4 ms·

I would like to quote a past comment http://www.reddit.com/r/netsec/comments/m0i93/_/c2x87tb http://www.reddit.com/r/netsec/comments/m0i93/_/c2x87tb - the volu

by xfs 14y ago

I would like to quote a past comment http://www.reddit.com/r/netsec/comments/m0i93/_/c2x87tb http://www.reddit.com/r/netsec/comments/m0i93/_/c2x87tb - the volume of attack coming from Chinese IP addresses but are essentially non-Chinese in origin is substantial. The windows xp piracy rate ends up in a very low uptake of windows update, leaving quite possibly the largest population of vulnerable hosts in the world. Attacks end up being false-flag even if not intended - Attacks that are genuinely Chinese in origin tend towards being citizen initiatives. Imagine if you lived in a jurisdiction where instead of being treated like Garry McKinnon for attacking American infrastructure, just nobody gives a fuck. The reverse also applies, but has a limit that Chinese is not widely understood by American 'hackers'. Any Chinese skiddie can cause an international incident by trying out their tools on an American company. Universities that run courses in infosec, of which some are military, are commonly accused origin IPs for attacks. The likelihood is that complacence, rather than official sponsorship or policy is the prime driver behind this phenomenon. - Instead of trying to build out \cough\\ cybercommands, Government sponsored CTF tournaments identify and reward talent, without bringing it on-board the National Security apparatus. Talent is left out in the community on the understanding it can be found if needed. - The 'Chinese Government' is nowhere near as cohesive and controlling as is depicted in Western sources. Government sponsored economic espionage activities that are out of proportion to American efforts against the rest of the world will originate at the provincial level. Chinese industry is very regional, with whole provinces specializing in specific industries, hence the benefits of economic espionage is highly regional in nature too. It is not in the central government's interests to sustain the Chinese hacker folklore, nor would it be within their ability to rein in any provincial government involvement.

amalag 14y ago
Yes a government response to this sort of guerrila warfare against unnamed attackers will be interesting. They cannot just create strong penalties as the attackers are beyond their jurisdiction. Punishing China for anything within their IP space is also a non-starter, something the authors do not mention.
cscurmudgeon 14y ago
This is a very recent report. Your comment is more than a year old. Are you asserting that nothing has changed? Edit: From the report in the article "Our research and observations indicate that the Communist Party of China (CPC,中国共产党) is tasking the Chinese People’s Liberation Army (PLA,中国人民解放军) to commit systematic cyber espionage and data theft against organizations around the world " They have a whole section devoted to backing this up.
- contingencies 14y ago
  commit systematic cyber espionage and data theft Most nations have something like this these days (eg. Australia, France, Germany, Korea, UK, US.) The US military terms this move toward constant low-level conflict with a focus on information warfare the RMA or Revolution in Military Affairs. Also note that quoting five words of mandarin (五个汉字) may function may make a commercially produced report appear more authoritative, but in practice it probably demonstrates the opposite.
  - cscurmudgeon 14y ago
    > Most nations have something like this these days (eg. Australia, France, Germany, Korea, UK, US.) Are you asserting that these nations have broken into non military infrastructure of some other nation they are at peace with? You are also asserting that these countries are stealing corporate data. Can you back that up? Do they compare with what China is doing? > Also note that quoting five words of mandarin (五个汉字) may function may make a commercially produced report appear more authoritative, but in practice it probably demonstrates the opposite. That doesn't hold for everyone. I agree with you that, in general, Mandarin is sort of fad-ish.
    - contingencies 14y ago
      Are you asserting that these nations have broken into non military infrastructure of some other nation they are at peace with? Certainly, they do it all the time. It's considered par for the course these days. It's not always breaking in to the infrastructure, sometimes it's providing it. For just two well known examples, look at Israel's Mossad-affiliated AMDOCS company's widespread global telecommunications data theft with "hosted billing solutions" for major mobile and fixed-line telecommunications carriers worldwide (certainly US and EU-wide). Or, look at the European Union's exposure of how the US has been constantly abusing surveillance capabilities for global geostrategic business purposes in their original report on Echelon; IIRC they had a very well documented case of Airbus vs. Boeing. These things don't stand still, and the above examples are continuing but originated 10+ years ago. IMHO it is now ignorant to believe that we live in anything less than a world of constant conflict where corporate-government mutual assistance and backscratching are the order of the day and citizens rights are nothing more than a quaint, antiquated notion you can easily put down in court given enough lawyers, legal entities, deniability, media gag orders (UK tops the world for these), assassinations (Singapore is up there), imprisonment (US after Wikileaks) or the odd, extreme, resignation.
forgotAgain 14y ago
Bullshit.

by xfs 14y ago

amalag 14y ago

Yes a government response to this sort of guerrila warfare against unnamed attackers will be interesting. They cannot just create strong penalties as the attackers are beyond their jurisdiction. Punishing China for anything within their IP space is also a non-starter, something the authors do not mention.

cscurmudgeon 14y ago

This is a very recent report. Your comment is more than a year old. Are you asserting that nothing has changed? Edit: From the report in the article "Our research and observations indicate that the Communist Party of China (CPC,中国共产党) is tasking the Chinese People’s Liberation Army (PLA,中国人民解放军) to commit systematic cyber espionage and data theft against organizations around the world " They have a whole section devoted to backing this up.

contingencies 14y ago
commit systematic cyber espionage and data theft Most nations have something like this these days (eg. Australia, France, Germany, Korea, UK, US.) The US military terms this move toward constant low-level conflict with a focus on information warfare the RMA or Revolution in Military Affairs. Also note that quoting five words of mandarin (五个汉字) may function may make a commercially produced report appear more authoritative, but in practice it probably demonstrates the opposite.
- cscurmudgeon 14y ago
  > Most nations have something like this these days (eg. Australia, France, Germany, Korea, UK, US.) Are you asserting that these nations have broken into non military infrastructure of some other nation they are at peace with? You are also asserting that these countries are stealing corporate data. Can you back that up? Do they compare with what China is doing? > Also note that quoting five words of mandarin (五个汉字) may function may make a commercially produced report appear more authoritative, but in practice it probably demonstrates the opposite. That doesn't hold for everyone. I agree with you that, in general, Mandarin is sort of fad-ish.
  - contingencies 14y ago
    Are you asserting that these nations have broken into non military infrastructure of some other nation they are at peace with? Certainly, they do it all the time. It's considered par for the course these days. It's not always breaking in to the infrastructure, sometimes it's providing it. For just two well known examples, look at Israel's Mossad-affiliated AMDOCS company's widespread global telecommunications data theft with "hosted billing solutions" for major mobile and fixed-line telecommunications carriers worldwide (certainly US and EU-wide). Or, look at the European Union's exposure of how the US has been constantly abusing surveillance capabilities for global geostrategic business purposes in their original report on Echelon; IIRC they had a very well documented case of Airbus vs. Boeing. These things don't stand still, and the above examples are continuing but originated 10+ years ago. IMHO it is now ignorant to believe that we live in anything less than a world of constant conflict where corporate-government mutual assistance and backscratching are the order of the day and citizens rights are nothing more than a quaint, antiquated notion you can easily put down in court given enough lawyers, legal entities, deniability, media gag orders (UK tops the world for these), assassinations (Singapore is up there), imprisonment (US after Wikileaks) or the odd, extreme, resignation.

forgotAgain 14y ago

Bullshit.