Slashdot Mirror
Google Attackers Identified as Chinese Government
forand writes Researchers, examining the attacks on Google and over 20 other companies in December, have determined 'the source IPs and drop server of the attack correspond to a single foreign entity consisting either of agents of the Chinese state or proxies thereof.'"
Coming to a planet near you.
âoeAny society that would give up a little liberty to gain a little security will deserve neither and lose both.
Nothing.
It's hardly a secret that governments conduct cyber-espionage - what seems shocking in this instance is that they have been caught and that a major company, a telecoms giant and the US government have all gone on the offensive. This seems like a pretty dramatic shift, and you have to wonder what China's really done to provoke such a reaction after everyone's spent the last decade quietly appeasing them to try and get a foothold in their markets. It sounds like reading the subject lines of a few Chinese activists' emails is only the tip of the ice berg in this case, it'll be interesting to see what else has yet to be revealed.
Bad China! BAD! Now give me more cheap, exploitable labor. AWWWE, how can we stay mad at you!
Copyright 2010. All rights reserved. This comment may not be copied in any way including, but not limited to caching.
If a foreign government had attacked non-digital assets of any US corporation, you would expect some kind of formal reprisal. Maybe not an airdrop of Marines, but certainly something more than Hilary Clinton threatening to write a stern letter.
What I have not doped out yet to my own satisfaction is whether the tepid response from Washington is the fault of the current administration, confusion regarding the digital nature of the breach and assets, or a little of both.
It couldn't be them. China would never do anything wrong.
That... or they'll just blame it on their status as a "developing nation" and that they shouldn't be held to the same standards as everyone else.
The original official notification of this from Google's Chief Legal Officer where he mentioned human rights advocates and human rights issues causes this to seem above the average security breach:
Second, we have evidence to suggest that a primary goal of the attackers was accessing the Gmail accounts of Chinese human rights activists.
I can understand how "We can't enforce copyright on software and music when we're busy lifting hundreds of millions of citizens out of poverty as a developing nation" works but I can't understand how "We need to arrest and persecute human rights activists because we're a developing nation" works.
My work here is dung.
Working for a Defense contractor, one of our systems was compromised. Fortunately, the idiot who gained access screwed up SSH which alerted us to what was going on, and prevented them from erasing their tracks. All SSH connections were from computers in China. They've been doing this for years, and no one has really called them on it until now. It takes Google to make a big enough splash before anyone really pays attention to it.
What did China do when they found all the bugs the US government put in the plane we sold them?
Nothing.
http://articles.latimes.com/2002/jan/20/news/mn-23796
We know because we hacked their servers ... duh.
There's botnets running on government computers in most countries, China is probably not an exception. I'm not saying they didn't do it, just that IPs are not complete proof.
The Wall Street Journal had a great article about some of the details behind the scenes of this particular incident, and also another article that did a good job of summarizing what has been discussed here over the last couple of years. The main stream media is openly stating that the People's Liberation Army is actively encouraging "citizen cyber militias" to conduct "cyber attacks" (good Lord how I hate that term) against foreign (read, United States) corporations. Although they haven't gone so far as to state that those militias have active backing of the government, they have said that the government is turning a blind eye to their activities. Furthermore, the WSJ goes on to state that there are United States agencies involved in similar espionage activities.
Given that background, it seems like hacking Chinese companies should be fair game for up and coming "security researchers" here in the United States. In the 1990s the United States government made it quite clear that they were going to come down hard on people who mess with government and Fortune 500 systems. Given the option between really securing the systems and punishing those who exploit the lack of security, they went with the latter. A lot of people, myself included, decided that once we turned 18 and faced the threat of real Federal prosecution, the wise move was to turn off the war dialers, stop snarfing ESN/MIN pairs out of the air, and stop trying to run exploit code against computers that we don't control.
We can't hone our craft in the United States anymore. Although there is a whole market for securing IT resources against attack, there isn't a playground to pick up skills in. My suggestion is that China is that playground. My suggestion is that Chinese corporations in the United States are the targets. I mean lets face it, there are hundreds of thousands of compromised computers in the United States. The United States government can't be held accountable for malicious activity directed toward Chinese corporations. It would be unfortunate for those entities to be DDoS'd. It would be unfortunate for their internal workstations to be the target of vulnerability research.
1. a body of corporations (those 20 or so affected)
Nothing of note. If they pull out publicly, they will continue to work with the Chinese through third parties. Shareholders don't give a damn about human rights or free speech. They just want their money.
2. a nation
They've already sold us poisoned toys and drywall. They've been using what amounts to slave labor for decades in order to provide cheap products. As long as the aforementioned shareholders are running things, you're not going to hear about the problems, and the American populace is too apathetic to sacrifice any amount of convenience.
3. a global community of nations (UN)
They'll pass some resolutions denouncing interference in the sovereign affairs of other countries. They'll slide in some language about Palestine or Iraq, and it will be vetoed by the US and Israel and maybe a pacific atoll that happens to have a bathroom.
4. a cybercommunity
Learn Chinese and troll MSN Spaces?
The government/culture of The People's Republic of China has only been in existence for about 70 years. Before that, it was the nationalistic Republic of China for about 35 years. And before that, it was an hereditary monarchy or thousands of year.
Maybe you should pick up a history book some time.
There is no "-1 offended" or "-1 you don't agree with me" mod options for a reason.
Hacking Google does not help China develop its industries.
Yes it does. At least according to the Wall Street Journal, the compromise goes far beyond a Gmail compromise of a few accounts belong to some human rights activists. Google is claiming that they've suffered an intellectual property loss due to a server compromise. Any time that China steals research from someone else, they've improved their industry without having to invest in the R&D. Beyond Google, the official count is up to 34 companies far that have suffered severe breaches.
We are in an era where China is being more and more restrictive on foreign companies. China was open when it was beneficial to them. They were open when it brought foreign expertise into their country. They welcomed foreign companies with open arms because they stood to benefit from the knowledge those companies have. Now that the Chinese have the knowledge, they are becoming more nationalistic (as if that were possible). They are heavily favoring national companies. A recently passed government procurement process contained a provision that government agencies must find local suppliers for IT systems and software. The Chinese have stolen enough technical know how from HP and Dell and IBM and Cisco and the rest that they can produce hardware that is good enough for their needs. China is now the largest automobile market on the planet, and they're building cars based on designs and with processes stolen from American and Japanese manufacturing firms. I read a story last year where Ford or GM was suing a Chinese company for selling a car that was more or less based entirely on a design and manufacturing process that was stolen whole sale from (Ford/GM).
The Chinese are smart. Our year 2010 is the Chinese year 4707. They have an ANCIENT culture. All of the games that people play have been played, observed and pondered in China for A LONG TIME. For the past couple of decades they have been benefiting from American processes and technologies. Americans have benefited from a Chinese willingness to use our processes to provide us with affordable goods. At the same time, they have developed the knowledge to create goods for their own growing "middle class". One of their goals is to increase domestic consumption. As the years continue to go by, more and more of the world's resources are going to be going to China, for the good of the Chinese. There is a reason that the Chinese are playing such an active role in Africa.
There's botnets running on government computers in most countries, China is probably not an exception. I'm not saying they didn't do it, just that IPs are not complete proof.
Nor does it have to be. China's government is screwed either way. If they claim they are not the attackers, but were working from owned machines, then their "perfection" and "infallibility" are gone. Given the inherent insecurity in authoritarian cocknozzles, that will hurt them where they live.
OTOH, if they don't cop to being hacked themselves, they have no other defense to being the source of the attacks.
Either way, they've gotten taken down a notch (and I bet you they are PISSED about it), and I'm betting that our own cocknozzles in DC are hoping they opt for the second approach. Nothing heavy will come from it, but we'll get a few more of their chips in the big game.