29 ms·

Chinese Hackers Infiltrate New York Times Computers

fatjokes 14y ago
"Security experts found evidence that the hackers stole the corporate passwords for every Times employee and used those to gain access to the personal computers of 53 employees" Does this mean the NYTimes is storing passwords in plaintext?
- Hilyin 14y ago
  I think if they have the ability to steal the passwords, even if they weren't plain text, they didn't do the proper precautions of encrypting with a salt. So either way, they failed.
  - betterunix 14y ago
    At this point, passwords should be considered obsolete when it comes to securing things. We should be using smartcards and cryptographic techniques; humans are just not good enough at generating or remembering random strings for passwords to be considered a good idea.
    - amalag 14y ago
      Yes I personally like the Yubikey idea which integrates with AD. Keeping a physical token and just pushing a button is nice.
  - tedunangst 14y ago
    The "Let's Set Up a Domain Controller" wizard doesn't ask how much salt you'd like to add to your passwords.
  - brown9-2 14y ago
    A domain controller is a Microsoft server, not custom built software.
- ImprovedSilence 14y ago
  not sure, I think the article was careful to not disclose how their passwords are stored, but the article did make mention of encryped passwords and the use of rainbow tables to crack them.
- albertsun 14y ago
  Keep reading.... "From there they snooped around The Times’s systems for at least two weeks before they identified the domain controller that contains user names and hashed, or scrambled, passwords for every Times employee."
- nonamegiven 14y ago
  Not necessarily. All we know is that they stole the password files. We don't know if the passwords were encrypted (but I'm assuming they were), and we don't know if the thieves were able to decrypt the passwords (they probably did for some fraction >0 and <= 100%).
- danso 14y ago
  I hope all the NYT employees didn't reuse those passwords anywhere else...I think if you work at a big political target like the NYT, you just have to treat it as sacrosanct as your personal email and bank accounts, even if the corporate account is just a formality (I.e. you forward all your emails to your gmail account...which is not a good idea if you're a reporter, but I know several who do it for the convenience)
- m0nastic 14y ago
  That means that the hackers pivoted from one system to the Domain Controller (with an account they cracked previously, or the results of a pass-the-hash attack), and got access to all of the account hashes (which they then would crack offline). The passwords aren't stored in plaintext, but with the computational power available to anyone (or substituting that, time), you start getting actual passwords in a couple of minutes (the worst ones), and maybe 90% in a few hours.
- deleted 14y ago
  [deleted]
- wes-exp 14y ago
  No, it means they use Windows :)
- blackman 14y ago
  they probably found the place where windows stores the passwords. All 8 character passwords under the unsalted scheme (NTLM) used by Microsoft can be cracked within minutes via use of rainbow tables. Even easier if LANMAN passwords are enabled.
tedunangst 14y ago
There's a couple surreal quotes in here. Like asking the Chinese Ministry of Defense to comment. "A Symantec spokesman said that, as a matter of policy, the company does not comment on its customers." Uh huh. Even when it's the customer doing the asking? Way to hide behind the policy.
- m0nastic 14y ago
  Symantec (or any software company) isn't going to comment to a reporter about why it's product didn't perform adequately, regardless of whether it's related to that reporters parent organization. If a reporter asked Oracle for a comment every time Tumblr went down because of something related to MySQL (I have no idea if Tumblr actually runs MySQL, that's just a hypothetical), the best they'd hear is "We don't comment about specific customer information."
  - tedunangst 14y ago
    Surely the Times could waive whatever privacy rights they have? Your example would be more on target if Oracle told Tumblr that they couldn't comment. What I'm getting at is, "We don't want to comment on our product." is a lot closer to the truth, they're just trying to weasel out of saying that.
    - m0nastic 14y ago
      Edit: It took me so long to write that that you edited your comment before I finished. ;) I think we're in agreement. It's not really about privacy (which was why when I saw the quote in the article, I giggled, and thought "That reporter's being funny"), it's about the fact that Symantec isn't even in a position to have a comment about it. If they were super on the ball and forthcoming, they might comment "We make software which is designed to protect users from the overwhelming majority of malware and viruses. There does not exist any solution which can completely guarantee safety from infection, but we have detected and stopped billions of threats." Don't get me wrong, the AV industry (actually much of the security industry) should be embarrassed by how fundamentally primitive things are; it's a bunch of horseshit. But they have absolutely nothing to gain by commenting about it, it would be walking into a hornet's nest. So they get to deflect it by saying they won't comment on a customer issue.
ChrisArchitect 14y ago
didn't expect much out of this story because it has felt for a long time that hackers targeting politically sensitive media orgs, govt and private sector out of China is the norm. Too common, widespread (however it's being organized) and they are too many for us to keep tabs on/hope to stop. All we can do is be vigilant in security practices and keeping on top of latest measures.
- re_todd 14y ago
  Keeping on top of the latest measures is great, but I wonder if it's good enough. Maybe we should go back to writing our most sensitive information on paper.
brown9-2 14y ago
If you want to give credit to a report detailing how much money your political leaders have piled up for themselves, hacking the media outfit that published it is a great way to confirm the story.
- OGinparadise 14y ago
  If you want to give credit to a report detailing how much money your political leaders have piled up for themselves, hacking the media outfit that published it is a great way to confirm the story. Do you think it matters now for the Chinese gov? By doing this and more they will make it very expensive for NYT and impossible for smaller outfits to mess with them. Maybe they'll uncover some dirt and release it to embarrass or discredit its reporters, who knows. Google thought they'd forced them to back down and we know what happened.
  - brown9-2 14y ago
    I don't think the New York Times would need much motivation to investigate corruption in China in the first place, but I strongly doubt being hacked by a foreign government would make them less motivated to do so.
- Jack000 14y ago
  that's the thing I don't understand. If accurately reported, this hacking attempt seems to be a sophisticated, expensive military operation with virtually no upside and high risk of discovery. It just doesn't seem rational to expend that kind of resource for such petty motives, especially if they have any idea how western media works, which I believe they do.
Volpe 14y ago
Strange that they would hack NYT when NYT's source for the WenJiaobao article seemed to be public financial records and info from wikileaks (state department cables). What is the strategic gain from hacking NYT? Identify potential other sources (within china) perhaps?
- brown9-2 14y ago
  It's not necessarily that the state as a whole found strategic value in this. Could just be one general hoping to impress the Politburo.
  - yzhengyu 14y ago
    TBH, it could be anyone in the chain with sufficient authority to trigger it and hoping to impress someone who can reward him in a tangible manner. And the sad thing, it is not limited to bureaucracies or government organisations. I have seen bugs that are not fixed, patches that are rejected because it allows someone somewhere to behave heroically in an attempt to impress someone. When I first experienced this, it was a very real WTF moment from the School of Dilbert Mismanagement.
- btilly 14y ago
  Any decent reporter is going to try to track down additional sources if possible. Conversely Chinese dissidents who want to get word out to the world are much more likely to talk to reporters for the NY Times than to the Chinese government. Therefore this becomes a possible way to identify dissidents. Even their public outing is good for them. The fact that this story is out there will make it less likely that Chinese dissidents will dare talk to NY Times reporters. Which means that dissidents will have a harder time getting their stories out to the world. There are other benefits to the Chinese as well. For instance the rich data that the Times has about various US organizations could help them identify people who could become useful informants.
- beagle3 14y ago
  That's not how journalism really works. More often than not, the journalist or their editor get tips from people in the know (who are trusted NOT to disclose that information to you). Only then does a journalist start combing public records to have a verifiable (and non incriminating) source -- there's just too much to look at without some initial hints. Perhaps they are looking for information about the tipsters.
temphn 14y ago
I think it's important to understand the Chinese perspective on this issue, if only to see why they do these things. Start with this: http://www.nytimes.com/2011/04/15/world/15aid.html?pagewanted=all http://www.nytimes.com/2011/04/15/world/15aid.html?pagewante... U.S. Groups Helped Nurture Arab Uprisings Even as the United States poured billions of dollars into foreign military programs and anti-terrorism campaigns, a small core of American government-financed organizations were promoting democracy in authoritarian Arab states. ... The United States’ democracy-building campaigns played a bigger role in fomenting protests than was previously known, with key leaders of the movements having been trained by the Americans in campaigning, organizing through new media tools and monitoring elections. ... Today the work of these groups is among the reasons that governments in turmoil claim that Western meddling was behind the uprisings, with some officials noting that leaders like Ms. Qadhi were trained and financed by the United States. Diplomatic cables report how American officials frequently assured skeptical governments that the training was aimed at reform, not promoting revolutions. and then this: http://online.wsj.com/article/SB10001424052748703560404576188981829658442.html http://online.wsj.com/article/SB1000142405274870356040457618... Is China Next? Over the course of three short months, popular uprisings have toppled regimes in Tunisia and Egypt, sparked a civil war in Libya and created unrest in other parts of the Middle East. They also have raised a question in many people's minds: Are all authoritarian regimes now threatened by this new democratic wave? In particular, is China, a rising superpower, vulnerable to these forces? Whether or not you believe the Arab Spring actually resulted in good outcomes, the salient fact is that US funded groups started the revolutions and prominent neocons (like Fukuyama in that WSJ article) were/are calling for similar actions in China. This is why the Chinese government feels that it is under attack by the United States, and it does not see a line between NGOs, the NYT/WSJ, and the US government, which they believe are working in concert to discredit their leaders and foment violent revolution in the name of democracy, as they did in the Middle East. Is this paranoid? Well, it's now hard to gainsay the USG/NGO connection given those articles, and in general even the NYT does tend to side with the USG against China or Arab regimes (most famously with Judith Miller). From this worldview, China thinks of this as a conflict between one of their intelligence agencies and one of ours. It's not obvious that they are wrong in that assessment.
- 14y ago
jenandre 14y ago
This story, and the recent RubyGems debacle should be teaching all of us one thing -- assume you can and will be hacked. Do you understand the implications (what data you are going to lose? what credibility?) Do you have a plan to deal with it? Ruby Gems was lucky in that their hack was noisy. The chinese government, as illustrated above, won't play so nice. This is why monitoring and incident response matter. Remember the subtle backdoor that almost slipped into the Linux kernel in 2003[1]? That could be Ruby Gems right now. Hopefully, they are taking the proper steps to investigate exactly what the hackers did. [1] http://kerneltrap.org/node/1584 http://kerneltrap.org/node/1584
- pifflesnort 14y ago
  China appears to be engaging in highly sophisticated attacks of the like that major companies need to be aware. The RubyGems fiasco is the result of remarkably incompetent decisions by everyone in the chain of control. The lessons are completely different. In the first, it's that you have to expect that you will be compromised if a determined and capable attacker targets you. In the second, it's that you will be compromised if you use software written by people and maintained by a community that seemingly lacks any remote resemblance of engineering competence.
  - jenandre 14y ago
    I don't think the RubyGems people were incompetent. The software serves its core purpose quite well (as a library delivery mechanism) and is quite reliable. But clearly they weren't thinking about security in decision, and what would happen if the repos were compromised. Let's be honest here - no software is 100% secure. As developers and consumers, the idea that we all review all of the tools in our toolchain for security soundness is absurd. It's like saying that everyone using C made poor decisions because of security flaws in popular libraries (even security ones, like openssl) and therefore all of the C community has no engineering competence. The fact is, China already has their eyes on GitHub and it's not beyond the planning capability to place backdoors in popular software to suit their future ends. No matter who the attacker may be, you have to be prepared for the situation where your computers and data are compromised, period.
sc00ter 14y ago
"It then replaced every compromised computer and set up new defenses in hopes of keeping hackers out." I hope that's just poor reporting, or does the Times' IT department really have that poor an understanding of how computers work? No wonder they got pwned. And I'm not buying the "we gave them free reign for four months on purpose" line. It makes no sense.
- damian2000 14y ago
  Maybe they actually meant every compromised computer OS (i.e. hard disk)?
  - onedognight 14y ago
    Maybe they mean OS and BIOS?
    - beagle3 14y ago
      And network card firmware. And graphics card firmware. And in some cases, also ILO firmware, DVD drive firmware, and maybe a few other pieces. If you trust your IT supplier, and the equipment is a two years old, it's probably more economical to replace everything than try to fix it. But why would you trust your IT supplier - who sources all their stuff from China in the first place?
      - m0nastic 14y ago
        All of those things are technically true, but don't match up with the M.O. of the perpetrators in question (they're not actually using any super-fancy BIOS rootkits). Also, the remediation process is exactly that, a process. It involves a pre-planned, direct remediation effort at a specific time, after which, egress traffic is monitored to look for any other outbound connections that pop up that were missed in the first "sweep." Passwords are all changed. You "rinse, lather, repeat" that process until you stop seeing the communications. It can take several times before you sound an "all-clear".
mcclosdl 14y ago
Jeez, NYT. 2FA much?
- tmsh 14y ago
  Most valuable point in this otherwise very interesting discussion. MFA neutralizes most hacker threats. Organizations like the NYT that are sensitive should implement them. I know we do for banking, per industry standards (FFIEC). Fraudsters aren't about to defeat RSA tokens or multiple channels of authentication in the near future, as far as I know. It's just too logistically difficult and an order of magnitude harder to then compromise the MFA servers (via MITM or otherwise), etc. If implemented correctly, they make access to individual personal data significantly more distributed and difficult to breach. Is MFA for e-mail each time extremely annoying? Probably. But logging into a system with just a username and password for a new ip address should not be the standard for authentication. This has got to be the solution eventually, and one which will essentially de-emphasize nation states or any large organizations from surveilling lists of accounts.
  - rawrly 14y ago
    MFA and Authentication has a much larger scope than what you've brought up here. I should start by I think passwords have atrophied and should be replaced, and MFA is the best option we have to replace passwords at this time. However, MFA has flaws many people are unaware of. I apologize for starting with a contradiction to something you state, but MFA does not neutralize most hacker threats. It only addresses authentication, it's unable to help against software compromises or user compromises -- Phishing attacks would still be effective, as the user will input a valid temporary token. What is MFA effective at preventing? Brute force password attacks, and users choosing bad passwords. An attacker who compromises an internal system or is successful in egressing a login database will gain the session tokens for logged in users and be abel to use that to access compromised accounts (subverting the entire logged in process.) But, you covered this, so I will digress to mentioning MFA's authentication concerns: The "forgot password" or "lost my token" systems are always a weak link. Frankly, it's improbable (due to overhead costs) that any bulk service provider (twitter, gmail, etc...) enact a strict verification process beyond automated email/phone verification (and this has been compromised before, lookup the attack against cloudflare's google services.) Second to the "lost password/token" attacks, there is the simple attack against the session ID/token. Remember, once you're logged in, your computer will store a token that it shares with the service to verify you are still authentication. While the token will expire, if the token is active then system will accept the session ID or token to verify you are logged in. The egress of data from the twitter login database included these session IDs. Of course, this requires a compromise of the system and not a MFA login compromise. Finally, on your discussion of using an MFA token for every login, every time. This is actually not true in all cases. A reasonable approach most implementations use is to require MFA for logins from unknown computers/IPs, once a system is verified via MFA a user would likely have a grace period when they would have to enter only their password until that grace period expires and then they would have to verify via MFA again, this could be 1 week, 1 month or 1 year+ Of course these statements I've made are really up to the environment's configuration, ideally in a very strict environment it's expected you verify via MFA each and every time, session IDs are updated automatically with every action and users are aware of security risks. But we don't live in this security/paranoia utopia (and perhaps that's all for the better.) Hope I've helped spark some discussions on MFA here. Bam, i'm out!
arunabh 14y ago
So PRC online spin doctors couldnt do the job http://en.wikipedia.org/wiki/50_Cent_Party http://en.wikipedia.org/wiki/50_Cent_Party
d4vlx 14y ago
So much time and effort by talented people being used for such useless purposes. So monarchic.
est 14y ago
I like how the whole article is rambling about Chinese hacks yet no strong & clear evidence suggests it's from China, except perhaps from a Chinese IP address. You know what, Chinese computers are also likely to be hacked easily.
- Volpe 14y ago
  I've found that's the case with any hack... for all we know it could be a competing newspaper routing through China. But nationalism/xenophobia trumps reason.
  - untog 14y ago
    What Chinese newspaper competes with the New York Times, in any meaningful sense? Given that media inside China is heavily censored, and Chinese newspapers publish in a language the vast majority of the US cannot read?
    - Volpe 14y ago
      I was implying it could be an American newspaper... As it stands if I 'hacked' HN and routed through china, I reckon the news would be: "HN hacked by Chinese Government!"
- guscost 14y ago
  It makes this sound more like a casualty of war, and less like an embarrassing mistake.
- hawkharris 14y ago
  I agree that the Times can't prove absolutely that the Chinese government was behind the attack. But they do provide a few strong pieces of evidence: (1) the university computers used in this attack were the same machines used in past attacks that were linked to China's military; (2) the attacks coincided directly with policy issues affecting Chinese officials. The article also had a relatively even-handed tone. It discussed the broader trend of hacks originating in China without linking the trend to the Chinese government, and it included an eloquent rebuttal quote from a Chinese official.
lennydizzy 14y ago
How come the Anonymous never attacked Chinese government?
- andrewcooke 14y ago
  http://www.telegraph.co.uk/news/worldnews/asia/china/9189192/Chinese-government-struggles-to-restore-hacked-websites.html http://www.telegraph.co.uk/news/worldnews/asia/china/9189192... google is useful for this kind of thing: https://www.google.cl/search?q=anonymous+target+china https://www.google.cl/search?q=anonymous+target+china
cloudout 14y ago
"a thermostat in one of its corporate apartments and a printer in its offices — were still communicating with computers in China" This is the dark side of the "internet of everything". Software=inherently buggy Software EATS WORLD Word=buggy?
amazedsaint 14y ago
"Psychic spies from china tries to hack your mind elation"
tokenadult 14y ago
From the article: "After surreptitiously tracking the intruders to study their movements and help erect better defenses to block them, The Times and computer security experts have expelled the attackers and kept them from breaking back in. "The timing of the attacks coincided with the reporting for a Times investigation, published online on Oct. 25, that found that the relatives of Wen Jiabao, China’s prime minister, had accumulated a fortune worth several billion dollars through business dealings." As a student of the language, history, culture, current politics, and future prospects of China since 1975, I had better comment on how significant this is. The effort by operatives based in China (that much is indisputable from the computer forensics involved in this case) is deeply hostile to the press freedom that is a fundamental difference between China and the United States. Under usual principles of international law, China has the responsibility to keep actors on its territory from launching harmful attacks on the territory of another country, unless it is interested in declaring war. Prior restraint of news media is routine in China, and accounts for a great deal of the public ignorance in China that keeps the current dictatorial regime in power, but it is not at all a friendly act toward the United States. The United States government has everything to gain and essentially nothing to lose by every other government on the planet being exposed to more press coverage of national leaders and their possibly corrupt activities. In this regard, the current regime in China and any government of the United States under the Constitution have inherently differing interests. The national interest of the common people of China, on the other hand, would be best served by freeing the news media there from the prior restraint and censorship that now exist there. If everyday people in China knew better what is really going on in the country, and what their leaders are doing, China could make greater progress in overcoming persistent poverty and enjoy more peaceful relations with countries all around the globe. Right now, the masses in China are not given the choice of knowing what's going on through uncensored mass media, nor are they given the choice of free and fair elections for choosing national leaders. My best hope is that this effort to scare off the New York Times from honest reporting about China will fail as efforts by the Church of Scientology to frighten away investigative journalists are also increasingly failing. http://tonyortega.org/2013/01/29/more-signs-of-scientologys-armageddon-as-the-media-takes-aim/ http://tonyortega.org/2013/01/29/more-signs-of-scientologys-... A lot of journalists would like nothing better than to write even more tough stories about what is really going in China, based on unfettered reporting with Chinese-speaking sources in the country. One journalist from China I met long ago in a place far away commented well in advance of the Internet age that if the Communist Party of China ceased censoring mass media that its rule would be gone "in a week." The time will come when the Party can't shut down all the channels of information flowing into China and within China, and then the Party will have to face elections or face a revolution. AFTER EDIT: The first reply asked a fair question, which is whether or not there is a basis for thinking that the Communist Party of China losing power in China would be a good thing. My answer is yes. I lived in Taiwan both under the KMT dictatorship and under its current democratic regime (which now again has the KMT as the ruling party, after an election). I have also been to Hong Kong. Chinese people can adapt well enough to democracy. In general, all around the world, freedom and democracy have their defects, but they are generally better for the people who live with them than the alternative. Precisely because Taiwan is available for an example, I think a transition to democracy in China could be especially smooth. It is regrettable that although there are Muslim democracies, the first attempts at specifically Arab democracies so far are nascent and struggling. The democratic transition in Arab countries will be harder in the short term for lack of culturally similar examples, but I think that too will be a long term benefit to the common people of the Arab lands. AFTER ONE MORE EDIT: Anyway, it shouldn't be the censorship and armed force of the Party that restricts the people's right to choose their national leaders.
tetrad 14y ago
The executive editor of the Times says “Computer security experts found no evidence that sensitive e-mails or files from the reporting of our articles about the Wen family were accessed, downloaded or copied"... but referring to their forensics they say that the attackers "search[ed] for and grab[bed] Mr. Barboza’s and Mr. Yardley’s e-mails and documents from a Times e-mail server" after cracking their password hashes. So which is it? Did they download gigs and gigs of mail, but not the ones they were looking for? Or is "found no evidence" doublespeak for "we're pretty sure they got what they were looking for, but the logs had already rolled over on that system, so we have no evidence that they did". Based on the rough timeline presented, this was after they were known, so it may have been their honey-pot server, but the tone of the article suggests that they were not honey-potting them and simply monitoring their progress as they slowly stomped their way through their live network. This begs the question... if they were really monitoring the attackers for months, including watching them grab Barboza and Yardley's e-mails, what are we to make of the PR statement that no relevant or sensitive e-mails were obtained?
beefsack 14y ago
*Crackers.
ChuckMcM 14y ago
It will be interesting if we see the first use of national firewalls used to keep a nation-state boxed in from the outside. I'm not sure what the 21st century equivalent of a blockade or siege is, but that would come close.
- don_draper 14y ago
  Interesting idea but difficult to implement. The hackers hide behind proxies. Unless you could cut off proxies everywhere they would still find ways to get in.
  - ChuckMcM 14y ago
    As are sieges and blockades of course. As virtual as the Internet is, in many ways, it still takes physical form as fiber optic cables and trunks. And due to a variety of reasons the number of those that cross national borders is fairly limited. Wireless is great but hard to push terabits of data through like lasers in glass do. I've just always thought of the Great Firewall of China as a state device to keep Chinese citizens from full access to the Internet, this article made me wonder if at some point there will be another Firewall outside the Great Firewall which isn't controlled by the Chinese but also keeps Chinese packets inside the country but for different reasons.
- crapshoot101 14y ago
  In a manner of speaking, isn't that what the Great Chinese Firewall is?
spitx 14y ago
Are these state-independent actors capable of orchestrating intrusions of such sophistication? Judge for yourself. They operate from a bare apartment on a Chinese island. They are intelligent 20-somethings who seem harmless. But they are hard-core hackers who claim to have gained access to the world's most sensitive sites, including the Pentagon. In fact, they say they are sometimes paid secretly by the Chinese government -- a claim the Beijing government denies. "No Web site is one hundred percent safe. There are Web sites with high-level security, but there is always a weakness," says Xiao Chen, the leader of this group. "Xiao Chen" is his online name. Along with his two colleagues, he does not want to reveal his true identity. The three belong to what some Western experts say is a civilian cyber militia in China, launching attacks on government and private Web sites around the world. If there is a profile of a cyber hacker, these three are straight from central casting -- young and thin, with skin pale from spending too many long nights in front of a computer. One hacker says he is a former computer operator in the People's Liberation Army; another is a marketing graduate; and Xiao Chen says he is a self-taught programmer. "First, you must know about the Web site you want to attack. You must know what program it is written with," says Xiao Chen. "There is a saying, 'Know about both yourself and the enemy, and you will be invincible.'" CNN decided to withhold the address of these hackers' Web site, but Xiao Chen says it has been operating for more than three years, with 10,000 registered users. The site offers tools, articles, news and flash tutorials about hacking. Private computer experts in the United States from iDefense Security Intelligence, which provides cybersecurity advice to governments and Fortune 500 companies, say the group's site "appears to be an important site in the broader Chinese hacking community." Arranging a meeting with the hackers took weeks of on- again, off-again e-mail exchanges. When they finally agreed, CNN was told to meet them on the island of Zhoushan, just south of Shanghai and a major port for China's navy. The apartment has cement floors and almost no furniture. What they do have are three of the latest computers. They are cautious when it comes to naming the Web sites they have hacked. On camera, Xiao Chen denies knowing anyone who has targetted U.S. government Web sites. But off-camera, in conversations over three days, he claims two of his colleagues -- not the ones with him in the room -- hacked into the Pentagon and downloaded information, although he wouldn't specify what was gleaned. CNN has no way to confirm if his claim is true. "They would not publicize this," he says of someone who hacks the U.S. Defense Department. "It is very sensitive." This week, the Pentagon said computer networks in the United States, Germany, Britain and France were hit last year by what they call "multiple intrusions," many of them originating from China. At a congressional hearing in Washington last week, administration officials testified that the government's cyber initiative has fallen far short of what is required. Most alarming, the officials said, there has never been a full damage assessment of federal agency networks. "We are here today because we must do more," said Robert Jamison, a top official in the U.S. Department of Homeland Security. "Defending the federal system in its current configuration is a significant challenge." U.S. officials have been cautious not to directly accuse the Chinese military or its government of hacking into its network. But David Sedney, the deputy assistant secretary of defense for East Asia, says, "The way these intrusions are conducted are certainly consistent with what you would need if you were going to actually carry out cyber warfare." Beijing hit back at that, denying such an allegation and calling on the United States to provide proof. "If they have any evidence, I hope they would provide it. Then, we can cooperate on this issue," Qin Gang, a spokesman for the Chinese Foreign Ministry, said during a regular press briefing this week. But again off-camera, Xiao Chen says after the alleged Pentagon attack, his colleagues were paid by the Chinese government. CNN has no way to independently confirm if that is true. His allegations brought strenuous denials from Beijing. "I am telling you honestly, the Chinese government does not do such a thing," Qin said. But if Xiao Chen is telling the truth, it appears his colleagues launched a freelance attack -- not initiated by Beijing, but paid for after the fact. "These hacker groups in my opinion are not agents of the Chinese state," says James Mulvenon from the Center for Intelligence Research and Analysis, which works with the U.S. intelligence community. "They are sort of useful idiots for the Beijing regime." He adds, "These young hackers are tolerated by the regime provided that they do not conduct attacks inside of China." One of the biggest problems experts say is trying to prove where a cyber attack originates from, and that they say allows hackers like Xiao Chen to operate in a virtual world of deniability. And across China, there could be thousands just like him, all trying to prove themselves against some of the most secure Web sites in the world. Source(s): http://www.cnn.com/2008/TECH/03/07/china.hackers/ http://www.cnn.com/2008/TECH/03/07/china.hackers/ http://www.youtube.com/watch?v=ovNVhk1rVVE http://www.youtube.com/watch?v=ovNVhk1rVVE
wavesounds 14y ago
Seems like putting a password on their printer and thermostat as well as telling their employees not to click random links or better yet setting up a security rule on their email router to not allow links and attachments from outside the network would have prevented this. In essence these big companies are leaving the door unlocked and keep acting surprised when people that don't like them open it up and poke around inside. There needs to be more education and common sense this sounds like a very easy attack to prevent.
corford 14y ago
All this focus on the sophistication of the Chinese hackers irritates me slightly. Reading between the lines, it seems the NYT would likely have weathered this "sophisticated" attack a lot better if they had observed a few simple security best practices: - Salt your password hashes (rendering rainbow tables inert) - Train your staff NOT to open attachments from unknown sources (especially if you've just written an inflammatory article on a foreign government official) - Configure your mail server to automatically strip and quarantine any attachment (inbound or outbound) that isn't of a type defined in a very strict white list - In addition to network firewalls, make use of the software firewall on the PC's themselves by tightly controlling what processes on the machines are given egress permission This stuff isn't rocket science and if the NYT can't get it right (knowing that they're a natural high profile target), what hope do other firms have? The focus of the discussion should be on getting to the bottom of why we keep seeing these basic security oversights being made over and over again, not panicking about Chinese über hackers and suggesting everyone move to smart cards, retina scans or paper.
- brown9-2 14y ago
  The point about hashes is irrelevant as the corporate passwords were stolen from Microsoft Windows domain controller. Users of Windows domains aren't free to swap in their own implementation of how password storage works.
- nikcub 14y ago
  > Salt your password hashes As brown9-2 mentions in his reply, it was a Windows Domain Controller > Train your staff NOT to open attachments from unknown sources Spear phishing attacks are more sophisticated than that. They aren't sending .EXE files. The two most common attachments are RTF[0] and PDF[1], or a link in the email body to a website that will attempt a drive-by download. These emails are composed in a way to make them look innocent (for eg. 'Twitter Password Reset Request', 'New Amazon.com Order', or an email from a new source, etc.). It is also likely that at this level of sophistication that there are 0day exploits involved. Attackers can send hundreds of spear emails over weeks and months, they just need a single click from one user to get their foot in the door. > quarantine any attachment (inbound or outbound) that isn't of a type defined in a very strict white list As mentioned above, the attachment types are RTF, PDF and XLS - and much more common is a link in an HTML email. > make use of the software firewall on the PC's The command and control servers send commands to ordinary looking websites using HTTPS. If you read the analysis of Flame or Stuxnet you will see the lengths that the designers went to to obfuscate this traffic. This analysis[2] describes what the C&C servers looked like for Flame. The admin panels make no mention of bots or worms, it looks like any other intranet site. It is really difficult to defend against these types of attacks. An attacker only needs 2 or 3 decent exploit writers to come up with a unique attack vector and a custom trojan tailored for the target. Also, time is on their side and they only need a single hit while you need to find and shut down all of the attempts. [0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3333 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3333 [1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4363 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4363 [2] http://www.securelist.com/en/blog/750/Full_Analysis_of_Flame_s_Command_Control_servers http://www.securelist.com/en/blog/750/Full_Analysis_of_Flame...
chayesfss 14y ago
Looks like their mail is just protected by username & password too

"Security experts found evidence that the hackers stole the corporate passwords for every Times employee and used those to gain access to the personal computers of 53 employees" Does this mean the NYTimes is storing passwords in plaintext?

Hilyin 14y ago
I think if they have the ability to steal the passwords, even if they weren't plain text, they didn't do the proper precautions of encrypting with a salt. So either way, they failed.
- betterunix 14y ago
  At this point, passwords should be considered obsolete when it comes to securing things. We should be using smartcards and cryptographic techniques; humans are just not good enough at generating or remembering random strings for passwords to be considered a good idea.
  - amalag 14y ago
    Yes I personally like the Yubikey idea which integrates with AD. Keeping a physical token and just pushing a button is nice.
- tedunangst 14y ago
  The "Let's Set Up a Domain Controller" wizard doesn't ask how much salt you'd like to add to your passwords.
- brown9-2 14y ago
  A domain controller is a Microsoft server, not custom built software.
ImprovedSilence 14y ago
not sure, I think the article was careful to not disclose how their passwords are stored, but the article did make mention of encryped passwords and the use of rainbow tables to crack them.
albertsun 14y ago
Keep reading.... "From there they snooped around The Times’s systems for at least two weeks before they identified the domain controller that contains user names and hashed, or scrambled, passwords for every Times employee."
nonamegiven 14y ago
Not necessarily. All we know is that they stole the password files. We don't know if the passwords were encrypted (but I'm assuming they were), and we don't know if the thieves were able to decrypt the passwords (they probably did for some fraction >0 and <= 100%).
danso 14y ago
I hope all the NYT employees didn't reuse those passwords anywhere else...I think if you work at a big political target like the NYT, you just have to treat it as sacrosanct as your personal email and bank accounts, even if the corporate account is just a formality (I.e. you forward all your emails to your gmail account...which is not a good idea if you're a reporter, but I know several who do it for the convenience)
m0nastic 14y ago
That means that the hackers pivoted from one system to the Domain Controller (with an account they cracked previously, or the results of a pass-the-hash attack), and got access to all of the account hashes (which they then would crack offline). The passwords aren't stored in plaintext, but with the computational power available to anyone (or substituting that, time), you start getting actual passwords in a couple of minutes (the worst ones), and maybe 90% in a few hours.
deleted 14y ago
[deleted]
wes-exp 14y ago
No, it means they use Windows :)
blackman 14y ago
they probably found the place where windows stores the passwords. All 8 character passwords under the unsalted scheme (NTLM) used by Microsoft can be cracked within minutes via use of rainbow tables. Even easier if LANMAN passwords are enabled.

tedunangst 14y ago

There's a couple surreal quotes in here. Like asking the Chinese Ministry of Defense to comment. "A Symantec spokesman said that, as a matter of policy, the company does not comment on its customers." Uh huh. Even when it's the customer doing the asking? Way to hide behind the policy.

m0nastic 14y ago
Symantec (or any software company) isn't going to comment to a reporter about why it's product didn't perform adequately, regardless of whether it's related to that reporters parent organization. If a reporter asked Oracle for a comment every time Tumblr went down because of something related to MySQL (I have no idea if Tumblr actually runs MySQL, that's just a hypothetical), the best they'd hear is "We don't comment about specific customer information."
- tedunangst 14y ago
  Surely the Times could waive whatever privacy rights they have? Your example would be more on target if Oracle told Tumblr that they couldn't comment. What I'm getting at is, "We don't want to comment on our product." is a lot closer to the truth, they're just trying to weasel out of saying that.
  - m0nastic 14y ago
    Edit: It took me so long to write that that you edited your comment before I finished. ;) I think we're in agreement. It's not really about privacy (which was why when I saw the quote in the article, I giggled, and thought "That reporter's being funny"), it's about the fact that Symantec isn't even in a position to have a comment about it. If they were super on the ball and forthcoming, they might comment "We make software which is designed to protect users from the overwhelming majority of malware and viruses. There does not exist any solution which can completely guarantee safety from infection, but we have detected and stopped billions of threats." Don't get me wrong, the AV industry (actually much of the security industry) should be embarrassed by how fundamentally primitive things are; it's a bunch of horseshit. But they have absolutely nothing to gain by commenting about it, it would be walking into a hornet's nest. So they get to deflect it by saying they won't comment on a customer issue.

ChrisArchitect 14y ago

didn't expect much out of this story because it has felt for a long time that hackers targeting politically sensitive media orgs, govt and private sector out of China is the norm. Too common, widespread (however it's being organized) and they are too many for us to keep tabs on/hope to stop. All we can do is be vigilant in security practices and keeping on top of latest measures.

re_todd 14y ago
Keeping on top of the latest measures is great, but I wonder if it's good enough. Maybe we should go back to writing our most sensitive information on paper.

brown9-2 14y ago

If you want to give credit to a report detailing how much money your political leaders have piled up for themselves, hacking the media outfit that published it is a great way to confirm the story.

OGinparadise 14y ago
If you want to give credit to a report detailing how much money your political leaders have piled up for themselves, hacking the media outfit that published it is a great way to confirm the story. Do you think it matters now for the Chinese gov? By doing this and more they will make it very expensive for NYT and impossible for smaller outfits to mess with them. Maybe they'll uncover some dirt and release it to embarrass or discredit its reporters, who knows. Google thought they'd forced them to back down and we know what happened.
- brown9-2 14y ago
  I don't think the New York Times would need much motivation to investigate corruption in China in the first place, but I strongly doubt being hacked by a foreign government would make them less motivated to do so.
Jack000 14y ago
that's the thing I don't understand. If accurately reported, this hacking attempt seems to be a sophisticated, expensive military operation with virtually no upside and high risk of discovery. It just doesn't seem rational to expend that kind of resource for such petty motives, especially if they have any idea how western media works, which I believe they do.

Volpe 14y ago

Strange that they would hack NYT when NYT's source for the WenJiaobao article seemed to be public financial records and info from wikileaks (state department cables). What is the strategic gain from hacking NYT? Identify potential other sources (within china) perhaps?

brown9-2 14y ago
It's not necessarily that the state as a whole found strategic value in this. Could just be one general hoping to impress the Politburo.
- yzhengyu 14y ago
  TBH, it could be anyone in the chain with sufficient authority to trigger it and hoping to impress someone who can reward him in a tangible manner. And the sad thing, it is not limited to bureaucracies or government organisations. I have seen bugs that are not fixed, patches that are rejected because it allows someone somewhere to behave heroically in an attempt to impress someone. When I first experienced this, it was a very real WTF moment from the School of Dilbert Mismanagement.
btilly 14y ago
Any decent reporter is going to try to track down additional sources if possible. Conversely Chinese dissidents who want to get word out to the world are much more likely to talk to reporters for the NY Times than to the Chinese government. Therefore this becomes a possible way to identify dissidents. Even their public outing is good for them. The fact that this story is out there will make it less likely that Chinese dissidents will dare talk to NY Times reporters. Which means that dissidents will have a harder time getting their stories out to the world. There are other benefits to the Chinese as well. For instance the rich data that the Times has about various US organizations could help them identify people who could become useful informants.
beagle3 14y ago
That's not how journalism really works. More often than not, the journalist or their editor get tips from people in the know (who are trusted NOT to disclose that information to you). Only then does a journalist start combing public records to have a verifiable (and non incriminating) source -- there's just too much to look at without some initial hints. Perhaps they are looking for information about the tipsters.

temphn 14y ago

I think it's important to understand the Chinese perspective on this issue, if only to see why they do these things. Start with this: http://www.nytimes.com/2011/04/15/world/15aid.html?pagewanted=all http://www.nytimes.com/2011/04/15/world/15aid.html?pagewante... U.S. Groups Helped Nurture Arab Uprisings Even as the United States poured billions of dollars into foreign military programs and anti-terrorism campaigns, a small core of American government-financed organizations were promoting democracy in authoritarian Arab states. ... The United States’ democracy-building campaigns played a bigger role in fomenting protests than was previously known, with key leaders of the movements having been trained by the Americans in campaigning, organizing through new media tools and monitoring elections. ... Today the work of these groups is among the reasons that governments in turmoil claim that Western meddling was behind the uprisings, with some officials noting that leaders like Ms. Qadhi were trained and financed by the United States. Diplomatic cables report how American officials frequently assured skeptical governments that the training was aimed at reform, not promoting revolutions. and then this: http://online.wsj.com/article/SB10001424052748703560404576188981829658442.html http://online.wsj.com/article/SB1000142405274870356040457618... Is China Next? Over the course of three short months, popular uprisings have toppled regimes in Tunisia and Egypt, sparked a civil war in Libya and created unrest in other parts of the Middle East. They also have raised a question in many people's minds: Are all authoritarian regimes now threatened by this new democratic wave? In particular, is China, a rising superpower, vulnerable to these forces? Whether or not you believe the Arab Spring actually resulted in good outcomes, the salient fact is that US funded groups started the revolutions and prominent neocons (like Fukuyama in that WSJ article) were/are calling for similar actions in China. This is why the Chinese government feels that it is under attack by the United States, and it does not see a line between NGOs, the NYT/WSJ, and the US government, which they believe are working in concert to discredit their leaders and foment violent revolution in the name of democracy, as they did in the Middle East. Is this paranoid? Well, it's now hard to gainsay the USG/NGO connection given those articles, and in general even the NYT does tend to side with the USG against China or Arab regimes (most famously with Judith Miller). From this worldview, China thinks of this as a conflict between one of their intelligence agencies and one of ours. It's not obvious that they are wrong in that assessment.

14y ago

jenandre 14y ago

This story, and the recent RubyGems debacle should be teaching all of us one thing -- assume you can and will be hacked. Do you understand the implications (what data you are going to lose? what credibility?) Do you have a plan to deal with it? Ruby Gems was lucky in that their hack was noisy. The chinese government, as illustrated above, won't play so nice. This is why monitoring and incident response matter. Remember the subtle backdoor that almost slipped into the Linux kernel in 2003[1]? That could be Ruby Gems right now. Hopefully, they are taking the proper steps to investigate exactly what the hackers did. [1] http://kerneltrap.org/node/1584 http://kerneltrap.org/node/1584

pifflesnort 14y ago
China appears to be engaging in highly sophisticated attacks of the like that major companies need to be aware. The RubyGems fiasco is the result of remarkably incompetent decisions by everyone in the chain of control. The lessons are completely different. In the first, it's that you have to expect that you will be compromised if a determined and capable attacker targets you. In the second, it's that you will be compromised if you use software written by people and maintained by a community that seemingly lacks any remote resemblance of engineering competence.
- jenandre 14y ago
  I don't think the RubyGems people were incompetent. The software serves its core purpose quite well (as a library delivery mechanism) and is quite reliable. But clearly they weren't thinking about security in decision, and what would happen if the repos were compromised. Let's be honest here - no software is 100% secure. As developers and consumers, the idea that we all review all of the tools in our toolchain for security soundness is absurd. It's like saying that everyone using C made poor decisions because of security flaws in popular libraries (even security ones, like openssl) and therefore all of the C community has no engineering competence. The fact is, China already has their eyes on GitHub and it's not beyond the planning capability to place backdoors in popular software to suit their future ends. No matter who the attacker may be, you have to be prepared for the situation where your computers and data are compromised, period.

sc00ter 14y ago

"It then replaced every compromised computer and set up new defenses in hopes of keeping hackers out." I hope that's just poor reporting, or does the Times' IT department really have that poor an understanding of how computers work? No wonder they got pwned. And I'm not buying the "we gave them free reign for four months on purpose" line. It makes no sense.

damian2000 14y ago
Maybe they actually meant every compromised computer OS (i.e. hard disk)?
- onedognight 14y ago
  Maybe they mean OS and BIOS?
  - beagle3 14y ago
    And network card firmware. And graphics card firmware. And in some cases, also ILO firmware, DVD drive firmware, and maybe a few other pieces. If you trust your IT supplier, and the equipment is a two years old, it's probably more economical to replace everything than try to fix it. But why would you trust your IT supplier - who sources all their stuff from China in the first place?
    - m0nastic 14y ago
      All of those things are technically true, but don't match up with the M.O. of the perpetrators in question (they're not actually using any super-fancy BIOS rootkits). Also, the remediation process is exactly that, a process. It involves a pre-planned, direct remediation effort at a specific time, after which, egress traffic is monitored to look for any other outbound connections that pop up that were missed in the first "sweep." Passwords are all changed. You "rinse, lather, repeat" that process until you stop seeing the communications. It can take several times before you sound an "all-clear".

mcclosdl 14y ago

Jeez, NYT. 2FA much?

tmsh 14y ago
Most valuable point in this otherwise very interesting discussion. MFA neutralizes most hacker threats. Organizations like the NYT that are sensitive should implement them. I know we do for banking, per industry standards (FFIEC). Fraudsters aren't about to defeat RSA tokens or multiple channels of authentication in the near future, as far as I know. It's just too logistically difficult and an order of magnitude harder to then compromise the MFA servers (via MITM or otherwise), etc. If implemented correctly, they make access to individual personal data significantly more distributed and difficult to breach. Is MFA for e-mail each time extremely annoying? Probably. But logging into a system with just a username and password for a new ip address should not be the standard for authentication. This has got to be the solution eventually, and one which will essentially de-emphasize nation states or any large organizations from surveilling lists of accounts.
- rawrly 14y ago
  MFA and Authentication has a much larger scope than what you've brought up here. I should start by I think passwords have atrophied and should be replaced, and MFA is the best option we have to replace passwords at this time. However, MFA has flaws many people are unaware of. I apologize for starting with a contradiction to something you state, but MFA does not neutralize most hacker threats. It only addresses authentication, it's unable to help against software compromises or user compromises -- Phishing attacks would still be effective, as the user will input a valid temporary token. What is MFA effective at preventing? Brute force password attacks, and users choosing bad passwords. An attacker who compromises an internal system or is successful in egressing a login database will gain the session tokens for logged in users and be abel to use that to access compromised accounts (subverting the entire logged in process.) But, you covered this, so I will digress to mentioning MFA's authentication concerns: The "forgot password" or "lost my token" systems are always a weak link. Frankly, it's improbable (due to overhead costs) that any bulk service provider (twitter, gmail, etc...) enact a strict verification process beyond automated email/phone verification (and this has been compromised before, lookup the attack against cloudflare's google services.) Second to the "lost password/token" attacks, there is the simple attack against the session ID/token. Remember, once you're logged in, your computer will store a token that it shares with the service to verify you are still authentication. While the token will expire, if the token is active then system will accept the session ID or token to verify you are logged in. The egress of data from the twitter login database included these session IDs. Of course, this requires a compromise of the system and not a MFA login compromise. Finally, on your discussion of using an MFA token for every login, every time. This is actually not true in all cases. A reasonable approach most implementations use is to require MFA for logins from unknown computers/IPs, once a system is verified via MFA a user would likely have a grace period when they would have to enter only their password until that grace period expires and then they would have to verify via MFA again, this could be 1 week, 1 month or 1 year+ Of course these statements I've made are really up to the environment's configuration, ideally in a very strict environment it's expected you verify via MFA each and every time, session IDs are updated automatically with every action and users are aware of security risks. But we don't live in this security/paranoia utopia (and perhaps that's all for the better.) Hope I've helped spark some discussions on MFA here. Bam, i'm out!

arunabh 14y ago

So PRC online spin doctors couldnt do the job http://en.wikipedia.org/wiki/50_Cent_Party http://en.wikipedia.org/wiki/50_Cent_Party

d4vlx 14y ago

So much time and effort by talented people being used for such useless purposes. So monarchic.

est 14y ago

I like how the whole article is rambling about Chinese hacks yet no strong & clear evidence suggests it's from China, except perhaps from a Chinese IP address. You know what, Chinese computers are also likely to be hacked easily.

Volpe 14y ago
I've found that's the case with any hack... for all we know it could be a competing newspaper routing through China. But nationalism/xenophobia trumps reason.
- untog 14y ago
  What Chinese newspaper competes with the New York Times, in any meaningful sense? Given that media inside China is heavily censored, and Chinese newspapers publish in a language the vast majority of the US cannot read?
  - Volpe 14y ago
    I was implying it could be an American newspaper... As it stands if I 'hacked' HN and routed through china, I reckon the news would be: "HN hacked by Chinese Government!"
guscost 14y ago
It makes this sound more like a casualty of war, and less like an embarrassing mistake.
hawkharris 14y ago
I agree that the Times can't prove absolutely that the Chinese government was behind the attack. But they do provide a few strong pieces of evidence: (1) the university computers used in this attack were the same machines used in past attacks that were linked to China's military; (2) the attacks coincided directly with policy issues affecting Chinese officials. The article also had a relatively even-handed tone. It discussed the broader trend of hacks originating in China without linking the trend to the Chinese government, and it included an eloquent rebuttal quote from a Chinese official.

lennydizzy 14y ago

How come the Anonymous never attacked Chinese government?

andrewcooke 14y ago
http://www.telegraph.co.uk/news/worldnews/asia/china/9189192/Chinese-government-struggles-to-restore-hacked-websites.html http://www.telegraph.co.uk/news/worldnews/asia/china/9189192... google is useful for this kind of thing: https://www.google.cl/search?q=anonymous+target+china https://www.google.cl/search?q=anonymous+target+china

cloudout 14y ago

"a thermostat in one of its corporate apartments and a printer in its offices — were still communicating with computers in China" This is the dark side of the "internet of everything". Software=inherently buggy Software EATS WORLD Word=buggy?

amazedsaint 14y ago

"Psychic spies from china tries to hack your mind elation"

tokenadult 14y ago

From the article: "After surreptitiously tracking the intruders to study their movements and help erect better defenses to block them, The Times and computer security experts have expelled the attackers and kept them from breaking back in. "The timing of the attacks coincided with the reporting for a Times investigation, published online on Oct. 25, that found that the relatives of Wen Jiabao, China’s prime minister, had accumulated a fortune worth several billion dollars through business dealings." As a student of the language, history, culture, current politics, and future prospects of China since 1975, I had better comment on how significant this is. The effort by operatives based in China (that much is indisputable from the computer forensics involved in this case) is deeply hostile to the press freedom that is a fundamental difference between China and the United States. Under usual principles of international law, China has the responsibility to keep actors on its territory from launching harmful attacks on the territory of another country, unless it is interested in declaring war. Prior restraint of news media is routine in China, and accounts for a great deal of the public ignorance in China that keeps the current dictatorial regime in power, but it is not at all a friendly act toward the United States. The United States government has everything to gain and essentially nothing to lose by every other government on the planet being exposed to more press coverage of national leaders and their possibly corrupt activities. In this regard, the current regime in China and any government of the United States under the Constitution have inherently differing interests. The national interest of the common people of China, on the other hand, would be best served by freeing the news media there from the prior restraint and censorship that now exist there. If everyday people in China knew better what is really going on in the country, and what their leaders are doing, China could make greater progress in overcoming persistent poverty and enjoy more peaceful relations with countries all around the globe. Right now, the masses in China are not given the choice of knowing what's going on through uncensored mass media, nor are they given the choice of free and fair elections for choosing national leaders. My best hope is that this effort to scare off the New York Times from honest reporting about China will fail as efforts by the Church of Scientology to frighten away investigative journalists are also increasingly failing. http://tonyortega.org/2013/01/29/more-signs-of-scientologys-armageddon-as-the-media-takes-aim/ http://tonyortega.org/2013/01/29/more-signs-of-scientologys-... A lot of journalists would like nothing better than to write even more tough stories about what is really going in China, based on unfettered reporting with Chinese-speaking sources in the country. One journalist from China I met long ago in a place far away commented well in advance of the Internet age that if the Communist Party of China ceased censoring mass media that its rule would be gone "in a week." The time will come when the Party can't shut down all the channels of information flowing into China and within China, and then the Party will have to face elections or face a revolution. AFTER EDIT: The first reply asked a fair question, which is whether or not there is a basis for thinking that the Communist Party of China losing power in China would be a good thing. My answer is yes. I lived in Taiwan both under the KMT dictatorship and under its current democratic regime (which now again has the KMT as the ruling party, after an election). I have also been to Hong Kong. Chinese people can adapt well enough to democracy. In general, all around the world, freedom and democracy have their defects, but they are generally better for the people who live with them than the alternative. Precisely because Taiwan is available for an example, I think a transition to democracy in China could be especially smooth. It is regrettable that although there are Muslim democracies, the first attempts at specifically Arab democracies so far are nascent and struggling. The democratic transition in Arab countries will be harder in the short term for lack of culturally similar examples, but I think that too will be a long term benefit to the common people of the Arab lands. AFTER ONE MORE EDIT: Anyway, it shouldn't be the censorship and armed force of the Party that restricts the people's right to choose their national leaders.

tetrad 14y ago

The executive editor of the Times says “Computer security experts found no evidence that sensitive e-mails or files from the reporting of our articles about the Wen family were accessed, downloaded or copied"... but referring to their forensics they say that the attackers "search[ed] for and grab[bed] Mr. Barboza’s and Mr. Yardley’s e-mails and documents from a Times e-mail server" after cracking their password hashes. So which is it? Did they download gigs and gigs of mail, but not the ones they were looking for? Or is "found no evidence" doublespeak for "we're pretty sure they got what they were looking for, but the logs had already rolled over on that system, so we have no evidence that they did". Based on the rough timeline presented, this was after they were known, so it may have been their honey-pot server, but the tone of the article suggests that they were not honey-potting them and simply monitoring their progress as they slowly stomped their way through their live network. This begs the question... if they were really monitoring the attackers for months, including watching them grab Barboza and Yardley's e-mails, what are we to make of the PR statement that no relevant or sensitive e-mails were obtained?

beefsack 14y ago

*Crackers.

ChuckMcM 14y ago

It will be interesting if we see the first use of national firewalls used to keep a nation-state boxed in from the outside. I'm not sure what the 21st century equivalent of a blockade or siege is, but that would come close.

don_draper 14y ago
Interesting idea but difficult to implement. The hackers hide behind proxies. Unless you could cut off proxies everywhere they would still find ways to get in.
- ChuckMcM 14y ago
  As are sieges and blockades of course. As virtual as the Internet is, in many ways, it still takes physical form as fiber optic cables and trunks. And due to a variety of reasons the number of those that cross national borders is fairly limited. Wireless is great but hard to push terabits of data through like lasers in glass do. I've just always thought of the Great Firewall of China as a state device to keep Chinese citizens from full access to the Internet, this article made me wonder if at some point there will be another Firewall outside the Great Firewall which isn't controlled by the Chinese but also keeps Chinese packets inside the country but for different reasons.
crapshoot101 14y ago
In a manner of speaking, isn't that what the Great Chinese Firewall is?

spitx 14y ago

Are these state-independent actors capable of orchestrating intrusions of such sophistication? Judge for yourself. They operate from a bare apartment on a Chinese island. They are intelligent 20-somethings who seem harmless. But they are hard-core hackers who claim to have gained access to the world's most sensitive sites, including the Pentagon. In fact, they say they are sometimes paid secretly by the Chinese government -- a claim the Beijing government denies. "No Web site is one hundred percent safe. There are Web sites with high-level security, but there is always a weakness," says Xiao Chen, the leader of this group. "Xiao Chen" is his online name. Along with his two colleagues, he does not want to reveal his true identity. The three belong to what some Western experts say is a civilian cyber militia in China, launching attacks on government and private Web sites around the world. If there is a profile of a cyber hacker, these three are straight from central casting -- young and thin, with skin pale from spending too many long nights in front of a computer. One hacker says he is a former computer operator in the People's Liberation Army; another is a marketing graduate; and Xiao Chen says he is a self-taught programmer. "First, you must know about the Web site you want to attack. You must know what program it is written with," says Xiao Chen. "There is a saying, 'Know about both yourself and the enemy, and you will be invincible.'" CNN decided to withhold the address of these hackers' Web site, but Xiao Chen says it has been operating for more than three years, with 10,000 registered users. The site offers tools, articles, news and flash tutorials about hacking. Private computer experts in the United States from iDefense Security Intelligence, which provides cybersecurity advice to governments and Fortune 500 companies, say the group's site "appears to be an important site in the broader Chinese hacking community." Arranging a meeting with the hackers took weeks of on- again, off-again e-mail exchanges. When they finally agreed, CNN was told to meet them on the island of Zhoushan, just south of Shanghai and a major port for China's navy. The apartment has cement floors and almost no furniture. What they do have are three of the latest computers. They are cautious when it comes to naming the Web sites they have hacked. On camera, Xiao Chen denies knowing anyone who has targetted U.S. government Web sites. But off-camera, in conversations over three days, he claims two of his colleagues -- not the ones with him in the room -- hacked into the Pentagon and downloaded information, although he wouldn't specify what was gleaned. CNN has no way to confirm if his claim is true. "They would not publicize this," he says of someone who hacks the U.S. Defense Department. "It is very sensitive." This week, the Pentagon said computer networks in the United States, Germany, Britain and France were hit last year by what they call "multiple intrusions," many of them originating from China. At a congressional hearing in Washington last week, administration officials testified that the government's cyber initiative has fallen far short of what is required. Most alarming, the officials said, there has never been a full damage assessment of federal agency networks. "We are here today because we must do more," said Robert Jamison, a top official in the U.S. Department of Homeland Security. "Defending the federal system in its current configuration is a significant challenge." U.S. officials have been cautious not to directly accuse the Chinese military or its government of hacking into its network. But David Sedney, the deputy assistant secretary of defense for East Asia, says, "The way these intrusions are conducted are certainly consistent with what you would need if you were going to actually carry out cyber warfare." Beijing hit back at that, denying such an allegation and calling on the United States to provide proof. "If they have any evidence, I hope they would provide it. Then, we can cooperate on this issue," Qin Gang, a spokesman for the Chinese Foreign Ministry, said during a regular press briefing this week. But again off-camera, Xiao Chen says after the alleged Pentagon attack, his colleagues were paid by the Chinese government. CNN has no way to independently confirm if that is true. His allegations brought strenuous denials from Beijing. "I am telling you honestly, the Chinese government does not do such a thing," Qin said. But if Xiao Chen is telling the truth, it appears his colleagues launched a freelance attack -- not initiated by Beijing, but paid for after the fact. "These hacker groups in my opinion are not agents of the Chinese state," says James Mulvenon from the Center for Intelligence Research and Analysis, which works with the U.S. intelligence community. "They are sort of useful idiots for the Beijing regime." He adds, "These young hackers are tolerated by the regime provided that they do not conduct attacks inside of China." One of the biggest problems experts say is trying to prove where a cyber attack originates from, and that they say allows hackers like Xiao Chen to operate in a virtual world of deniability. And across China, there could be thousands just like him, all trying to prove themselves against some of the most secure Web sites in the world. Source(s): http://www.cnn.com/2008/TECH/03/07/china.hackers/ http://www.cnn.com/2008/TECH/03/07/china.hackers/ http://www.youtube.com/watch?v=ovNVhk1rVVE http://www.youtube.com/watch?v=ovNVhk1rVVE

wavesounds 14y ago

Seems like putting a password on their printer and thermostat as well as telling their employees not to click random links or better yet setting up a security rule on their email router to not allow links and attachments from outside the network would have prevented this. In essence these big companies are leaving the door unlocked and keep acting surprised when people that don't like them open it up and poke around inside. There needs to be more education and common sense this sounds like a very easy attack to prevent.

corford 14y ago

All this focus on the sophistication of the Chinese hackers irritates me slightly. Reading between the lines, it seems the NYT would likely have weathered this "sophisticated" attack a lot better if they had observed a few simple security best practices: - Salt your password hashes (rendering rainbow tables inert) - Train your staff NOT to open attachments from unknown sources (especially if you've just written an inflammatory article on a foreign government official) - Configure your mail server to automatically strip and quarantine any attachment (inbound or outbound) that isn't of a type defined in a very strict white list - In addition to network firewalls, make use of the software firewall on the PC's themselves by tightly controlling what processes on the machines are given egress permission This stuff isn't rocket science and if the NYT can't get it right (knowing that they're a natural high profile target), what hope do other firms have? The focus of the discussion should be on getting to the bottom of why we keep seeing these basic security oversights being made over and over again, not panicking about Chinese über hackers and suggesting everyone move to smart cards, retina scans or paper.

brown9-2 14y ago
The point about hashes is irrelevant as the corporate passwords were stolen from Microsoft Windows domain controller. Users of Windows domains aren't free to swap in their own implementation of how password storage works.
nikcub 14y ago
> Salt your password hashes As brown9-2 mentions in his reply, it was a Windows Domain Controller > Train your staff NOT to open attachments from unknown sources Spear phishing attacks are more sophisticated than that. They aren't sending .EXE files. The two most common attachments are RTF[0] and PDF[1], or a link in the email body to a website that will attempt a drive-by download. These emails are composed in a way to make them look innocent (for eg. 'Twitter Password Reset Request', 'New Amazon.com Order', or an email from a new source, etc.). It is also likely that at this level of sophistication that there are 0day exploits involved. Attackers can send hundreds of spear emails over weeks and months, they just need a single click from one user to get their foot in the door. > quarantine any attachment (inbound or outbound) that isn't of a type defined in a very strict white list As mentioned above, the attachment types are RTF, PDF and XLS - and much more common is a link in an HTML email. > make use of the software firewall on the PC's The command and control servers send commands to ordinary looking websites using HTTPS. If you read the analysis of Flame or Stuxnet you will see the lengths that the designers went to to obfuscate this traffic. This analysis[2] describes what the C&C servers looked like for Flame. The admin panels make no mention of bots or worms, it looks like any other intranet site. It is really difficult to defend against these types of attacks. An attacker only needs 2 or 3 decent exploit writers to come up with a unique attack vector and a custom trojan tailored for the target. Also, time is on their side and they only need a single hit while you need to find and shut down all of the attempts. [0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3333 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3333 [1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4363 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4363 [2] http://www.securelist.com/en/blog/750/Full_Analysis_of_Flame_s_Command_Control_servers http://www.securelist.com/en/blog/750/Full_Analysis_of_Flame...

chayesfss 14y ago

Looks like their mail is just protected by username & password too