Slashdot Mirror


Journalists' Yahoo E-Mail Accounts Compromised In China

andy1307 writes "According to this article in the New York Times, 'In what appears to be a coordinated assault, the e-mail accounts of at least a dozen rights activists, academics and journalists who cover China have been compromised by unknown intruders. The infiltrations, which involved Yahoo e-mail accounts, appeared to be aimed at people who write about China and Taiwan, rendering their accounts inaccessible, according to those who were affected. In the case of this reporter, hackers altered e-mail settings so that all correspondence was surreptitiously forwarded to another e-mail address. ... The victims of the most recent intrusions included a law professor in the United States, an analyst who writes about China's security apparatus and several print journalists based in Beijing and Taipei, the capital of Taiwan."

35 of 130 comments (clear)

  1. Damn Chinese! by fuzzyfuzzyfungus · · Score: 5, Funny

    Don't you know that you should do your wiretapping directly at the ISP level, like real Americans?

    1. Re:Damn Chinese! by Marcika · · Score: 3, Insightful

      Don't you know that you should do your wiretapping directly at the ISP level, like real Americans?

      I'm sure that they know and they do. But wiretapping at the ISP level doesn't help if their victims use HTTPS or SSL IMAP/POP like pretty much all Gmail (and Yahoo?) users do. Real Americans(TM) subpoena Google or Yahoo records directly over their convenient law-enforcement interfaces -- China can't do that...

    2. Re:Damn Chinese! by KiloByte · · Score: 4, Interesting

      https is very easy to MITM if you can inject bogus signed certificates. For that you need to control a CA. Like, for example, CNNIC whose root certificate is included in MSIE and Firefox.

      Please to vote on the bug report to remove this security hole.

      --
      The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
    3. Re:Damn Chinese! by muckracer · · Score: 5, Insightful

      > https is very easy to MITM if you can inject bogus signed certificates.

      agreed

      > For that you need to control a CA.

      agreed

      > for example, CNNIC whose root certificate is included in MSIE and Firefox.

      agreed

      > Bug 542689 - Please remove CNNIC CA root certificate from NSS

      agreed BUT: Why do you single out this particular CA when the valid issues you raised APPLY TO ALL OF THEM?!

    4. Re:Damn Chinese! by TheLink · · Score: 2, Insightful

      The real bug is Mozilla doesn't _help_ you realize and figure out that a cert has been changed for no good reason.

      Yes the way to do it won't work 100% for the average person. But the average person will get pwned anyway.

      So in this case, Mozilla should help the ones who care about security - warning people that the server cert has been changed rather early, or worse the CA has changed, or even worse the CA has changed AND the new CA is in a different country.

      But no, the Mozilla developers still haven't lifted a finger to help. Not even after 5 years.

      See this:
      https://bugzilla.mozilla.org/show_bug.cgi?id=286107

      And comment #5 and rest of discussion.

      Quote:
      Ian Grigg 2005-03-15 12:14:26 PST

      #4. I'd agree with that.

      The critical change is when a new cert comes in signed by a *different* CA. In
      the event that this is a bad situation, both CAs can disclaim by pointing the
      finger at each other. The bad CA just shrugs and says "I followed my
      established and audited procedures...." In practice, even a little finger
      pointing will break any semblance of CAs backing up their words.

      --
    5. Re:Damn Chinese! by TubeSteak · · Score: 2, Insightful

      Don't you know that you should do your wiretapping directly at the ISP level, like real Americans?

      Why would you need to when the e-mail hosts have so thoughtfully buried an auto-forwarding function on a settings page that no one ever checks?

      "Free" e-mail has generally only improved in quality over the last decade, but that one move was incredibly boneheaded.
      Every time I log in, the first thing I should see is "Your E-Mail Is Forwarded To: [No Where/Address]".
      Anything else is just pure gold for malicious actors.

      --
      [Fuck Beta]
      o0t!
    6. Re:Damn Chinese! by tlhIngan · · Score: 2, Informative

      Out of curiosity, could someone actually provide a concrete example of a MITM attack ever being successfully carried out? Bonus points for anyone who can further provide reasons for why this means Firefox no longer likes self signed certs.

      Well, there's SSLSniff that was used to demonstrate faking Paypal certificates (via NULL attacks in browsers). There's also the neat SSLStrip that transforms a HTTPS transaction down to an HTTP one.

      They work by ARP spoofing right now, and if you combine with the IE WPAD (web proxy auto-discovery) mechanism, you could put together a pretty nice MITM attack unit.

      And wasn't there reports of a box sold to governments that was designed to do this MITM stuff? Like this appliance? This one's better than SSLSniff as it uses subverted CAs.

      More info - http://arstechnica.com/security/news/2010/03/govts-certificate-authorities-conspire-to-spy-on-ssl-users.ars

    7. Re:Damn Chinese! by EXrider · · Score: 2, Informative

      And it's not just Yahoo. None of them (Yahoo, Hotmail, Google) allowed you to use https for the entire email session, including Gmail, until the recent Google hack incident.

      Gmail has offered the option to use HTTPS for your entire session for several years now, I remember discovering it back in '05 while perusing the preferences. It just wasn't the default.

      --
      grep -iw skynet /etc/services
  2. Is anyone surprised? by Anonymous Coward · · Score: 5, Insightful

    China is a totalitarian state. Has been since 1949. What free trade has done is to make it a rich totalitarian state instead of a poor one. I never understood the argument that capitalism would lead to anything like democracy. Democracy [usually] leads to at least some level of capitalist/free-enterprise economy, but not the other way around.

    1. Re:Is anyone surprised? by dkleinsc · · Score: 4, Insightful

      I never understood the argument that capitalism would lead to anything like democracy.

      The reason you can't understand that argument is that it's complete BS. It was created to try to convince Americans that the reason our government is making it extremely easy to trade with China is to spread democracy, not increase corporate profits at the expense of American workers' careers.

      And historically at least, the system of government best suited to corporate profits is not democracy, but fascist-leaning dictatorships. That's true whether we're talking about Mussolini, Hitler, Franco, Pinochet, or Batista.

      --
      I am officially gone from /. Long live http://www.soylentnews.com/
    2. Re:Is anyone surprised? by h00manist · · Score: 2, Funny

      "Socialism GOOD, capitalism BAD! Kill THEM for FREEDOM!". Umm oh wait, sorry that was on the other side, whatever, just invert it.

      --
      Build your own energy sources from scratch. http://otherpower.com/
    3. Re:Is anyone surprised? by Hijacked+Public · · Score: 4, Insightful

      I don't understand it either, mainly because I think the climate in China is closer to free market capitalism than the climate in the US. In relative terms China is a capitalist utopia, particularly from a producer's perspective.

      --
      "Sacrifice for the good of The State" - The State
    4. Re:Is anyone surprised? by Software+Geek · · Score: 2, Insightful

      Perhaps you need a history course. Historically, Mussolini, Hitler, and Franco drew their countries into ruinous wars, which are very hard on corporate profits. Batista so weakened his government that it was taken over by communists who nationalized everything. Corporations hate that.

      Saying that the system of government best suited to corporate profits is a fascist-leaning dictatorship is like saying Bernie Madoff will get you the best return on your investment. It is sometimes true in the short term, but in the long term it is very, very false.

    5. Re:Is anyone surprised? by dkleinsc · · Score: 2, Insightful

      But why the hell would an arbitrary corporation prefer having the laws change at the pleasure of a demagogue who may or may not like them instead of having an easily "lobbied"/bribed legislature?

      Because bribing 1 despot is cheaper and easier than bribing the 300 or so congresscritters/MPs needed to get a majority. Plus you do so much work to buy off particular politicians, and then the pesky public votes for someone else and you need to start over again.

      --
      I am officially gone from /. Long live http://www.soylentnews.com/
    6. Re:Is anyone surprised? by Skillet5151 · · Score: 2, Insightful

      It seems unlikely that the man who dominates the entire country and can take what he likes from its tax revenues is going to do whatever you ask for a check.

    7. Re:Is anyone surprised? by jav1231 · · Score: 3, Insightful

      We should have shit-canned our trade with China when Tienanmen Square happened. Period. Everything after was hypocrisy.

    8. Re:Is anyone surprised? by Spitfirem1 · · Score: 2, Insightful

      Saying that the system of government best suited to corporate profits is a fascist-leaning dictatorship is like saying Bernie Madoff will get you the best return on your investment. It is sometimes true in the short term, but in the long term it is very, very false.

      That would be relevant, if only people and corporations had the foresight to pay attention to anything more than the Next Big Thing. The lack of any sort of a long view and the attitude that what is best for right now is always the right choice are both almost ubiquitous in our culture and are detrimental to society in many cases.

    9. Re:Is anyone surprised? by MightyMartian · · Score: 2, Insightful

      To some degree I agree with you. I have more knowledge of Industrial England than of Rome (though there was a pretty major civil war between the Plebs and the Proles that lead to an expansion of the aristocracy there). In England, at least, the people had the good fortune of a number of historical trends lining up at the same time; labor shortages at the tail end of the Middle Ages (after the Black Death) which saw a sharp increase in demand for workers, the beginnings of a free market economy being established even before the Industrial Revolution, a stable and effective government with clear lines of authority thanks to the Glorious Revolution, and, by the 18th century a rapidly expanding population, a major overseas empire that basically kickstarted the consumer revolution (this is when China as manufacturer of cheap goods to the West really begins, thanks in large part to European, and in particular to Dutch and English merchants), and, of course, the ultimate development of a middle class in particular during the Victorian Era. I agree the aristocracy in large part was responsible for the major reform bills, but I'd say that once some of the reforms had begun, it was a snowball. The more political power the ordinary people got, the more they wanted, and the more the political class could benefit from giving it to them. That's the real story, that the landed gentry in England, already weakened by the end of any remnants of feudalism, were ultimately supplanted by the political class. That latter fact precedes the Industrial Revolution, and was born out of all things the struggles between Parliament and the Stuarts over who had the right to run the country.

      --
      The world's burning. Moped Jesus spotted on I50. Details at 11.
    10. Re:Is anyone surprised? by MightyMartian · · Score: 3, Interesting

      It doesn't always work out, but having a middle class helps, also because they have time, skills, and money to spend on politics.

      China is the great experiment. It's been a given since the the English Civil War that a middle and mercantile classes will demand, and will ultimately take a greater share of the political system. I posit that the Chinese leadership is hoping to accomplish the creation of a thriving middle class without any great increase in political liberties. Will the experiment work? Hard to say. Damned scary if it does, that's for sure.

      --
      The world's burning. Moped Jesus spotted on I50. Details at 11.
    11. Re:Is anyone surprised? by MightyMartian · · Score: 2, Insightful

      I'm sorry, how is that different from an insurance company saying "Your patient's policy does not cover this. Please let him die."

      You anti-health care nuts really are a greedy, and yet pathetically retarded bunch.

      --
      The world's burning. Moped Jesus spotted on I50. Details at 11.
    12. Re:Is anyone surprised? by dkleinsc · · Score: 2, Insightful

      If we're talking companies based in the countries that lose the war, then you'd be correct. But in a lot of cases (including those in the 1930's and 40's) we're talking about outside multinationals, who can move their capital quite easily from one country to another. Ergo they can and will play they short-term gain in, say, Spain, then head to Germany for a decade, then to Argentina, and so on.

      It's remarkably similar to investments in fundamentally unsound securities. The idea is to make a bundle while everything looks great, and leave someone else holding the bag when it goes sour.

      --
      I am officially gone from /. Long live http://www.soylentnews.com/
  3. Hmm yeah by Dunbal · · Score: 2, Interesting

    Reminds me of all those emails I get from the head of the International Bank of Nigeria who somehow has to use hotmail/gmail/yahoo mail. Or how the "British National Lottery" also can't afford it's own mail server.

    Seriously, "journalists" can't use anything but yahoo? Or even if they were limited to yahoo - they can't encrypt their email?

    I suspect these "journalists" are just some "random group of people" and that the story is just more hype.

    --
    Seven puppies were harmed during the making of this post.
    1. Re:Hmm yeah by Bearhouse · · Score: 2, Insightful

      A lot of freelance journalists use google and yahoo, as do many people who have professional mail accounts, but prefer to conduct private and/or personal business using a 'free' provider. Do you really want a confidential source in China to risk sending info to *@nytimes.etc?

  4. This is why you don't do business with China by smooth+wombat · · Score: 5, Interesting

    People roll their eyes when I tell them I don't buy products made in China. I refuse to support a government with such an abusive human rights record.

    It's tough at times finding a product not made in China, but I use the free market to make my point.

    Some people talk the talk when it comes to making a statement. Very few actually walk the walk.

    --
    We will bankrupt ourselves in the vain search for absolute security. -- Dwight D. Eisenhower
    1. Re:This is why you don't do business with China by Anonymous Coward · · Score: 3, Funny

      I carved it myself, out of a solid lump of silicon.

    2. Re:This is why you don't do business with China by east+coast · · Score: 3, Insightful

      This is all the more reason to actively avoid their product; so that we can make it profitable for other countries to take up the production of items that only seem to sell at the lowest price point possible. It may cost us a little today but in the long run we won't be so attached to one provider that we have to put up with their abusive nature if we need to "cut the cord."

      --
      Dedicated Cthulhu Cultist since 4523 BC.
    3. Re:This is why you don't do business with China by dr-alves · · Score: 2, Insightful

      Very true.

      People seem to think of China as this troublesome country that does whatever it wants and that nothing can be done about it. This is simply not true.

      China is actually more dependent on US and EU than the other way around. They devote most resources to the production of products that need to be mandatorily exported as the the chinese masses cannot afford them.

      Corporations and states seem to ignore the blatant anti-freemarket and anti-freedom-speech-policies because of the el-dorado of the 2 bilion people market. WAKE UP. Chinese policy will never allow for free market, and will always be biased towards chinese products.

      To add insult to injury, in EU, chinese imports SIMPLY PAY NO TAXES, sinking the local producers in the process.

      So what can be done? Well western states can stop acting like slaves to their chinese overlords.

    4. Re:This is why you don't do business with China by u38cg · · Score: 4, Insightful

      The quickest way to sort out the human rights situation in China is to create a population with enough of a stake in society for it to be worth standing up and be counted. Free speech means very little when you're on the breadline. Even if your boycott had any meaningful effect, it would just make government repression easier, not harder - and China is quite easily big enough to run a closed economy if it wanted to.

      --
      [FUCK BETA]
    5. Re:This is why you don't do business with China by cdrudge · · Score: 2, Insightful

      May I ask what brand of [just about anything] you are using that has no components made in China?

      Fixed.

    6. Re:This is why you don't do business with China by Ash+Vince · · Score: 2, Informative

      To add insult to injury, in EU, chinese imports SIMPLY PAY NO TAXES, sinking the local producers in the process.

      What utter rubbish. Here is the site on the eu website that will allow you to calculate the duty:

      http://ec.europa.eu/taxation_customs/dds/cgi-bin/tarchap?Lang=EN

      It takes a while to figure out how it works, but I just searched for a DVD Recorder (TARIC CODE = 8521900090) and the import duty was 13.9%. Here is the result for non-magnetic tape video recording apparatus:

      http://ec.europa.eu/taxation_customs/dds/cgi-bin/tarduty?Taric=8521900090&SimDate=20100331&Action=1&ProdLine=80&Country=CN/0720&Type=0&Action=1&YesNo=1&Indent=-1&Flag=1&Test=tarduty&Periodic=0&Download=0&Lang=EN&Description=yes

      I am sure there is the odd product that is not covered by duty, but you seem to think everything imported to the EU from China pays no duty, that is plainly not true.

      --
      I dont read /. to RTFA, I read /. to offend people in ignorance.
  5. Yahoo, MS is poison by AHuxley · · Score: 3, Informative

    With reports like "Yahoo 'helped jail China writer'" in 2005 ... would most people with any public or private interest in China stay with Yahoo's products in any form after its "complicity" over the past years?
    http://news.bbc.co.uk/2/hi/4221538.stm

    --
    Domestic spying is now "Benign Information Gathering"
  6. Re:Yahoo by TheCowSaysMooNotBoo · · Score: 2, Insightful

    Yeah, real journalists use their ISP's webmail (*cough*), their own servers (which can be confiscated) or their friends (also confiscateable). Then you have the possibility of offshore email accounts on an american friend's server (which will get blocked). At least when using webmail, the others have to either break in the servers (like they did in TFA) or subpoena them (which I don't see the Chinese govt. do tbh).

  7. They use webmail for confidential data? by guanxi · · Score: 2

    I think I probably wrote the same thing when news of the GMail hacking allegations came out: Who is dumb enough to use a public webmail service for confidential email? Don't they have access to any good advice? Training? Or just think it through a little -- does Yahoo Mail seem like a secure place to store sensitive data?

  8. funny jokes are reality jokes that are not funny by h00manist · · Score: 2, Insightful

    False flag operations "False flag operations are covert operations which are designed to deceive the public in such a way that the operations appear as though they are being carried out by other entities. The name is derived from the military concept of flying false colors; that is, flying the flag of a country other than one's own. False flag operations are not limited to war and counter-insurgency operations, and have been used in peace-time; for example during Italy's strategy of tension." ...

    --
    Build your own energy sources from scratch. http://otherpower.com/
  9. Re:So let's get this straight: by Asic+Eng · · Score: 3, Insightful
    for 20 years now malware targets mostly DOS/Windows, yet these guys still use exactly that

    Like everyone else on the planet. Not that it matters whether you access webmail via Linux or via Windows.

    the main vector of malware coming in is via e-mail attachments, yet these guys keep clicking on them

    Webmail cracked - that's almost certainly not clicking-on-attachments territory, more likely poor password choice. Access to company servers from the inside (employees collaborating with the attackers) is another possible path of attack.

    signed e-mails and attachments would make reception thereof fairly safe, yet these guys have no idea about it

    Works only on a node-to-node basis. If their contact doesn't have the tools, then they can't use it. Same applies to encryption obviously. Is PGP freely available in China? How long till the government detects that you are using PGP and takes you in for questioning solely based on that fact?

    but then these guys probably would feign complete ignorance and amazement over the fact, that especially the totalitarian governments of the world don't exactly work with white gloves

    If the Chinese government attacks western computer systems, that's news. It might require a political response, that should be in the public discussion. Regardless, it's certainly worth reporting.

    ...don't give a shit about your self-aggrandized ego of 'a journalist' and the hallowed freedom of press

    Freedom of the press is vital for my freedom and for yours. I think your disdain is completely inappropriate here.