8 ms·

Why China Is Reading Your Email

43 points by denzil_correa 14y ago

deleted 14y ago
[deleted]
opinali 14y ago
Not mine...
teawithcarl 14y ago
This article is EXACTLY correct. I speak/read Chinese and Japanese fluently, since 1987. The scale of China's corporate hacking is historic and state-sponsored - exceeding any nation in history by a wide berth. State sponsored hacking at this unprecedented scale wrecks society in both China and America. The massive level of invasion will leave us all living in a more broken down world.
- Spooky23 14y ago
  It has always puzzled me that even sophisticated audiences like HN regard this situation by killing the messenger. Usually reactions are mostly "meh", "Where is your tinfoil hat?", or "the US does it too". At the end of the day, as proprietors of Internet services, the information being stolen from you or your company is your customer's data. You should care and be alarmed.
  - diminoten 14y ago
    I'd just keep track of the usernames who say that, wait until they reveal their identity elsewhere on HN via a "Show HN" or something, then ask them publicly to explain what their stance is on protecting their users' data. When they give the famous cookie-cutter response of, "Obviously we care." then you can hit them with, "but did you not say 'meh' when this same issue came up a few months ago?"
- chewxy 14y ago
  As do I (reading/speaking chinese fluently). However your second statement really warrants a [citation needed] tag
HarryHirsch 14y ago
Countries engage in espionage. Water is wet.
- teawithcarl 14y ago
  Cultural relativism (espionage damage is equal) trivializes towards inaction. Water is wet.
  - coldtea 14y ago
    Bias (our espionage is better) trivializes towards acceptance. Water is wet.
- diminoten 14y ago
  Countries don't usually engage in espionage on behalf of private entities, with other private entities as their target, with explicit economic goals.
  - HarryHirsch 14y ago
    What? Industrial espionage is age-old, and you would expect nations to engage in it. It is a method of economic development.
    - diminoten 14y ago
      No you wouldn't, that's a huge conflict of interest in the modern world.
  - hindsightbias 14y ago
    China is the new France http://www.nytimes.com/1991/09/14/news/14iht-spy_.html http://www.nytimes.com/1991/09/14/news/14iht-spy_.html (which was the new Japan in 91 or so).
    - diminoten 14y ago
      No they're not, this is unlike anything anyone's ever done before, unless you decide to generalize to the point where you lose almost all relevant data.
cwisecarver 14y ago
Create a bunch of well-crafted honeypots, put the proof on the international stage. Embarrassment and sanctions ensue.
- charonn0 14y ago
  Digital forensics aren't as damning or incontrovertible as, for example, Adlai Stevenson's Cuban Missile presentation[1]. [1]: https://www.youtube.com/watch?v=MSV9_J8Csts https://www.youtube.com/watch?v=MSV9_J8Csts
coldtea 14y ago
I don't care why (and if) China is reading my email (I have a Gmail account). Can you please answer why the US and EU is reading my email? Both has related laws, email retention policy, email "wiretapping" systems, and have been known to abuse the "court order" system and just go ahead and read everything they like. I could not care less for China reading it, because China is more than ten thousand miles away, and is not known to interfere with my country and people's lives, unlike the US and EU.
- greenmountin 14y ago
  Solutions exist, but no one uses them. You are getting spam because you are not requiring hashcash. They are reading your email because you are not encrypting it. Government and law-enforcement, even if trust-worthy, function via intermediaries who may not be. This will just never improve and I think we have to address that with the tools we know will do the job.
  - unclebucknasty 14y ago
    Respectfully, that merely explains how they are able to read it, not "why" as the parent asks.
  - betterunix 14y ago
    "They are reading your email because you are not encrypting it." One of the problems we have here is that tools like PGP and S/MIME require the receiver to do something before the sender can encrypt a message for them. We need something like identity based encryption, where the sender decides if the message will be encrypted and the receiver does not need to publish anything in advance (threshold IBE systems should probably be used to ensure that no single entity can read everyone's mail). Unfortunately, IBE and related technologies are thoroughly patent-encumbered, and so it will be a long time before we can just deploy it freely.
    - Retric 14y ago
      You need to exchange key's before you can encrypt a message. Think of it like this in a pure one way communication you send all parts of the message, and anyone who reads it can decode it. If you instead get one of there key's (even if it's from a 3rd party) you can encrypt something for them. Or you can think of it like this, if the receiver never makes any key's there is nothing special about them that prevents others from reading there messages.
denzil_correa 14y ago
First, There is a nice counter argument in the article - But what about the argument that the U.S. is shedding crocodile tears? America (and Israel) were almost certainly behind the most successful known cyber attack to date: the Stuxnet virus that impeded Iran's uranium- enrichment program. There might be some comfort in knowing that the U.S. is doing unto China what China is doing unto the U.S. Second, I think people who are saying - "I don't care" to China reading their email account are unaware of the implicit repercussions. Another snip from the article "If I had access to your bank account, would you worry? If I had access to your home security system, would you worry? If I have access to the pipes coming into your house? Not just your security system but your gas, your electric—and you're the Pentagon? Maybe nobody's been killed yet, but I don't want you having the ability to hold me hostage. I don't want that. I don't want you to be able to blackmail me at any point in time that you want." It's the potential ability for a foreign host to keep you hostage which is the real worry was a citizen.
tstactplsignore 14y ago
We do need a proper response to this kind of threat, but it's almost certainly not the response we're ever going to get from the politicians in Washington. Serious cyber policy should at least include the following: A. Comprehensive technological education for employees who even might come into contact with sensitive information at government institutions, military institutions, or high-profile private firms like banks and software companies. B. A push for using modern, transparent, open-source, reviewed software and hardware for all vital tech infrastructure. No more legacy FORTRAN or Windows XP or Internet Explorer 5. C. Taking the power grid off of the public internet and onto a closely monitored and private infranet.
- superuser2 14y ago
  Definitely B. I think a scary percentage of IT managers feel that their legacy Fortran XP/IE5 computer systems are actually more secure than modern alternatives. We're going to have a find a way around that sentiment.
- w1ntermute 14y ago
  Don't forget that we also need to establish squadrons of cyberwarriors to covertly hack into and steal information from Chinese government entities and large Chinese corporations.
- coldcode 14y ago
  What does FORTRAN have to do with computer security? FORTRAN is still the most common language used in high performance computing, but in no case is it used for security or web access.
- jlgaddis 14y ago
  Unfortunately, all of those are easily bypassed by the average corporate employee who will still open that attachment, dismiss the warning dialogs, or click "OK" on any message that pops up.
lgleason 14y ago
If you want to discourage this kind of behavior stop feeding the machine.... You can't do that when you run year over year trade deficits with these guys. Reign that in and you will have a chance at solving this problem.
- teawithcarl 14y ago
  Freakonomics - cyber attacks must "cost" China money. Bitter pill, but strong trade damage is the only pocketbook China will listen to. Cyber attacks must be directly tied to China losing money.
ChuckMcM 14y ago
I keep hoping we'll respond to these challenges with more DARPA challenge like prizes and fewer additions to the CFAA.
forgottenpaswrd 14y ago
Wow, this is fantastic. The US media is preparing a new scapegoat: Chinese hackers, so if financial institutions fail(they are currently set to fail for their selves) they have an enemy they could use. Note in the article, if people can't use their ATMs, like in Cyprus, Chinese are the ones responsible!! Brilliant, like Nazism used Communism(Reichstag fire) and Communism(Stalin) used Nazism as an excuse to gain more and more power from its citizens, US of America needs new enemies, as Sadam Hussein and Osaba Bin Laden are dead in order to make the powerful more powerful, the TSA more freedom killers and citizens less autonomous from the government.
- fkdjs 14y ago
  OMG, it's like we can't focus on multiple things at once. How about this revelation: people in cyprus can't use ATMs because they can't manage their money, and Chinese government-sponsored hackers are also targeting American businesses. I know, it's a lot to concentrate on. But seriously, I like many others on this tech-centered news site where we pretty much run the entire internet collectively, have seen first hand Chinese-sponsored hackers. So you can't really pull the wool over our eyes so easily.
- acqq 14y ago
  You are more than right. To the other readers: Whenever you can read the kind of articles like the TFA you can be certain of only one thing: some propaganda office somewhere either wrote it or motivated somebody to write it that way. The military people have zero interest to present such details to the public, the propaganda people do but only if the purpose is "to prepare the opinion at home" (the pretext) for something that is going to follow. So just remeber this for now, I'm sure you'll see something will happen soon but not initiated from the other side. It's not a tinfoil-hat-imagined conspiracy but how "the machinery" of structures with different interests imperfect as it is "shines" to the outer world. For examples of similar actions from not so long ago: http://www.time.com/time/magazine/avrticle/0,9171,994414,00.html http://www.time.com/time/magazine/avrticle/0,9171,994414,00.... Unless you're one of those on the payroll, don't happy, be worry.
  - berntb 14y ago
invdevm 14y ago
As if US itself isn't reading our emails. Nonsense article. US created Al-Qaida first. And that's a fact. US attacked Iraq bcoz of their stupid chemical weapons argument. And US still support Pakisan despite the fact that Pakistan supplied nuclear technology to China as well as North Korea and is sponsoring terrorism. US thinks that since they are a developed nation, whatever they are doing is right. Well above facts doesn't support the thinking. The fact is that US is a fool, fooling their own citizens and promoting universal hatred.
DanielBMarkham 14y ago
Mainly because none of this has ever been done before, there exists a low-level state of war between many opposing nations, even small third-parties (http://freedom-or-safety.com/blog/when-will-the-first-hacker-be-killed/ http://freedom-or-safety.com/blog/when-will-the-first-hacker...) I don't see China as being made a scapegoat. I see the system working itself out. New technologies always create new relationships between people and governments. When the net rolled out, we thought the openness would bring about positive reforms. What seems to be happening is that governments are getting very good at controlling what citizens read. Instead they're using the openness of the net as an attack vector. Not exactly what we expected.
SCAQTony 14y ago
That was absolutely chilling! I am sorry I don't have anything of value to contribute but to me this is an historical equal to the Soviets launching a satellite into space. I think it deserves an internet infrastructure response from the US. Thank you for posting
rikacomet 14y ago
I did go back, and checked my email account. No, its only me who is reading my emails, its a corporate espionage problem, corporations have to deal with it. Normal people don't have anything of interest for state sponsored intrusions, thus are not targeted. Please dear journalists, don't drag me in this war, I know someone is pissed here and there on both side, and both have armies like muscles, too tempting for both side to flex, but seriously, this is not diplomacy! We as people, should root out both govt democratically if they even dare to wage a open cyber war. If my govt would do that, I would seriously vote against any war, no matter how just it may sound. Americans have a life, Chinese people also have a life. I don't see the problem in common people's life.
deleted 14y ago
[deleted]
fishstix55 14y ago
I ran an intrusion detection and firewall appliance during my stay in China and the attempts were relentless. Tl;dr Got data you care about? Bring a throwaway laptop and cellphone on arrival. Rotate passwords.
rurban 14y ago
Because US tech companies still use MS Windows and their employers may use Facebook and Gmail on their PCs. Easy as that

43 points by denzil_correa 14y ago

deleted 14y ago

[deleted]

opinali 14y ago

Not mine...

teawithcarl 14y ago

This article is EXACTLY correct. I speak/read Chinese and Japanese fluently, since 1987. The scale of China's corporate hacking is historic and state-sponsored - exceeding any nation in history by a wide berth. State sponsored hacking at this unprecedented scale wrecks society in both China and America. The massive level of invasion will leave us all living in a more broken down world.

Spooky23 14y ago
It has always puzzled me that even sophisticated audiences like HN regard this situation by killing the messenger. Usually reactions are mostly "meh", "Where is your tinfoil hat?", or "the US does it too". At the end of the day, as proprietors of Internet services, the information being stolen from you or your company is your customer's data. You should care and be alarmed.
- diminoten 14y ago
  I'd just keep track of the usernames who say that, wait until they reveal their identity elsewhere on HN via a "Show HN" or something, then ask them publicly to explain what their stance is on protecting their users' data. When they give the famous cookie-cutter response of, "Obviously we care." then you can hit them with, "but did you not say 'meh' when this same issue came up a few months ago?"
chewxy 14y ago
As do I (reading/speaking chinese fluently). However your second statement really warrants a [citation needed] tag

HarryHirsch 14y ago

Countries engage in espionage. Water is wet.

teawithcarl 14y ago
Cultural relativism (espionage damage is equal) trivializes towards inaction. Water is wet.
- coldtea 14y ago
  Bias (our espionage is better) trivializes towards acceptance. Water is wet.
diminoten 14y ago
Countries don't usually engage in espionage on behalf of private entities, with other private entities as their target, with explicit economic goals.
- HarryHirsch 14y ago
  What? Industrial espionage is age-old, and you would expect nations to engage in it. It is a method of economic development.
  - diminoten 14y ago
    No you wouldn't, that's a huge conflict of interest in the modern world.
- hindsightbias 14y ago
  China is the new France http://www.nytimes.com/1991/09/14/news/14iht-spy_.html http://www.nytimes.com/1991/09/14/news/14iht-spy_.html (which was the new Japan in 91 or so).
  - diminoten 14y ago
    No they're not, this is unlike anything anyone's ever done before, unless you decide to generalize to the point where you lose almost all relevant data.

cwisecarver 14y ago

Create a bunch of well-crafted honeypots, put the proof on the international stage. Embarrassment and sanctions ensue.

charonn0 14y ago
Digital forensics aren't as damning or incontrovertible as, for example, Adlai Stevenson's Cuban Missile presentation[1]. [1]: https://www.youtube.com/watch?v=MSV9_J8Csts https://www.youtube.com/watch?v=MSV9_J8Csts

coldtea 14y ago

I don't care why (and if) China is reading my email (I have a Gmail account). Can you please answer why the US and EU is reading my email? Both has related laws, email retention policy, email "wiretapping" systems, and have been known to abuse the "court order" system and just go ahead and read everything they like. I could not care less for China reading it, because China is more than ten thousand miles away, and is not known to interfere with my country and people's lives, unlike the US and EU.

greenmountin 14y ago
Solutions exist, but no one uses them. You are getting spam because you are not requiring hashcash. They are reading your email because you are not encrypting it. Government and law-enforcement, even if trust-worthy, function via intermediaries who may not be. This will just never improve and I think we have to address that with the tools we know will do the job.
- unclebucknasty 14y ago
  Respectfully, that merely explains how they are able to read it, not "why" as the parent asks.
- betterunix 14y ago
  "They are reading your email because you are not encrypting it." One of the problems we have here is that tools like PGP and S/MIME require the receiver to do something before the sender can encrypt a message for them. We need something like identity based encryption, where the sender decides if the message will be encrypted and the receiver does not need to publish anything in advance (threshold IBE systems should probably be used to ensure that no single entity can read everyone's mail). Unfortunately, IBE and related technologies are thoroughly patent-encumbered, and so it will be a long time before we can just deploy it freely.
  - Retric 14y ago
    You need to exchange key's before you can encrypt a message. Think of it like this in a pure one way communication you send all parts of the message, and anyone who reads it can decode it. If you instead get one of there key's (even if it's from a 3rd party) you can encrypt something for them. Or you can think of it like this, if the receiver never makes any key's there is nothing special about them that prevents others from reading there messages.

denzil_correa 14y ago

First, There is a nice counter argument in the article - But what about the argument that the U.S. is shedding crocodile tears? America (and Israel) were almost certainly behind the most successful known cyber attack to date: the Stuxnet virus that impeded Iran's uranium- enrichment program. There might be some comfort in knowing that the U.S. is doing unto China what China is doing unto the U.S. Second, I think people who are saying - "I don't care" to China reading their email account are unaware of the implicit repercussions. Another snip from the article "If I had access to your bank account, would you worry? If I had access to your home security system, would you worry? If I have access to the pipes coming into your house? Not just your security system but your gas, your electric—and you're the Pentagon? Maybe nobody's been killed yet, but I don't want you having the ability to hold me hostage. I don't want that. I don't want you to be able to blackmail me at any point in time that you want." It's the potential ability for a foreign host to keep you hostage which is the real worry was a citizen.

tstactplsignore 14y ago

We do need a proper response to this kind of threat, but it's almost certainly not the response we're ever going to get from the politicians in Washington. Serious cyber policy should at least include the following: A. Comprehensive technological education for employees who even might come into contact with sensitive information at government institutions, military institutions, or high-profile private firms like banks and software companies. B. A push for using modern, transparent, open-source, reviewed software and hardware for all vital tech infrastructure. No more legacy FORTRAN or Windows XP or Internet Explorer 5. C. Taking the power grid off of the public internet and onto a closely monitored and private infranet.

superuser2 14y ago
Definitely B. I think a scary percentage of IT managers feel that their legacy Fortran XP/IE5 computer systems are actually more secure than modern alternatives. We're going to have a find a way around that sentiment.
w1ntermute 14y ago
Don't forget that we also need to establish squadrons of cyberwarriors to covertly hack into and steal information from Chinese government entities and large Chinese corporations.
coldcode 14y ago
What does FORTRAN have to do with computer security? FORTRAN is still the most common language used in high performance computing, but in no case is it used for security or web access.
jlgaddis 14y ago
Unfortunately, all of those are easily bypassed by the average corporate employee who will still open that attachment, dismiss the warning dialogs, or click "OK" on any message that pops up.

lgleason 14y ago

If you want to discourage this kind of behavior stop feeding the machine.... You can't do that when you run year over year trade deficits with these guys. Reign that in and you will have a chance at solving this problem.

teawithcarl 14y ago
Freakonomics - cyber attacks must "cost" China money. Bitter pill, but strong trade damage is the only pocketbook China will listen to. Cyber attacks must be directly tied to China losing money.

ChuckMcM 14y ago

I keep hoping we'll respond to these challenges with more DARPA challenge like prizes and fewer additions to the CFAA.

forgottenpaswrd 14y ago

Wow, this is fantastic. The US media is preparing a new scapegoat: Chinese hackers, so if financial institutions fail(they are currently set to fail for their selves) they have an enemy they could use. Note in the article, if people can't use their ATMs, like in Cyprus, Chinese are the ones responsible!! Brilliant, like Nazism used Communism(Reichstag fire) and Communism(Stalin) used Nazism as an excuse to gain more and more power from its citizens, US of America needs new enemies, as Sadam Hussein and Osaba Bin Laden are dead in order to make the powerful more powerful, the TSA more freedom killers and citizens less autonomous from the government.

fkdjs 14y ago
OMG, it's like we can't focus on multiple things at once. How about this revelation: people in cyprus can't use ATMs because they can't manage their money, and Chinese government-sponsored hackers are also targeting American businesses. I know, it's a lot to concentrate on. But seriously, I like many others on this tech-centered news site where we pretty much run the entire internet collectively, have seen first hand Chinese-sponsored hackers. So you can't really pull the wool over our eyes so easily.
acqq 14y ago
You are more than right. To the other readers: Whenever you can read the kind of articles like the TFA you can be certain of only one thing: some propaganda office somewhere either wrote it or motivated somebody to write it that way. The military people have zero interest to present such details to the public, the propaganda people do but only if the purpose is "to prepare the opinion at home" (the pretext) for something that is going to follow. So just remeber this for now, I'm sure you'll see something will happen soon but not initiated from the other side. It's not a tinfoil-hat-imagined conspiracy but how "the machinery" of structures with different interests imperfect as it is "shines" to the outer world. For examples of similar actions from not so long ago: http://www.time.com/time/magazine/avrticle/0,9171,994414,00.html http://www.time.com/time/magazine/avrticle/0,9171,994414,00.... Unless you're one of those on the payroll, don't happy, be worry.
- berntb 14y ago

invdevm 14y ago

As if US itself isn't reading our emails. Nonsense article. US created Al-Qaida first. And that's a fact. US attacked Iraq bcoz of their stupid chemical weapons argument. And US still support Pakisan despite the fact that Pakistan supplied nuclear technology to China as well as North Korea and is sponsoring terrorism. US thinks that since they are a developed nation, whatever they are doing is right. Well above facts doesn't support the thinking. The fact is that US is a fool, fooling their own citizens and promoting universal hatred.

DanielBMarkham 14y ago

Mainly because none of this has ever been done before, there exists a low-level state of war between many opposing nations, even small third-parties (http://freedom-or-safety.com/blog/when-will-the-first-hacker-be-killed/ http://freedom-or-safety.com/blog/when-will-the-first-hacker...) I don't see China as being made a scapegoat. I see the system working itself out. New technologies always create new relationships between people and governments. When the net rolled out, we thought the openness would bring about positive reforms. What seems to be happening is that governments are getting very good at controlling what citizens read. Instead they're using the openness of the net as an attack vector. Not exactly what we expected.

SCAQTony 14y ago

That was absolutely chilling! I am sorry I don't have anything of value to contribute but to me this is an historical equal to the Soviets launching a satellite into space. I think it deserves an internet infrastructure response from the US. Thank you for posting

rikacomet 14y ago

I did go back, and checked my email account. No, its only me who is reading my emails, its a corporate espionage problem, corporations have to deal with it. Normal people don't have anything of interest for state sponsored intrusions, thus are not targeted. Please dear journalists, don't drag me in this war, I know someone is pissed here and there on both side, and both have armies like muscles, too tempting for both side to flex, but seriously, this is not diplomacy! We as people, should root out both govt democratically if they even dare to wage a open cyber war. If my govt would do that, I would seriously vote against any war, no matter how just it may sound. Americans have a life, Chinese people also have a life. I don't see the problem in common people's life.

deleted 14y ago

[deleted]

fishstix55 14y ago

I ran an intrusion detection and firewall appliance during my stay in China and the attempts were relentless. Tl;dr Got data you care about? Bring a throwaway laptop and cellphone on arrival. Rotate passwords.

rurban 14y ago

Because US tech companies still use MS Windows and their employers may use Facebook and Gmail on their PCs. Easy as that