Talk On Chinese Cyber Army Pulled From Black Hat
Trailrunner7 writes "A talk on China's state-sponsored offensive security efforts scheduled for the Black Hat conference in Las Vegas later this month has been pulled after concerns were raised by people within the Chinese and Taiwanese government about the talk's content. The presentation was to be delivered by Wayne Huang, CTO of Armorize, an application security company with R&D operations in Taiwan. The talk was billed as an in-depth, historical look at the offensive capabilities and operations of China's so-called cyber-army."
Let's compare the two different stories that were going to be posted as authors duped.
Screenshot
Worded quite differently, no? This published summary accuses the Chinese and Taiwanese government about it, while the other one just says they had concerns about their good relationships in the community.
China is directing the single largest, most intensive foreign intelligence gathering effort since the Cold War against the United States.... http://www.securityweek.com/chinas-cyber-threat-growing
Which way gets more Slashdot buzz?
A: Give a presentation at Black Hat.
B: Schedule a presentation of Black Hat, only to have to pulled and then a release of that fact leads to a discussion of that not-ready-for-Black-Hat topic here on Slashdot.
C: Call CowboyNeal and ask him to post a story.
Black Hat conference cancelled one of their talks due to political pressure? Wow. I thought Black Hat was one of those "we don't care who you are, we're going to talk about this" forums?
Usually one would ridicule other conferences with something like "Do you see Black Hat canceling like this? Grow a pair!" But this is just depressing. Guess Black Hat is experiencing some "shrinkage".
Next thing you know they're going to be cowering over trumped up Cease and Desist orders.
I work for the Department of Redundancy Department.
If the US doesn't start taking the PRC's cyber offensive capabilities seriously, the US is in for a whole world of hurt. Note how, in the article, the author mentions that Titan Rain and Aurora were not viewed as surprising in Asia, but rather more like, 'yeah, yeah, what else is new?' It is widely known in the security industry that China has been pursuing cyber offensive capabilities for quite some time. Why doesn't it get more discussion?
"I'd rather be a lightning rod than a seismometer." -Ken Kesey
Just wondering why people put up notices of these types of seminars days or weeks before the conference. Put out information a few hours ahead of time. I don't know how many concurrent seminars there are, but maybe there could be a "you really want to sit in on this" track? It just seems like a lot of these get shot down in advance for no good reason.
"Sometimes a woman is a kind of religion, she can save your soul & set you free from all your sins" - Bad Examples
PUSSIES !!
I thought they had a lot more backbone than this.
It gets plenty of attention - notice how the US government is pushing for killswitches for their half of the internet?
I thought Black Hat was one of those "we don't care who you are, we're going to talk about this" forums?
Those types of organizations don't have annual conferences in Las Vegas.
"Black Hat!" I mean, really. Who would you expect to show up at a Las Vegas venue called the "Super-Villain Expo," Lex Luthor, or wannabes in purple-spandex cosplay?
Offensive capability #3: Censoring free speech in foreign nations.
The Politburo must be pleased by this successful demonstration.
The Blackhat conference can't be blamed for the private buisness interests of one of it's presenters being leveraged in the country he bases one of his companies out of. They have no control over this, their only move is to find somebody as knowledgeable about the situation that doesnt have any affiliations that could be leveraged in this way, AND who has the time to pump out a presentation in that limited of a timeframe (since most anybody on this would be at the professional or entrepreneurship level)
This is a red herring. The US is not involved in this story, other than the fact that Black Hat takes place there.
Also, in response to another poster, Black Hat did not cancel one of their talks. The presenter did, due to pressure from Taiwan, according to TFA.
It's like people can't read anymore.
Because publicly traded companies are reactionary.
Until Google stoop up and admitted to getting owned, businesses would say it was only worthwhile to defend against automated worms and viruses. That targeted attacks can get your company owned is not news to anyone in the security space, but justifying the monitoring and defensive measures to detect and respond to malicious attackers was tough without datapoints showing that attacks like that actually happen.
Unless you're Richard Bejtlich, who wrote the book on that. http://www.taosecurity.com/books.html
Here's a great overview article by him on APT.
http://searchsecurity.techtarget.com/magazinePrintFriendly/0,296905,sid14_gci1516312,00.html
Blessed are the pessimists, for they have made backups.
The same talk -- or at least a very similar one, by the same people -- is scheduled to be given at Defcon. Anyone know the status of that? I doubt Defcon is very susceptible to outside pressure, but since the speaker does business in Taiwan he may be reluctant to defy them.
Just because you sold your soul to the devil that needn't make you a teetotaler. --The Devil and Daniel Webster
Caleb Sima, Armorize's CTO
Wayne Huang, CTO of Armorize
How many CTOs does one company need?
Because since companies tell their competition "I've been owned", only a couple organizations (that had a capability to do anything about it) had a decent picture.
One of those is the US Gov't.
Since they knew companies were unlikely to help themselves, they came/are coming up with proposals to protect infrastructure
And then when these ideas are floated around Slashdot, they get blasted like clay pigeon at a skeet range because "big brother wants my admin passwords" and other assorted reasons.
No one wants to be owned, but it appears they want help from the government even less.
(I won't make a judgement on which option is the lesser evil, the rest of you can argue about that)
The US needs a strong cyber offensive capability. Unplugging the internet doesn't qualify.
"I'd rather be a lightning rod than a seismometer." -Ken Kesey
Or the only thing left at Defcon will be lame talks on how to replace the password files on unencrypted disk drives or hack your neighbors wifi.
You CAN just promise there will be some awesome talks that you will happily want to shell out $140 cash to attend. Let it be a surprise.
This policy should apply to anything related to speakers from censorship heavy governments or any speaker from a major corporation (cisco, juniper, microsoft..etc)
I hope this years badges are not crappy last-second disappointments accompanied by endless lines. Stay out of the pools.
The reasons why China wouldn't want this guy to speak are clear. It wouldn't be an issue for Taiwan except that current Taiwanese administration has been expanding ties with China at a fairly rapid pace. I'm sure they wanted to avoid ruffling feathers in China. We all know how ridiculous China is with any negative press, how they have to make a big show of dissatisfaction over every little thing. The Chinese leadership soils itself whenever some Taiwanese official travels to Japan or the States. So the Taiwanese, particularly those in the KMT party, are working pretty hard to keep China happy. There have been claims of censorship in Taiwan the Taiwanese media for this same reason.
There's some strong opposition in Taiwan to these expanding ties, but my impression is that people there aren't all that troubled by this. They're far more concerned in the almighty dollar than they are principles.
'nuf said.
When you do a billing and explain exactly what sensitive information you are going to be talking about far in advance of the event. How is anyone surprised when the people to whom are actually sensitive to that information object. If your going to drop an informational bombshell it needs to be a surprise.
If your not dropping an informational bombshell then likely you are just trying to get attention and wasting everyones time.
Very nice article, thanks. If you have access, the 451 Group did a great report on APT's a while back too.
"I'd rather be a lightning rod than a seismometer." -Ken Kesey
Okay. Why does the US need a strong cyber offensive capability?
It is against the entire west. That includes all of EU. EU simply keeps quiet about it, but they know that they are under constant attack.
That's because the (illegal) occupying KMT administration in TW has PRC cock stuck so high up their asses, their saliva are nothing but PRC cums.
We need a blacker black.. The whole world is wimping out for the love of money.
For justice, we must go to Don Corleone
C4, JDAM, ASAT
Bye Bye internet
Yeah I just got back from lunch and I can't read yet
All your internet, are belong to us!
GG
(Obvious (missing!)) keyword: kowtow
What makes you think the US government would tell you if they had taken steps to develop strong cyber defense or offense capabilities?