link.
- throwoutway 3y ago
  Unifi has both enterprise and consumer routers...
yfiapo 3y ago
The link goes to the press release. The actual advisory (https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-270a https://www.cisa.gov/news-events/cybersecurity-advisories/aa...), linked from the press release, contains quite a bit more detail. They detail how they have observed Cisco routers being backdoored but don't limit the issue to that manufacturer.
- 0xDEAFBEAD 3y ago
  >BlackTech actors bypass the router's built-in security features by first installing older legitimate firmware [T1601.002] that they then modify in memory to allow the installation of a modified, unsigned bootloader and modified, unsigned firmware [T1601.001]. I wonder how best to handle this kind of downgrade attack. Is reverting to an older firmware version an intended, supported feature? If so, I assume it's present in case the customer has a problem with the latest firmware and they want to revert. Maybe it makes sense to implement some restrictions on reversions -- e.g. they can only be done with physical access to the device, and it becomes impossible after an upgrade has been in place for 1 month say. The focus on international subsidiaries was very interesting to me. I wonder what, specifically, it is about a subsidiary that makes it a softer target. Perhaps it's easier to gain physical access to a subsidiary office.
  - Abby0 3y ago
    Actually, the current router I have does have a security feature that prevents the user from downgrading the firmware. I think its more common on recent routers as well.
  - slimsag 3y ago
    Just do what game consoles do: add hardware fuses that are expected to be blown depending on the version, and have the bootloader verify the number of fuses blown on boot. Then the device becomes a brick if it tries to boot an older firmware.
    - loeg 3y ago
      Really bad customer experience if there is a regression in a new firmware version, though.
chaostheory 3y ago
If there is a war (hot or cold) with China, I doubt consumer tech will be spared as much as I love my Govee and TCL smart devices.
- dmix 3y ago
  Where was Russias great cyber warfare teams? They wouldn't have held back against consumer devices. From what I've read western agencies helped Ukraine and the cyber efforts were mostly neutered. It's one thing to be a random org in peace time but in war the deep penetration into Chinese networks will have exposed plenty of Chinese efforts not yet disrupted and all that was super secret and careful before turns into open warfare. So it's not like the west is going in blind. The US spends mountains on this stuff, not including the mass of western commercial infosec companies tracking these critical "threat groups" as their business model. NSA is huge as it is and who knows how many federal and DOD agencies have cyber mandates these days. All systems are inherently vulnerable but some mass back doors in routers has been speculated to death by people way smarter than me and most I've read is that the risk is largely over stated to the civilian population. The router doomsday scenarios are always super hand wavvy in the details.
  - chaostheory 3y ago
    > Where was Russias great cyber warfare teams? They wouldn't have held back against consumer devices. The difference is that we’re fighting a proxy war with Russia over Ukraine. With Taiwan, it will be a direct war due to the security guarantees we have given Taiwan.
  - jstarfish 3y ago
    > Where was Russias great cyber warfare teams? They wouldn't have held back against consumer devices. I don't think their goal has ever been sabotage as much as it has been intelligence gathering, but I suspect a lot of their efforts have gone underreported. Russia did successfully brick thousands of consumer satellite modems to disrupt communications in the opening hours of the Ukraine campaign. Everybody reported on Elon Musk swooping in and playing savior, but they acted like he's the first person to bring satellite service to Ukraine and neglected to mention incumbent ISPs' devices operating in the area had been destroyed in targeted cyberattacks (later, Russia went low-tech and just started lobbing artillery at ground stations). Because of this oversight, nobody really understood why he pulled the service from the front lines-- he saw what Russia was capable of and didn't want Starlink to become a military target itself.
AnonCoward42 3y ago
It's always Cisco routers. The question might be naïve, but are Cisco routers inherently insecure at this point? I know Cisco is also the biggest target and it's obvious that consumer routers are less secure, but at this point the amount of backdoors in Cisco routers raises the question if there is another player that has better security. Honest question: Is it just selective awareness or are Cisco routers not the best option when it comes to security (for higher profile targets)? edit: replace "a bad" with "not the best"
- Abby0 3y ago
  Cisco has poor software quality and control when it comes to IOS (Cisco OS not Apple's iOS) implementation that differs based on the end client or customer using their networking devices. This includes small/medium companies, universities, Large enterprise, Internet service providers, Data center, network storage...etc. Each of the previously mentioned groups have their own implementation and licenses for specific IOS version running inside the network device (whether a Firewall, Router, Switch, or Switch with routing capabilities...etc). It has been long known that Cisco's poor software is due to the hundreds of modules/features they try to support on these devices (you never know which device will receive updates and for how long). System administrators/Network Engineers alike always complain about the poor quality of Cisco's Software[1][2] [1] https://www.reddit.com/r/sysadmin/comments/cpcxjx/has_cisco_gone_mad/ https://www.reddit.com/r/sysadmin/comments/cpcxjx/has_cisco_... [2] https://www.reddit.com/r/networking/comments/137csr0/why_the_hate_for_cisco/ https://www.reddit.com/r/networking/comments/137csr0/why_the...
- trasz4 3y ago
  [dead]
- TacticalCoder 3y ago
  > It's always Cisco routers A few weeks ago it was all about Unifi (and many others) being backdoored due to some upstream supplier being pwned by the NSA. So it's not only Cisco. It's all of them.
  - dpcx 3y ago
rurban 3y ago
Last week I read about this firmware downgrading trick (Cisco et al) in active spyware from a north korean group. Was it a spanish target?
achrono 3y ago
Why "PRC-Linked" and not "Chinese"? They don't seem to hesitate to use demonyms -- they do use 'Japanese' for example (https://www.cisa.gov/news-events/alerts/2023/09/27/nsa-fbi-cisa-and-japanese-partners-release-advisory-prc-linked-cyber-actors https://www.cisa.gov/news-events/alerts/2023/09/27/nsa-fbi-c...).
- millzlane 3y ago
  FTA: People’s Republic of China (PRC)-linked cyber actors known as BlackTech I think that is the lingua franca used when referring to China.
  - achrono 3y ago
    If it were part of the lingua franca, "PRC" would be as easily recognizable as saying "US" or even "NZ" -- on the street or in the boardroom. Do you really think that is the case?
    - QuarterReptile 3y ago
      I think PRC is more easily recognizable than NZ, yes, but I'm willing to surmise that NZ means New Zealand.
- jlund-molfese 3y ago
  One simple reason is that there are 2 Chinas, but only 1 Japan. The specificity adds clarity, especially with a global audience. It’s very hard to misinterpret “PRC”, while “Chinese” is more ambiguous. And obviously you want to be more careful with negative statements like “Chinese Hackers” than positive ones like “Japanese (state) Partners.
  - achrono 3y ago
    1. What are the 2 Chinas? 2. Re being more careful with negative statements -- they are clearly unable to do so consistently, see below: [1] Look at the very clear headlines featuring "Iranian Government-Sponsored APT Actors" in https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-320a https://www.cisa.gov/news-events/cybersecurity-advisories/aa... and "Iranian State Actor" in https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-264a https://www.cisa.gov/news-events/cybersecurity-advisories/aa... [2] Again, look at the very clear headlines featuring "Russian State-Sponsored" in https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-110a https://www.cisa.gov/news-events/cybersecurity-advisories/aa... Why are they not equally 'careful' here? Why are they not using the country's "official" names such as IRI (Islamic Republic of Iran) or RF (Russian Federation)? Note that I'm not even going into the rabbit hole of "PRC-Linked" vs "Iranian Government-Sponsored" -- although that is perfectly worth questioning also, because if you go into the actual article on Iran, they weasel out by saying "likely Iranian government-sponsored APT", whereas here it's only "PRC-linked" because we do not know for sure.
user3939382 3y ago
Wow a trifecta of organizations I don't trust that actively work to undermine our democracy and rights.
- loeg 3y ago
  Which one of the four named in the title are you leaving out?

165 points by fortran77 3y ago

diogenes4 3y ago

What evidence do they have?

creato 3y ago
If you don’t believe them, you’re free to ignore the advisory.
- marricks 3y ago
  Surely you see how evidence is necessary for something to be believed right
  - foota 3y ago
    It's a warning, you don't even have to believe it to take action. If someone told me a missile was going to hit my apartment I probably wouldn't believe them, but I might go grab coffee
    - sebastiennight 3y ago
      I can tell you with full sincerity that no missile is going to hit the one of these two places (home and coffee shop) where you won't be at 8PM. Now maybe I'm with the NSA and I know where you'll be. Maybe I'm just an informant and I know where the NSA thinks you'll be. What will you do?
    - CamperBob2 3y ago
      Foota, a missile is going to hit your apartment. Really! You can believe me! Unlike the NSA, I have no history of lying to you! Hope there's a 24-hour Starbucks close by (but not too close).
  - creato 3y ago
    That depends on what is being asked of me as a consequence. Read the actual advisory: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-270a https://www.cisa.gov/news-events/cybersecurity-advisories/aa... If I administered commercial routers, the request would seem reasonable to me.
  - theultdev 3y ago
    One if by land, two if by sea. Either way, let's wait for the video, I don't believe Paul that the Brits are here.
  - huytersd 3y ago
    Not necessarily. That’s where trust and reputation comes in and in this case I’m willing to believe the agencies.
    - shmde 3y ago
      > Trust and Reputation > 3 Letter Agencies Pick one.
      - threeseed 3y ago
        The world isn't black or white.
  - bitshiftfaced 3y ago
    Depending on how we model a system, we don't necessarily need direct evidence in order for indirect events to influence our beliefs (see: abductive reasoning).
rockskon 3y ago
For something like this - the NSA and FBI have been trying to gain industry trust by releasing these advisories. The NSA at least has publicly admitted to this being one of the big reasons they do so given they've not managed to regain trust post-Snowden. They have no incentive to lie here. But see this for what it is: An attempt at gaining trust so more people will voluntarily work with them and give them data.
- boomboomsubban 3y ago
  I do not understand your position. "The trust they gain from making this unsourced claim is a clear benefit, so they have no incentive to lie about it." Wouldn't the gained trust be an incentive? You could argue if they lied the incentive wouldn't be worth the risk, but proving they lied about this would be difficult and that's a seperate argument from the one you made.
  - rockskon 3y ago
    I am arguing the incentive to lie isn't worth the risk in this case. And they're not likely to give sources because of the whole "protecting sources and methods" bias they have to not reveal how they know what they know. I'm making an argument about their motive here. The damage they'd face from lying is great (what if another leak comes out? What if a backdoor is found in the patch communicating with NSA infrastructure?) and the possible benefit relatively small.
    - roenxi 3y ago
      These people lie professionally. It is their job to conceal and misrepresent their activities. They've lied to everyone already at some point. They certainly lie to people outside the US, they've lied to people in the US, they've lied to their oversight committees in Congress and they've lied to the president. It seems likely they're lying to each other for office politics reasons. How are they supposed to take damage from lying? They have no credibility to lose. The NSA Wikipedia page takes a while to scroll through and is a saga of backdoors and skullduggery. "Spies lied, news at 11" will read the headline. I'm not saying this specific thing is true or not, what do I know. But if it turned out to be a lie, who could claim to be surprised? It has entered the public record that they developed tech to pretend to be foreigners like the PRC when conducting their cybercrime activities.
kube-system 3y ago
The link at the bottom of the article has a pretty good explanation of how it works and how to mitigate it. What part of it exactly do you need evidence for?
2OEH8eoCRo0 3y ago
If you were actually interested in evidence you'd be able to find it, as I have, in a minute or two of following links. For example: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-270a https://www.cisa.gov/news-events/cybersecurity-advisories/aa... https://attack.mitre.org/versions/v13/techniques/T1021/004/ https://attack.mitre.org/versions/v13/techniques/T1021/004/ > G0098 BlackTech BlackTech has used Putty for remote access.[2] https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/palmerworm-blacktech-espionage-apt https://symantec-enterprise-blogs.security.com/blogs/threat-... > The Threat Hunter Team at Symantec, a division of Broadcom (NASDAQ: AVGO), has uncovered a new espionage campaign carried out by the Palmerworm group (aka BlackTech) involving a brand new suite of custom malware, targeting organizations in Japan, Taiwan, the U.S., and China.

ksec 3y ago

>Advisory helps organizations protect against PRC-linked actors hiding in router firmware The most popular router brand is TP-Link which is a Chinese Brand. Both Eero and Nest from Amazon to Google aren't available worldwide. Netgear and Linksys has poor Firmware update frequency. That is pretty much left with ASUS which I have a decade old unfix bug with my ISP that randomly fails to get new IP. I only wish Apple would come back with new AirPort Extreme.

nubinetwork 3y ago
Mikrotik?
- godzillabrennus 3y ago
  Do those things come setup for a normal smb out of the box yet or is it build your own NAT still to use one?
  - webdoodle 3y ago
    Almost nothing about MicroTik can be described as "out of the box" or easy, but they can be configured to do SMB using the onboard USB connector. https://www.youtube.com/watch?v=YDdTSswDu8I https://www.youtube.com/watch?v=YDdTSswDu8I
  - nullify88 3y ago
    They have a default configuration applied when they are first powered on after a reset which includes wan, lan and nat setup. Possibly some basic firewall setup though I cant recall.
ruined 3y ago
the linked documents indicate several brands, none of which are tp-link.
throwoutway 3y ago
Unifi has both enterprise and consumer routers...

yfiapo 3y ago

The link goes to the press release. The actual advisory (https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-270a https://www.cisa.gov/news-events/cybersecurity-advisories/aa...), linked from the press release, contains quite a bit more detail. They detail how they have observed Cisco routers being backdoored but don't limit the issue to that manufacturer.

0xDEAFBEAD 3y ago
>BlackTech actors bypass the router's built-in security features by first installing older legitimate firmware [T1601.002] that they then modify in memory to allow the installation of a modified, unsigned bootloader and modified, unsigned firmware [T1601.001]. I wonder how best to handle this kind of downgrade attack. Is reverting to an older firmware version an intended, supported feature? If so, I assume it's present in case the customer has a problem with the latest firmware and they want to revert. Maybe it makes sense to implement some restrictions on reversions -- e.g. they can only be done with physical access to the device, and it becomes impossible after an upgrade has been in place for 1 month say. The focus on international subsidiaries was very interesting to me. I wonder what, specifically, it is about a subsidiary that makes it a softer target. Perhaps it's easier to gain physical access to a subsidiary office.
- Abby0 3y ago
  Actually, the current router I have does have a security feature that prevents the user from downgrading the firmware. I think its more common on recent routers as well.
- slimsag 3y ago
  Just do what game consoles do: add hardware fuses that are expected to be blown depending on the version, and have the bootloader verify the number of fuses blown on boot. Then the device becomes a brick if it tries to boot an older firmware.
  - loeg 3y ago
    Really bad customer experience if there is a regression in a new firmware version, though.

chaostheory 3y ago

If there is a war (hot or cold) with China, I doubt consumer tech will be spared as much as I love my Govee and TCL smart devices.

dmix 3y ago
Where was Russias great cyber warfare teams? They wouldn't have held back against consumer devices. From what I've read western agencies helped Ukraine and the cyber efforts were mostly neutered. It's one thing to be a random org in peace time but in war the deep penetration into Chinese networks will have exposed plenty of Chinese efforts not yet disrupted and all that was super secret and careful before turns into open warfare. So it's not like the west is going in blind. The US spends mountains on this stuff, not including the mass of western commercial infosec companies tracking these critical "threat groups" as their business model. NSA is huge as it is and who knows how many federal and DOD agencies have cyber mandates these days. All systems are inherently vulnerable but some mass back doors in routers has been speculated to death by people way smarter than me and most I've read is that the risk is largely over stated to the civilian population. The router doomsday scenarios are always super hand wavvy in the details.
- chaostheory 3y ago
  > Where was Russias great cyber warfare teams? They wouldn't have held back against consumer devices. The difference is that we’re fighting a proxy war with Russia over Ukraine. With Taiwan, it will be a direct war due to the security guarantees we have given Taiwan.
- jstarfish 3y ago
  > Where was Russias great cyber warfare teams? They wouldn't have held back against consumer devices. I don't think their goal has ever been sabotage as much as it has been intelligence gathering, but I suspect a lot of their efforts have gone underreported. Russia did successfully brick thousands of consumer satellite modems to disrupt communications in the opening hours of the Ukraine campaign. Everybody reported on Elon Musk swooping in and playing savior, but they acted like he's the first person to bring satellite service to Ukraine and neglected to mention incumbent ISPs' devices operating in the area had been destroyed in targeted cyberattacks (later, Russia went low-tech and just started lobbing artillery at ground stations). Because of this oversight, nobody really understood why he pulled the service from the front lines-- he saw what Russia was capable of and didn't want Starlink to become a military target itself.

AnonCoward42 3y ago

It's always Cisco routers. The question might be naïve, but are Cisco routers inherently insecure at this point? I know Cisco is also the biggest target and it's obvious that consumer routers are less secure, but at this point the amount of backdoors in Cisco routers raises the question if there is another player that has better security. Honest question: Is it just selective awareness or are Cisco routers not the best option when it comes to security (for higher profile targets)? edit: replace "a bad" with "not the best"

Abby0 3y ago
Cisco has poor software quality and control when it comes to IOS (Cisco OS not Apple's iOS) implementation that differs based on the end client or customer using their networking devices. This includes small/medium companies, universities, Large enterprise, Internet service providers, Data center, network storage...etc. Each of the previously mentioned groups have their own implementation and licenses for specific IOS version running inside the network device (whether a Firewall, Router, Switch, or Switch with routing capabilities...etc). It has been long known that Cisco's poor software is due to the hundreds of modules/features they try to support on these devices (you never know which device will receive updates and for how long). System administrators/Network Engineers alike always complain about the poor quality of Cisco's Software[1][2] [1] https://www.reddit.com/r/sysadmin/comments/cpcxjx/has_cisco_gone_mad/ https://www.reddit.com/r/sysadmin/comments/cpcxjx/has_cisco_... [2] https://www.reddit.com/r/networking/comments/137csr0/why_the_hate_for_cisco/ https://www.reddit.com/r/networking/comments/137csr0/why_the...
trasz4 3y ago
[dead]
TacticalCoder 3y ago
> It's always Cisco routers A few weeks ago it was all about Unifi (and many others) being backdoored due to some upstream supplier being pwned by the NSA. So it's not only Cisco. It's all of them.
- dpcx 3y ago

rurban 3y ago

Last week I read about this firmware downgrading trick (Cisco et al) in active spyware from a north korean group. Was it a spanish target?

achrono 3y ago

Why "PRC-Linked" and not "Chinese"? They don't seem to hesitate to use demonyms -- they do use 'Japanese' for example (https://www.cisa.gov/news-events/alerts/2023/09/27/nsa-fbi-cisa-and-japanese-partners-release-advisory-prc-linked-cyber-actors https://www.cisa.gov/news-events/alerts/2023/09/27/nsa-fbi-c...).

millzlane 3y ago
FTA: People’s Republic of China (PRC)-linked cyber actors known as BlackTech I think that is the lingua franca used when referring to China.
- achrono 3y ago
  If it were part of the lingua franca, "PRC" would be as easily recognizable as saying "US" or even "NZ" -- on the street or in the boardroom. Do you really think that is the case?
  - QuarterReptile 3y ago
    I think PRC is more easily recognizable than NZ, yes, but I'm willing to surmise that NZ means New Zealand.
jlund-molfese 3y ago
One simple reason is that there are 2 Chinas, but only 1 Japan. The specificity adds clarity, especially with a global audience. It’s very hard to misinterpret “PRC”, while “Chinese” is more ambiguous. And obviously you want to be more careful with negative statements like “Chinese Hackers” than positive ones like “Japanese (state) Partners.
- achrono 3y ago
  1. What are the 2 Chinas? 2. Re being more careful with negative statements -- they are clearly unable to do so consistently, see below: [1] Look at the very clear headlines featuring "Iranian Government-Sponsored APT Actors" in https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-320a https://www.cisa.gov/news-events/cybersecurity-advisories/aa... and "Iranian State Actor" in https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-264a https://www.cisa.gov/news-events/cybersecurity-advisories/aa... [2] Again, look at the very clear headlines featuring "Russian State-Sponsored" in https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-110a https://www.cisa.gov/news-events/cybersecurity-advisories/aa... Why are they not equally 'careful' here? Why are they not using the country's "official" names such as IRI (Islamic Republic of Iran) or RF (Russian Federation)? Note that I'm not even going into the rabbit hole of "PRC-Linked" vs "Iranian Government-Sponsored" -- although that is perfectly worth questioning also, because if you go into the actual article on Iran, they weasel out by saying "likely Iranian government-sponsored APT", whereas here it's only "PRC-linked" because we do not know for sure.

user3939382 3y ago

Wow a trifecta of organizations I don't trust that actively work to undermine our democracy and rights.

loeg 3y ago
Which one of the four named in the title are you leaving out?