Slashdot Mirror
Chinese Hackers Targeting NYPD Computers
Mike writes "A network of hackers, most based in China, have been making up to 70,000 attempts a day to break into the NYPD's computer system, the city's Commissioner, Raymond Kelly, revealed Wednesday. Kelly suggested that 'perhaps it is because of the NYPD's reach into the international arena' that they are being targeted for computer hacking 'in much the way the Pentagon has been.' The hackers are apparently using a botnet to make up to 5,000 attempts a day at various unsecured portals into the NYPD's files. China's foreign ministry spokesman Qin Gang denied involvement in computer espionage. 'Some people outside of China are bent on fabricating lies of so-called Chinese computer spies,' he said last month. The obvious question is, why are the Chinese so interested in the NYPD computer network?"
Someone should create a GUI interface using Visual-Basic to track an IP!
Practice makes perfect.
why are the Chinese so interested in the NYPD computer network? Perhaps hey've been watching too much US "Law And Order" style television programming?
I've abandoned my search for truth; now I'm just looking for some useful delusions.
I like how the summary quotes the minister Qin Gang as denying any involvement, and then immediately goes on to ask "The obvious question is, why are the Chinese so interested in the NYPD computer network?".
Hey, I'm sure he's lying too...
Human trafficking? Drugs? Two obvious ones off the top of my head.
The obvious question is, why are the Chinese so interested in the NYPD computer network?
They're not. The bot herder is probably in New York, and controlling the bots by tunneling so it looks like he/she is in China.
Haven't you seen the movie Hackers?
One of our competitors trademarked the term "hypothesis". From now on, we will call them "boneheaded ideas".
is that once they hacked the computer systems, an hour later they needed to hack it again!
--
"It is now safe to switch off your computer."
They should do what I, and others do. Just block all traffic from certain countries.
With most of my sites, I'm not interested in international traffic and all I get is spammers and content scrapers. I cam across this tip on blocking spammers and scrapers using IPFilter on Solaris and just update my ipf.conf file from time to time if I notice anything strange coming in, which I check from time to time. I also grab lists of ip ranges to add as well.
While it bothers me a bit to limit access to sites in principle, I really don't get any benefit from international traffic that outweighs the nuisance of the few that ruin it for everyone else.
Dual Opteron < $600
The obvious question is, why are the Chinese so interested in the NYPD computer network?
No, the obvious question is why are the NYPD's computer people so dumb that they're reporting the generic, worm-generated port, web and ssh scans that everybody sees from China and everywhere else as an out-of-the-ordinary hacking attempt?
Moderating "-1, Disagree" is simple censorship. Have the guts to post your opinion.
Right people in China are attacking the NYPD computer systems.
That seems way more likely than people in NY using proxies in china.
Time to actually use the US "hackers" to teach important US computer users something about security, and demand more of it from the manufacturers.
Or start using OpenVMS for all important stuff. That OS is nice:)
The Chinese are trying to find out where the best and tastiest donuts in the NYC area are located.
Unfortunately for them, I happen to know the information they seek is loaded on an air gapped mainframe in the heart of Police HQ which is guarded by automatic defense systems and can only be accessed by the Chief of Police and Rudy Guiliani.
Yeah, they forgot to update who the mayor is... this is the police here, not the NSA, okay?
It seems rather irresponsible to simply assume "The Chinese" are interested in the NYPD at all. It could just be a few random people, some of which are Chinese. Why assume the government has any knowledge at all? Do people automatically assume a US-based hacker ring has the blessings of the US government? It's probably easier to operate in China currently. With massive population densities in some areas, you can fade in to the background, and with the areas where there's no one, a generator and satcom connection make it a real PITA to find you.
Canada: The US's more awesome sibling.
"The hackers are apparently using a botnet to make up to 5,000 attempts a day at various unsecured portals into the NYPD's files."
So, can someone explain why NY's finest have "various unsecured portals" which give access to their files?
Please tell me it's just sloppy editing, (again)...
I thought that everybody serious these days, (CIA, FBI...) had at least two internet portals - a 'public face' for external users and wannabee hackers and a private one protected by *very* state of the art stuff. Of course, most of the real stuff would be on secure intranet.
OK, OK, just me being naÃve again...
"Qin Gang denied involvement in computer espionage."
. And the Chinese gymnasts in diapers are still 16.
Beer is proof that God loves us and wants us to be happy.
It's criminal overlord Mandarin, controlling his gang of Triads from an underground bunker that can only be accessed via secret door in the base of the Statue of Liberty.
It will take an epic alliance of Tony Stark and Peter Parker to put aside their past differences, fighting over the woman they both loved, and both lost, to put a stop to this criminal masterplot to end the world as we know it.
Starring: Jackie Chan as the Mandarin
Zac Efron as Peter Parker
and Robert Downey Jr. returns as Tony Stark.
Go check out the NY Shield threat warning/reporting program.
Awwww. The NYPD thinks they're special. :rolleyes:
I must be special, too, because I log tons of probes. Hundreds, sometimes thousands a day.
Any company with ssh or, really, any common password-protection scheme exposed to the net is going to see thousands of brute-force attempts per day. The majority of the botnet may be in China or Eastern Europe, but that does not indicate that the actual hackers are either Chinese or Russian. It just means those countries have crap IT security overall.
There is nothing special to see here. The NYPD is inflating its importance, probably for more funding.
A slashdotter who didn't build his own computer is like a Jedi who didn't build his own lightsaber.
Just a wild guess.
Who trusts IPs, though?
I hope I didn't brain my damage.
If I were the IT Director for the NYPD I would be hard pressed not to just drop all traffic from China. Or for that matter half a dozen other popular sources of malicious activity. If you really must have the website for the NYPD open to these other countries then put it on a standalone network segregated from anything important. I mean duh...
Post a web link to http://www.nyc.gov/ and hope that 0.0000526% of your citizens click on it.
Serious question. How concrete are the info on these cyber warfare news? It seems almost always Chinese or Russian being reported as the perps, followed by posts claiming we* do the same to them, etc. With botnet and other multiple indirections involved, how credible are the tracing info?
* "We" as in the most baddest, most awesomest country in the world. I won't insult your intelligence with further elaboration.
Fuck systemd. Fuck Redhat. Fuck Soylent, too. Wait, scratch the last one.
I've gotten a hell of a lot more than that in a single day. Coming from a botnet, so rate limiting by IP didn't work. They tried about 5 times per common english name as a login in mostly alphabetical order, hitting machines that had SSH open to the world.
It used to happen every couple of weeks, with thousands of attempts per machine. They'd probably still be trying if the security folks hadn't decided to outlaw us being so promiscuous.
Build it, and they will come^Hplain.
I'd think NY mafia would be more interested in this activity.
Don't knock my chinese coder, he does alot of good work.
Now if I could just figure out why I my credit card keep having KFC purchases on it.
To me, the summary looks like this:
"A network of hackers, most based in China, a href="http://www.nydailynews.com/news/2009/04/22/2009-04-22_international_hackers_lauching
I really, really, really Wondered, how this went trough all of the firehose, the Slashdot "editors" and everything... Maybe all people at /., are already dead and replaced by very small shell scripts. And the comment submitters are programs too... ...because, that would explain A LOT!
(Oh, and the preview is broken too. The layout has huge free space in them, and the line breaks are missing.)
Any sufficiently advanced intelligence is indistinguishable from stupidity.
there was a way to monetize the incoming traffic from zombies and autoprobes?
lol
> They took master lessons from the last US President's administration.
That's odd. I thought they were fairly good at it.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
Just based on ISP. Some ISPs are just massive trouble spots. They don't care what their users do and don't respond to complaints. Now, that will mean blocking some countries, like China, since their state ISP is a problem spot.
I really think that we need to start just shutting off people who won't play nice on the Internet. I'm not talking demanding perfection, but there are massive differences in ISPs. I work for an ISP, effectively, working for a large university. When we receive a complaint about a computer doing bad shit, the appropriate person gets notified and if the problem isn't cleared up, the connection is shut down. We also take some proactive steps to watch the network and see if someone is doing something bad. That's all I'm asking for is ISPs that will respond when they get contacted by someone saying "Hey you've got a system doing bad shit."
However many providers don't. You contact them and they ignore you, or lie. The Chinese ISP is one of the liars. They say "That IP isn't ours," even though APNIC shows it is, to any complaint.
So we need to just start blocking these people. If enough sites/networks do that, well then maybe they'll start playing well with others.
Looks like they got /. judging by the broken A HREF tag. Did yah use use Preview Button? Did yah? Did yah?!
Never email donotemail@WeAreSpammers.com
Parent is 100% right. This is a non-story.
Anyone who goes to the trouble of checking their logs for nearly all Internet-facing services would be very, very familiar with this.
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
route add 222.32.0.0/11 127.0.0.1
no matter how good it is, it is human nature always wants to make things better
You can mod this down. But its not a fear thing, its an awe thing. I mean seriously, look at how much more the USA can do than a European nation, and that is how much more the Chinese should be able to do. It's just an awesome thing.
This is my sig.
KAK ALL?
What exactly are you trying to spell? I don't understand.
Oh... you're trying to make a reference that corporate America is like the Soviet Union. Which makes absolutely no sense. If you're going to use the Russki "K" reference, at least make sure that it's in reference to some kind of fascism, otherwise it's just plain out of context.
Geez.
Let me give you a hint: if you want to troll, at least be a *good* troll. You know, add something to the slashdot experience, instead of making no sense. You've been on slashdot long enough that you should have graduated past simple trolls like that. Why not challenge yourself to be the best troll you can be?
Maybe one day you may just find that you've had an original thought.
"Trolls they were, but filled with the evil will of their master: a fell race..." -- J.R.R. Tolkien on Olog-hai
>have been making up to 70,000 attempts a day
Myself, I set up a targeted marketing campaign and feed them 70,000 ads a day.
1 in 4 Maine children in struggle with hunger.
You're right. Bush's administration had such a soft target in the senate and house at that time, that the tremendous success they enjoyed can't be counted as them being good at it.
Really? Are they being targeted, or are they seeing the same crap everyone else does?
I track probes coming into my home router. I usually see hundreds of probes per day with IP addresses in China banging on the usual ports (7212, 9090, 1026, 1027) as well as the ports do jour (55657). Some of these Chinese IP addresses I've been seeing for a year or more. Go to a site like http:..isc.sans.org/ and look at the stats for the 221.208.x.x block. 221.192.x.x seems to be popular these days as well.
Depending on what kind of outward facing net presence they have, 70k probes per day doesn't seem to be out of the ordinary based on the usual network scanning that goes on.
Given the Great Firewall of China and their survelance of all Internet traffic, Chinese denials of these hacking attempts ring hollow.
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
"why are the Chinese so interested in the NYPD computer network?" It is not specific to NYPD. They even try to crack my home computer! It's more like a broadcast attack.
Kelly suggested that 'perhaps it is because of the NYPD's reach into the international arena' that they are being targeted for computer hacking
WTF is the NYPD reaching into the international arena? That's not their job. They shouldn't be doing anything outside of NY.
1984 was not supposed to be an instruction manual.
that's what the Chinese are up to, ya sure ya betcha then. Sven.
doesn't NYPD patrol the docks? sounds like China wants their lead and mercury exports to look like baby toys and prime beef.
if this is supposed to be a new economy, how come they still want my old fashioned money?
All you base are belong to us!!
I am open source, and Linux baby!
They read about it on the Interwebs, and co-opted their spam partners to do the dirty work.
Really. Scouts honor.
Some days it's just not worth
chewing through my restraints.
Election time for The Mighty Giuliani (or one of he's pupils, perhaps)?
Before I switch the default port of ssh to other less obvious I was getting a (failed) login attempt every second... most of them from China, yes. But that gives a ratio of 86400 attemps per day per computer!
My first approach was to block the whole subnet of the attacker(s). Two weeks later I gave up and switched the ssh port ;-)
Well... as my computer, certainly, is not in the the list of political hackers, as is a private one and I don't work for the (any) govern, but... I have a fix IP :)
That might mean that they have a Linux server directly connected to the Internet through the default port.
They need access to NYPD personnel records to find the only one who can stop their plans.
John McClane has an unlisted number.
The Thirteenth Floor.
Here's an experiment Hollywood does every year:
make the same movie twice, then see which version the public loves.
It came out at the same time as the Matrix, but was a lot more interesting, but with fewer really awesome fights.
Like to brew? Want to talk about it? Brattlebrew: groups.yahoo.com/group/brattlebrew
OK, let's address this calmly. Who has to be tortured to make things right here?
They're still pissed about Jack Bauer raiding the Consulate and killing their Consul.
make the same movie twice,
Put a superstar and other known actors in one, and a bunch of guys people would say "hey isn't that the guy from that thing?" in the other
then see which version the public loves.
Dual Opteron < $600
The other day I saw a comment in an article that said most TOR exit nodes seem to come out in China. Now we see "most hack attempts come from China" ... well duh ...
Any unsecure proxy is going to get spidered in 24 hours, and then it'll be the source of all attacks until such time as the server admin realises and shuts it down.
IP addresses are a useless guide to *who* is actually using the connection, regardless of the country it is located in.
take out their barracks and mow down the field of those little bastards next to it.
"Nobody will know that their money is missing!"
Closed Gates, Open Windows!
You know it's bad when its secretary has a name "Gates"...
Ban China! Maybe they don't know about proxies! Wait, what if they do?! Wait, if they knew about proxies, then attacks would not be coming from China! Unless, they knew about proxies, and they knew that NYPD knew that they knew, so NYPD would think that there is no way in hell Chinese hackers would not mask their trail from China and they didn't use proxies at all! Bugger... OK so ban China, oh and ban Canada too, I think they know about proxies also.
I will not be pushed, filed, stamped, indexed, briefed, debriefed or numbered. My life is my own.
I'm starting to think these reports are just agencies who want to feel special. Is getting your ports probed anything special? My home network constantly has traffic from viruses and bots trying to propagate over the internet. Servers constantly having some script kiddie trying to get in via ssh. Does that mean I (and every other /. member) is as important as the DoD and NYPD?
I have no doubt that's part of it. If I made $0.75/hr I could not afford a retail copy of Vista, so I would pirate. But I wouldn't visit their update site, cause their "genuine advantage" crap might lock me out of my system. Result: tons of unpatched systems in the third world.
Microsoft feeds the botnet operators with their policies.
A slashdotter who didn't build his own computer is like a Jedi who didn't build his own lightsaber.
or three times, even
Media that can be recorded and distributed can be recorded and distributed.
-kfg
The NYPD might be able to do something about this. They have a sizable anti-terrorism operation, over a thousand people. David Cohen, the NYPD's Deputy Commissioner for Intelligence, used to head Clandestine Services at the CIA. Sooner or later, many of the world's conflicts spill over into New York City, and the NYPD has to deal with it. So the NYPD has more capability to deal with external threats than most departments. They're also bigger than the FBI.
The NYPD is well-connected with infrastructure organizations. They're generally thought of as better organized than U.S. Homeland Security in that area. Homeland Security tends to be political. The NYPD, for better or for worse, is just cops. They also have a large number of people with good connections outside the US and good foreign language skills. The NYPD has liaison officers with key police departments around the the world, and they're willing to put somebody on a plane to go somewhere when necessary.
Most computer intrusions, once the attacker has been localized, yield to ordinary cop work. Now the attackers have the full attention of the NYPD.
Finding places to put a few hundred people from one prison versus America's five decade military, economic and social entanglement in the Middle East: Bullshit equivocation is bullshit.
I have a bone to pick with the phrasing of this and other articles like it.
When people first read it, they go ZOMFG 70000 WTF, which is clearly the article's intent. However, it's not like there are 70,000 Chinese people sitting in a room all trying to hack the gibson or whatever. I'd bet this is the work of maybe 10 people at the very most. Another thing to keep in mind is that a login 'attempt' is not really a very big deal in of itself. It's much more accurate to say there is one attempt to hack into the network, and the method being used is brute force.
---- I'll take you in a Hunt deathmatch any day.
We have spent the last 2 weeks fending off Chinese hackers. They started with a legit login, extracting valuable data from our subscription-only site. Once we locked that down, the attacks started with methodical login attempts. We've blocked IPs, but they have jumped around, apparently using a botnet.
Thanks to the prevalence of stolen Microsoft operating systems in China, unpatched copies of windows abound, leaving them open to botnet slavery.
"No matter where you go, there you are." -- Buckaroo Banzai
...he wants his handle back.
'He who has to break a thing to find out what it is, has left the path of wisdom.' -- Gandalf to Saruman
I think it's the Chinese government that are lying.
Major DUH factor that the China foreign ministry LIED: 'Some people outside of China are bent on fabricating lies of so-called Chinese computer spies.'
The paid hacker arm of the Chinese government, called "The Red Hacker Alliance" has been documented since 1998.
The fact that Red China declared 'Technological War' on the USA has been known for years.
And Red China still has US 'Most Favored Nation' status because why? Are we out of our minds?!
if you can find a way into the NYPD network, I'm sure you also have at least limited access to police radio, warrants as they're issued, patrol car locations, officer records (including where their families live) and even FBI databases. Thanks to Guilliani making the NYPD one of the biggest police departments in history, there are SO many computers that intrusion detection would be difficult on that scale. NYPD is probably the best target in the U.S. for access to records all over the place.
An organized crime group located in NY would be able to strengthen their defenses against the NYPD 100 fold easily if they had this kind of access.
So, if you were a hacker able to build a botnet by targeting PCs on an international scale, produce a series of backdoors in the NYPD network and obtain this information, then you could sell these services for millions and move to a sunny island somewhere.
China just happens to have probably the most unprotected consumer PCs on the planet and is an excellent target for botnet drones.
The NYPD is one of the absolute best police departments in the world. Their resources rival the FBI and probably eclipse the military of smaller nations. NYC, being the financial capital of the world, has jurisdiction of all dollar denominated currency transactions. they occur in Manhattan via peering relationships through intermediary banks.
here is a recent example of the long arm of the manhattan da:
http://manhattanda.org/whatsnew/press/2009-04-07.shtml
I fail to see why it's relevant to suggest that the hackers in question were mostly Chinese. It's not like there is any proof they were put up to it by the Chinese government, so it seems to matter little - if anything - whether they're based in China, Russia, the Netherlands (where I happen to live) or the US even.
This is just politics and Slashdot merrily joins the choir that sings the anti-Chinese song. Excellent journalism, as usual.
The only issue here is that China seems to be doing little to fight this type of crime within it's borders on the net. Asking (or even forcing) China to do better is certainly fair, suggesting that its "the Chinese" doing the hacking isn't.
It is good to see the many responses here on /. that show people don't just swallow this kind of propaganda anymore.
A network of hackers, most based in China, have been making up to 70,000 attempts a day to break into the NYPD's computer system, the city's Commissioner, Raymond Kelly, revealed Wednesday.
This wording clearly states that "We know that we are dealing with Chinese Hackers" - but how do they know? One of the many features of the internet has traditionally been that there was no actual way of knowing with any certainty where an IP address is, geographically. Even today, AFAIK, there is still only a rather loose arrangement for which IP addresses are used in which country, and there is any number of way to appear to be from another region. My own son in Denmark routinely watches South Park, which I understand should only be watchable to users in the US. What, if anything, did these guys do to verify that the alleged hackers really were from China? Nothing, I'm sure, since 70,000 is quite a large number to go through per day. And what about the Great Firewall of China, that we hear is impenetrable to anything and everything, even to the extent that it catches people speaking about "democracy", that terribly dangerous word?
And of course, if they are clever enough to hack into a foreign nation's computer systems, why aren't they clever enough to employ the well known tricks of disguise that everybody, even on /. know all about?
The obvious question is, why are the Chinese so interested in the NYPD computer network?
No, the question is "Why should they be interested?" - and the answer is most likely: "They aren't". We don't need to even ask a Chinese official; the NYPD is a local police force, of little interest to the Chinese government or the Chinese people in general, except in cases where they cooperate on fighting international crime, or in connection with security operations, in which case they shouldn't have to resort to hacking anyway.
The REAL obvious question here is: "Who is it that has an interest in spreading this nonsense?" - and it is not difficult to come up with plausible answers. Under the previous administration it could easily have been "sources close to government (ie. Rumsfeld or Cheney)", but I give Obama more credit than that. America is infested with wild-eyed anal-retentives, who are all too willing to believe that everybody in other countries are communists or muslim terrorists out to take away their guns and money - they are more than likely both the source and the target audience for this kind of drivel.
Another good question is: How did it make its way onto Slashdot? I mean, OK, this is not a top-notch high-brow news-outlet, but still.
all they have to do is make sure they dont start hacking ALL the NYPD webs...and that can be prevented by shutting down the internets of course. die hard made it very clear.
Good people go to bed earlier.
How about following in the military's and FBI's footsteps and not placing those networked systems available to the internet. Seems to me if it does not touch the internet , it must be safe....
another one is have a special made ethernet card that needs special software to operate, and kill
all other types of network connections to the computers (in case someone slips in a usb wifi key)
Seriously, we should be sending this right back at them...DDoS them and make them see ...we won't go down without a fight.
bots brute forcing logins != hackers
One Police Plaza is just south of Chinatown.
A sentence you'll never see on an Internet discussion board: "You know what? You're right."
Have you ever been to China Town? I can see how the Chinese would want information about NYPD raids and known names related to knock-off dealing.
Let me give you a hint, junior douchebag, never assume as your assumptions are probably as wrong as this one. And I no longer bother attempting to explain myself to the lowbrows - and will you EVER learn the correct definition of troll?
The NYPD protects the UN building when heightened security is needed, the NYPD has contact with many diplomats in NY while carrying out their patrols. Also the NYPD currently has hundreds of officers overseas thru the UN training local police forces in places like formerly UN mandated Kosovo. https://cranberry.cc.columbia.edu/cs/ContentServer?childpagename=Bronxbeat%2FJRN_Content_C%2FBBArticleDetail&c=JRN_Content_C&p=1165270050524&pagename=JRN%2FBBWrapper&cid=1175372074098