Slashdot Mirror
Washington Post: We Were Also Hacked By the Chinese
tsu doh nimh writes "A sophisticated cyberattack targeted The Washington Post in an operation that resembled intrusions against other major American news organizations and that company officials suspect was the work of Chinese hackers, the publication acknowledged on Friday. The disclosure came just hours after a former Post employee shared information about the break-in with ex-Postie reporter Brian Krebs, and caps a week marked by similar stories from The New York Times and The Wall Street Journal. Krebs cites a former Post tech worker saying that the publication gave one of its hacked servers to the National Security Agency for analysis, a claim that the Post's leadership denies. The story also notes that the Post relied on software from Symantec, the same security software that failed to detect intrusions at The New York Times for many months."
I need some attention too!
What I have derived form this past weeks revelations.
1. The Chinese have no problem gaining access to what ever computer networks they wish to.
2. They seem to be most interested in themselves, kinda like creeping other people's Facebook to see what they say about you.
3. So far, they haven't found anything worth their time.
4. Organizations seem to feel that since they discovered something on their networks, they have discovered everything on their networks.
5. Fail.
Has anyone seen any details on how to detect this specific method of attack, malware signatures, or similar? Cause that just might be of use, seeing the widespread nature of this.
Also, who hasn't been attacked? Bueller? Bueller?
Returned Peace Corps IT Volunteer
Let's just list the companies that have been verified not to have been attacked by the Chinese.
Symantec has probably been hacked by the Chinese too...
Someone at Anonymous works for Symantec
"When life gives you lemons, don't make lemonade. Make life take the lemons back!" -- Cave Johnson
we have all been attacked by chinks; who cares
And yet so dumb as to not obscure the origins of their attacks so that they could claim plausible deniability. Hmm... Coincidence that news of these hacks occurred shortly after the announcements of the US expanding its "cyber" warf.. er, defense programs?
I assume they can blame China because all the IPs of the hackers are in Chinese blocks.
So... why the fuck do these American news journals need China to have access in the first place? Why do these businesses need to route traffic to/from China? Are they using Huawei routers or something asstarded?
Is that why I was modded down last time?
I'm curious why repeated attacks "by the Chinese" have invoked no response from the government? It seems odd that we have US Companies being attacked on US soil and there's not even a peep about it.
I'm not saying bomb people but tis seems.....weird...
As a rock-in-roll Physicist once said, No matter where you go, there you are.
I'm sure a myriad of complot theories are being concocted as we speak. Based on the world population, the probability of Chinese hacking anyone are roughly 1 in 6. Considering that, China scores much higher than almost any other country.
I hadn't the slightest objection to his spending his time planning massacres for the bourgeoisie... (P.G. Wodehouse)
So do those people really think that the Chinese are the first to hack into their servers?
Something tells me they don't actually reveal that Americans have been hacking into their servers for years aswell, because they want to hype up the entire cyber-terrorism and warfare thing. You know, makes it easier for politicians to push through even more bills that kill off the internet.
I see no mention that Symantec is mentioned.
This time against the paper that brought down the Nixon administration. The Watergate scandal began with the arrest of the E. Howard Hunt and other lowlife security types at the Democratic National Headquarters in Washington DC. "A third rate burglary attempt" commented Nixon's press secretary Ron Zieglar. But the Post kept following the money as the administration scrambled to cover up the White House's role in numerous illegal operations against political opponents. An anonymous administration official (since identified as the FBI's Mark Felt, who revealed himself just before he died) began tipping the Post's Bob Woodward. At the height of the scandal, Woodward and Carl Bernstein prepared a bombshell story about US Attorney General John Mitchell's role in the Watergate coverup. Mitchell was reached by phone late in the evening for his reaction, and he reportedly screamed "JEEEEEEEEE-SUSS! (Washington Post publisher) Katie Graham is going to get her tit caught in a big fat wringer if you print that."
They edited "her tit" out Mitchell's quote from the story that came out the next morning.
I now remember, I was also hacked by the Chinese.
Has this info been made public?
I'd love to see a full study on how much Microsofts lack of security for the last 15 years has cost the American people in lost secrets to foreign agencies. I'm sure its significant, problem is the person doing the study will probably die in a car crash or get cancer before its finished.
Golly, it's almost as if relying upon detection after the fact or at entry point is no real protection. Oh, but you say, defense in depth! Well, defense in depth is great. But, intrusion detection of the sort is like tissue paper when you might get thousands of attacks daily. The only real defense is actually having software that isn't exploitable. And that means having (a) open software you can analyze, (b) developers/vendors of that software who will quickly address problems, (c) open disclosure so you don't have to wait months to find out you might already be being hacked--giving you the option to simply stop using software if it's hackable--, (d) multiple servers running multiple software stacks so you have something to switch to for (c), and (e) having a strong push for possible problems so you don't have to rely upon (b) because (b) is just a bad hack to the truth that no software is perfect--as that's a broken record if it's said all the time, as it's meant to explain the *occasional* security bug.
Oh, and I think this also highlights the whole point that treating security as a joke shows the joke's on you. The real thing to worry about is just how bad the US Government's security score is. If you at all believe that government is generally worse than private industry--not something I particularly believe given just how bad private industry is--, then the US as a whole is fucked at least as far as any concerns for keeping US Government held data private from the Chinese or other hackers. All things considered, it makes one wonder if the data China has--not necessarily even their government--would put Wikileaks to shame.
Eurohacker European paranoia, gun rights, and h
What is the point on the IT department if your going to blame off the shelf software. The software is a rough first stop but in no way a completely solution for prevention. Before you blame the software also blame the IT department.
The Washington Post is a company that sells propaganda to suckers. They lie for a living. Why should anyone believe them now?
That monolithic entity known only as THE CHINESE.
Odd that when Anonymous deface a bank's website we don't say THE AMERICANS hacked it.
Of course it's a sophisticated attack. It happened to a big company, and they cannot be held responsible. If it happened to me on my home PC or at a small business, it would be my own fault for having inadequate security.
If the main story on the front pages is "Hacked by Chinese", was that supposed to be the main story or is it just script kiddies bragging?
For all intensive purposes, "whom" is no longer a word. That begs the question, "who cares"?
Can we please get rid of that ridiculous expression?
These companies deserve to be hacked. They obviously have no concern about security, or they would run a decent OS, not a POS.
Who has not been hacked (successfully or not) by Chinese over the years, newspaper, TV, not just the media and government, any body with a server connected to the internet ? And who has not been hacked by the Russians ? I suspect there will be few answers.
Not only have 4 other bad things happened, we've also failed to get rid of that ridiculous expression!
I am officially gone from
Can someone remind me who wrote Stuxnet? - and how is this any worse?
The Onion, America's Finest News Source, recently posted an article saying they'd also given all their passwords to the Chinese.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
It seems that the US is quite far behind the curve in protecting itself from so-called cyberattacks. By 'the US', I mean to include the government, private industry, and basically anyone in the US with internet connectivity. Well, OK, maybe not the crew at the NSA, but aside from them there seems to be an endlessly big attack surface and a dearth of the resources and will needed to deal with the problem.
It also seems that China is the worst of the APTs by far. Certainly not the only one, but the one that's at least 75% probable to be behind many of the significant attacks we've seen surface in the media recently.
I wonder if some heavy operant conditioning in the real world could moderate China's propensity for bad cyber behavior? For example, suppose the US government were certain that China was behind a serious intrusion (think the RSA spearphishing attack and the consequent defense systems information bleeds from the likes of LockMart et al.). Perhaps if one of China's few nuclear submarines unaccountably failed to report in after each such major cyber attack, they might change their behavior.
We are still far enough ahead of China in terms of submarine stealth to make that happen in a manner that would leave the Chinese extremely uncertain as to what happened (hostility or accident?) and who, if anyone, did it. What are they going to do, nuke us on suspicion? Doubt it very much. Retaliate against our submarines? China still can't find them. Retaliate against our surface fleet? We have the space assets to ID sources of surface and air attacks, and the SOSUS arrays and other underwater assets have everything China runs under the surface tagged in realtime. At the moment, we enjoy a highly assymetric circumstance: we can hurt them in an important part of real milspace with complete deniability, and they can't do that to us. And they care about serious economic losses that compromise military preparedness.
Right now, China incurs no cost for successful cyber attacks. If it cost them a billion dollars in real-world, slow-to-replace military equipment each time they did significant damage to us in cyberspace, maybe they would dial it back a bit.
Next thing you'll be telling me sometimes the government lies.
This might be a dumb question but: guys, how do we know it's "the Chinese" ?
Also the official guy predicting an "internet 9/11 is imminent" like 24h before the first news of a hack got published here seemed really enlightened :)
of people in one country hacking one website or did your idiot ass mean selected people in the PRC?
An email containing attachments or malicious URLs that compromise Microsoft Windows desktops ...
"Cookie jar? What cookie jar?" (hands continue grabbing cookies)
"You're paranoid, besides you make bad cookies. Who would want them?" (more hands appear)
"Yes," says a chorus of one hundred voices singing in perfect unison, "there are no hands. The cookies are bad. Besides, everyone steals cookies, so why get upset?" (more hands appear, grabbing at cookies)
Thousands of voices chime in, "Correct! No cookies! The hands could be hallucinations! Can you prove they're not a plot to discredit Handland?" (hands withdraw)
"Anybody want to buy some excellent cookies? Very inexpensive! Home baked cookies! Cookies for sale!"
Symantec does not make intrusion detection software. They make virus scanning software. These two things are different. It's like not being able to turn a screw with a hammer. Well duh!. You need to have host based intrusion detection as well as network intrusion detection. These are all in addition to virus scanning. And keep in mind that virus scanning is basically security theater BS anyway.
The Premiere of the PRC managed to sock away $2 billion in various banks, including the US banks, in violation of anti-corruption laws in China and the US. All the while, the average rural Chin family cannot afford medical care or education and still works for coolie wages in this Communist paradise. Do you think this might be embarrassing to the Communist Party? They are not hacking to fix the problem. They are hacking to find out who squealed.