4 ms·
I don't think DDoS is a real offensive weapon in cyber-warfare. It's just a noise-making attention-drawing machine. What the paper calls targeted exploitation
by wsxcde 12y ago
I don't think DDoS is a real offensive weapon in cyber-warfare. It's just a noise-making attention-drawing machine.
What the paper calls targeted exploitation is the real weapon here. The main thing I took away from this paper is that the Chinese government now has the infrastructure to pwn anyone who visits websites hosted in China. This is pretty scary and simultaneously an amazing engineering feat.
- LiweiZ 12y agoAny advice for visitors of those websites hosted in China? As a Chinese, I am always wondering if there is a way to avoid this. Many of us are aware of the backdoors in the Chinese apps (across all the platforms). No matter how big names they are, they have to comply with the order from the ruling ones (I guess most of them cooperate with little guilty feeling). The best I can think of is to have different devices for visiting/using Chinese apps/websites. To a larger scale, I think average users have very limited resources to hide from big organizations. What average Joe could do is a more general question I have not figured out. Thanks in advance.
- Buge 12y agoThe ideal answer is to convince the sites you visit to use https.
- LiweiZ 12y agoI don't think, practically, we could expect anything positive from the other side. But still thanks.
- alphapapa 12y agoIf the Chinese government controls a single CA that's installed by default, couldn't they MitM any TLS connection that isn't pinning certs? Are there any Chinese CAs in any browsers' default installs? If so, they should probably be removed immediately.
- kijin 12y agoCNNIC is no longer trusted by Chrome due to recent incidents, and you can manually remove it from Firefox and IE. While you're at it, take a few minutes to browse the list and also remove anything that sounds Chinese. If any website you visit legitimately uses a Chinese SSL certificate, you can whitelist it specifically. I actually do this for SSL certificates signed by my own country's CA (not China), and it works wonderfully.
- comex 12y agoSome general advice, to decrease the chance any given browser exploit will work against you: - Disable Java; disable or whitelist Flash; use a different PDF reader than Adobe. - Use either Firefox with NoScript or Chrome. (Disabling JavaScript is highly effective at reducing attack surface, but on any sites you've whitelisted, Firefox is significantly less secure than Chrome due to the lack of sandbox, though they're working on it... I think that NoScript equivalents for Chrome don't work correctly, but could be wrong.) - Don't use XP! It no longer receives security updates... - For the same reason, on mobile, prefer devices that have up to date operating systems. Not perfect, but that's the state of computer security these days.
- LiweiZ 12y agoVery detailed. Thanks for your input.
- joshfraser 12y agoMost of China is running on outdated, no-longer-supported software with lots of vulnerabilities. Pawning those computers is easy as there is an abundance of well documented exploit vectors available.
- ianstallings 12y agoI disagree. If the history of EW/SIGINT has taught us anything it's that denial of service through saturation is effective. E.G. "Jamming".
- JoachimS 12y agoThe question is if that truth transcends well from broadcast media (i.e. Radio) to packet based, routed networks such as the Internet. Esp long term effects.