3 ms·

"Without establishing a solid connection to China, there will always be room for observers to dismiss APT actions as uncoordinated, solely criminal in nature, o

by nohat 14y ago

"Without establishing a solid connection to China, there will always be room for observers to dismiss APT actions as uncoordinated, solely criminal in nature, or peripheral to larger national security and global economic concerns. We hope that this report will lead to increased understanding and coordinated action in countering APT network breaches." This really is the key point. People generally believed that the major hacks have been Chinese government based, but without publicized proof public policy is unlikely to change. China (and people who don't want to insult China) can get away with dismissing the mountain of circumstantial evidence because few people with power want to directly accuse it. Maybe this report will start to change the situation.

martindale 14y ago
Strong ties have been established with attacks like this already, this isn't the first time. Sadly my source [1] has disappeared, but I literally just finished an aggregation of other content [2] this morning. [1]: http://en.wikipedia.org/wiki/Titan_Rain#cite_note-SANS-2 http://en.wikipedia.org/wiki/Titan_Rain#cite_note-SANS-2 -- archived at http://web.archive.org/web/20051214143959/http://www.breitbart.com/news/2005/12/12/051212224756.jwmkvntb.html http://web.archive.org/web/20051214143959/http://www.breitba... but I can't find any further quotes from the SANS Institute on what their deductions were based on. [2]: https://plus.google.com/112353210404102902472/posts/T4THntTxbRE https://plus.google.com/112353210404102902472/posts/T4THntTx...
- nohat 14y ago
  I agree that pretty much anyone who gave a cursory inspection would come to the conclusion that the attacks were from Chinese intelligence. There were still lots of defences of China claiming it could be patriotic hackers, or that the evidence was circumstantial. I think some of this was that if US officials make it clear that they know the attacks are from China it puts them under pressure to act (potentially in a way that would anger China). Diplomatically it's more convenient to pretend not to be sure.
  - joequant 14y ago
    There's also the matter of "is this worth starting a war over?" One thing about this is that Chinese military is not the same thing as Chinese intelligence. The main Chinese intelligence agency is the Ministry of State Security. Mixing up the PLA with the MSS is like mixing up the DOD with the CIA. I doubt that the United States government will do anything more than "raise the issue." The trouble is that if the US does something like file a formal diplomatic protest, it will be a promise by the United States not to try to do anything similar, and I don't see how the US would consider that to be in its national interest. One other interesting thing is that the Chinese hacker community is very different from the US hacker community, in that US hackers tend to hate the military and authoritarian systems whereas the Chinese hacker community sees themselves as patriotic defenders of the motherland. A lot of this has to do with differences in history (i.e. the US involvement with Vietnam). Something that gives you an idea of the difference is that if you go to any newsstand, you'll see a lot of military magazines, and so hackers in China are "solider wannabees" in ways that hackers in the US aren't.
    - greedo 14y ago
      APT is just an externality for US biz right now. The fact that the Chinese were able to steal the plans to the JSF doesn't really hurt Lockheed-Martin's ability to sell the plane to the US or allies. Of course it hurts the ability of the buyers to effectively deploy the JSF against anyone able to buy JSF data from the Chinese; but LockMart really doesn't care too much about that.
    - D9u 14y ago
      "...Mixing up the PLA with the MSS is like mixing up the DOD with the CIA." DoD & the "Intelligence Community" have been working together a lot more closely than you think, especially since 11-Sep-2001. http://www.armedforcesjournal.com/2012/11/11795254 http://www.armedforcesjournal.com/2012/11/11795254
  - Volpe 14y ago
    Also, It would depend on what kind of evidence China has on US hacking China.

by nohat 14y ago

martindale 14y ago

Strong ties have been established with attacks like this already, this isn't the first time. Sadly my source [1] has disappeared, but I literally just finished an aggregation of other content [2] this morning. [1]: http://en.wikipedia.org/wiki/Titan_Rain#cite_note-SANS-2 http://en.wikipedia.org/wiki/Titan_Rain#cite_note-SANS-2 -- archived at http://web.archive.org/web/20051214143959/http://www.breitbart.com/news/2005/12/12/051212224756.jwmkvntb.html http://web.archive.org/web/20051214143959/http://www.breitba... but I can't find any further quotes from the SANS Institute on what their deductions were based on. [2]: https://plus.google.com/112353210404102902472/posts/T4THntTxbRE https://plus.google.com/112353210404102902472/posts/T4THntTx...

nohat 14y ago
I agree that pretty much anyone who gave a cursory inspection would come to the conclusion that the attacks were from Chinese intelligence. There were still lots of defences of China claiming it could be patriotic hackers, or that the evidence was circumstantial. I think some of this was that if US officials make it clear that they know the attacks are from China it puts them under pressure to act (potentially in a way that would anger China). Diplomatically it's more convenient to pretend not to be sure.
- joequant 14y ago
  There's also the matter of "is this worth starting a war over?" One thing about this is that Chinese military is not the same thing as Chinese intelligence. The main Chinese intelligence agency is the Ministry of State Security. Mixing up the PLA with the MSS is like mixing up the DOD with the CIA. I doubt that the United States government will do anything more than "raise the issue." The trouble is that if the US does something like file a formal diplomatic protest, it will be a promise by the United States not to try to do anything similar, and I don't see how the US would consider that to be in its national interest. One other interesting thing is that the Chinese hacker community is very different from the US hacker community, in that US hackers tend to hate the military and authoritarian systems whereas the Chinese hacker community sees themselves as patriotic defenders of the motherland. A lot of this has to do with differences in history (i.e. the US involvement with Vietnam). Something that gives you an idea of the difference is that if you go to any newsstand, you'll see a lot of military magazines, and so hackers in China are "solider wannabees" in ways that hackers in the US aren't.
  - greedo 14y ago
    APT is just an externality for US biz right now. The fact that the Chinese were able to steal the plans to the JSF doesn't really hurt Lockheed-Martin's ability to sell the plane to the US or allies. Of course it hurts the ability of the buyers to effectively deploy the JSF against anyone able to buy JSF data from the Chinese; but LockMart really doesn't care too much about that.
  - D9u 14y ago
    "...Mixing up the PLA with the MSS is like mixing up the DOD with the CIA." DoD & the "Intelligence Community" have been working together a lot more closely than you think, especially since 11-Sep-2001. http://www.armedforcesjournal.com/2012/11/11795254 http://www.armedforcesjournal.com/2012/11/11795254
- Volpe 14y ago
  Also, It would depend on what kind of evidence China has on US hacking China.