Washington Post: We Were Also Hacked By the Chinese

tsu doh nimh writes "A sophisticated cyberattack targeted The Washington Post in an operation that resembled intrusions against other major American news organizations and that company officials suspect was the work of Chinese hackers, the publication acknowledged on Friday. The disclosure came just hours after a former Post employee shared information about the break-in with ex-Postie reporter Brian Krebs, and caps a week marked by similar stories from The New York Times and The Wall Street Journal. Krebs cites a former Post tech worker saying that the publication gave one of its hacked servers to the National Security Agency for analysis, a claim that the Post's leadership denies. The story also notes that the Post relied on software from Symantec, the same security software that failed to detect intrusions at The New York Times for many months."

Comments

Yea. Me Too.

[Anonymous Coward]

I need some attention too!

What I have derived form this past weeks revelations.

1. The Chinese have no problem gaining access to what ever computer networks they wish to.

2. They seem to be most interested in themselves, kinda like creeping other people's Facebook to see what they say about you.

3. So far, they haven't found anything worth their time.

4. Organizations seem to feel that since they discovered something on their networks, they have discovered everything on their networks.

5. Fail.

Re:Yea. Me Too.

[jhoegl]

Go back into your bunker...

NPR had a great story on this yesterday, but since you most news is propaganda, you must ask these ignorant questions.
Your ignorance breeds unto itself.

Re:Yea. Me Too.

[alexander_686]

These newspapers have been reporting embarrassing things. Like members of the Communist Party and their family members have vast wealth – implying that this wealth is coming from inside contacts and use (or abuse) of official power. The Communist Party would be interested in who is leaking the details.

Re:Yea. Me Too.

[flyneye]

So, why can't they use a stolen credit card number to get to the premium/pay stories?
Doesn't add up.

Re:Yea. Me Too.

[jhoegl]

Clearly you understand nothing of your own situation.
You make excuses for your ignorance by claiming sources are false, when they have repeatedly been proven.
Instead you let someone else filter your information, forming your opinion for you.
Lets hope you never make a major life decision that will affect others.

Re:Yea. Me Too.

[flyneye]

Well someone said so anyway. I guess you got it from newsclown.
I've heard enough verifiable bullshit over the years from NPR to see that it's just an ad agency for aging hippies.

Re:Yea. Me Too.

[alexander_686]

Your missing the point. The fact is that somebody is hacking into the paper to figure out who the journalist's sources are.

So, it's not the average Chinese citizen trying to read the paper – it's about finding who the journalist are, what their sources are, etc – the stuff a government would need to harasses and shut down the people who are leaking the data.

Re:Yea. Me Too.

[Forty Two Tenfold]

U.S. Defense Secretary Warns of a Possible 'Cyber-Pearl Harbor'.

So, no, it's simple. The USA declared "Cyber War" on the USA so some "attacks" are required to be reported. These don't have to be real though, just reported.

Re:Yea. Me Too.

[flyneye]

Ahh thats better an actual answer rather than the newclown defense league.
Now it would be funny to find the newspapers hacked China...

Re:Yea. Me Too.

[AmiMoJo]

You are assuming it was the Chinese government. So far I have not seen a shred of evidence to support that. There is some circumstantial evidence that the attacks may have originated from China, possibly.

It would actually make a lot more sense if it were hackers hired by the politician who has been the subject of these embarrassing stories. Of course it might just be the Chinese equivalent of Anonymous.

Re:Yea. Me Too.

[PCM2]

You are assuming it was the Chinese government. So far I have not seen a shred of evidence to support that. There is some circumstantial evidence that the attacks may have originated from China, possibly.

It would actually make a lot more sense if it were hackers hired by the politician who has been the subject of these embarrassing stories.

OK, did I just read your whole comment to learn that you think there's not "a shred of evidence" that it was the government, but instead you believe it was hackers hired by the government? I think I can smell my brain dying.

Of course it might just be the Chinese equivalent of Anonymous.

Do you have any idea how things work in China? Just think for a minute: Great Firewall of China, ring any bells? Go find some bandwidth statistics and see how hard it is for the Chinese to get access to fast internet connections, compared to places like South Korea or Japan. And if there really were some underground internet hacker movement composed of individuals in China -- and there isn't -- why on Earth would they attack Western newspapers, which mostly tell the truth, and not their own newspapers, which never do?

Re:Yea. Me Too.

[AmiMoJo]

OK, did I just read your whole comment to learn that you think there's not "a shred of evidence" that it was the government, but instead you believe it was hackers hired by the government? I think I can smell my brain dying.

A politician acting for themselves is not the same as the state deciding to sanction something. When a US politician goes to jail that doesn't mean that the government committed a crime or endorsed his behaviour.

Re:Yea. Me Too.

[alexander_686]

This is China - the lines between government, party, industry, and politician are a bit blurred. For example, IIRC, the Army reports to the party - not to the government. Elections are limited and managed. etc.

Re:Yea. Me Too.

[PCM2]

A politician acting for themselves is not the same as the state deciding to sanction something. When a US politician goes to jail that doesn't mean that the government committed a crime or endorsed his behaviour.

OK, my guess was right. You really don't understand how things work in China. My recommendation is that you go to the library, grab back issues of some reputable news source (The Economist might be a good place to start) and read up on everything you can find about the last Chinese national election. Along the way you'll learn a lot about how free Chinese politicians are to act independently. (TL;DR - China ain't the US.)

Also, just think about what you're suggesting. This isn't some politician giving an order to have some hapless old man thrown in prison. That kind of thing happens all the time in China, and nobody ever hears about it. What you're saying, though, is that some lone politician, acting completely independently and on his own initiative, hired hackers to launch an attack on the two largest, most respected newspapers in the United States. Not even the largest companies -- the largest newspapers. Exactly how was this supposed rogue, lone wolf politician planning to cover up what he did?

Re:Yea. Me Too.

[alexander_686]

Define “Hack”. Are not investigative journalist suppose to investigate? Unearth buried and unpleasant truths? Being a “hack” used to be slang for being a journalist. A low class one interested in sensationalist stories, but still...

Re:Yea. Me Too.

[blue_teeth]

The Power of Nightmares

Re:Yea. Me Too.

[K. S. Kyosuke]

"the lines between government, party, industry, and politician are a bit blurred"

That almost sounds like a description of Japan, too!

Re:Yea. Me Too.

[K. S. Kyosuke]

Perhaps they tried to edit the name to "Wachinkton Post"?

Re:Yea. Me Too.

[cyfer2000]

I don't think /.er 84093 can be a 50 Cent party member

Re:Yea. Me Too.

[mbkennel]

"What could they possibly want with the newspapers?
They don't control anything of value.
Most of the news is bullshit and propaganda.(probably less than in China, tho)
Are they trying to insert their own journalism?( as if anyone would notice)"

Think.

They are attempting to find and punish---extremely severely---any sources who gave information to the reporters. They are threatening the reporters. They are threatening the newspapers who publish information critical of the regime's power.

Re:Yea. Me Too.

[mjwalshe]

They want to find the journalists sources so they can be sent to the gulags (if they are lucky).

Re:Yea. Me Too.

[flyneye]

Where can I find this newsclown? Can I get a deposit back on mine?

Re:Yea. Me Too.

[flyneye]

I'm still waiting for computer saavy newsclowns, they seem to still be stuck on the tubes and pipes thing.

Re:Yea. Me Too.

[flyneye]

LOL, I defy them to carry out any threats to newsclowns!
Go on take your best shot! Buncha sissy Chinese hackers! Go on , I dare you!

Re:Yea. Me Too.

[flyneye]

Hey N.Y.Times and Wash. Post journalists are lucky. Send them! Dunno about the luck of the WSJ guys though, wouldn't they be too rich to be journalists if they were? But fair is fair, send them too!

Re:Yea. Me Too.

[mjwalshe]

send Murdoch Sr and Jnr First :-)

Re:Yea. Me Too.

[flyneye]

Added Bonus: Exhumed remains of Hearst

Re:Yea. Me Too.

[SourceFrog]

Devil's Advocate, and tinfoil hat time: How do we know this isn't a sophisticated false flag operation, by our own government? This could be exactly what is needed to try convince the public to support new over-reaching laws giving the government much more control over our Internet. Watch closely any new bills or regulations that follow this.

Re:Yea. Me Too.

[russotto]

The Communist Party would be interested in who is leaking the details.

I'm going to guess they mostly came up empty-handed. I doubt reporters would keep such information on the Post's systems -- either because they're technophobic, or paranoid that someone else at the post would steal their sources, or perhaps in a few cases worried about the US government subpoenaing the information.

Re:Yea. Me Too.

[AmiMoJo]

So by your logic the US got a blowjob in the Oval Office.

The government is not one man, even in China. If it this did happen and was ever proven he would be forced out at the very least, if not prosecuted, even in China.

I think you need to do some reading about China. My girlfriend is Chinese as it happens, so I have some interest in this subject. There is corruption and lawbreaking, but the official policy is to clamp down on it. It will be ignored until it can no longer be ignored (because incontrovertible proof is made public), at which point the powers that be will come down hard.

Re:Yea. Me Too.

[gmhowell]

There is corruption and lawbreaking, but the official policy is to clamp down on it.

Oh, why didn't you tell us? There's a policy against it? Then surely it never happens. /eyeroll

Re:Yea. Me Too.

[Pros_n_Cons]

The attacks all seem to begin around 8:00AM in China also. Maybe the scene has changed since my day but h4x0rs were getting ready for bed around that time. seems to me this is sponsored and they're clocking into work.

Re:Yea. Me Too.

[PCM2]

The government is not one man, even in China. If it this did happen and was ever proven he would be forced out at the very least, if not prosecuted, even in China.

OK, now I think you're intentionally being thick.

Let's recap: You are the one suggesting that this was the work of one man, acting alone. I am the one telling you that this is virtually impossible, and an attack of this kind would never be done without official government sanction. So explain to me what your new argument is now, because you sure as hell sound like you're making my point for me.

I think you need to do some reading about China. My girlfriend is Chinese as it happens, so I have some interest in this subject.

I bow before the superior intellect, Khan.

It will be ignored until it can no longer be ignored (because incontrovertible proof is made public), at which point the powers that be will come down hard.

Yeah? And just when would that proof be made public. You mean the kind of "made public" like when the newspapers you attacked run stories about it and the entire world knows about it?

I am begging you ... begging you, now. THINK. Use your brain.

Re:Yea. Me Too.

[AmiMoJo]

You claim that it is "virtually impossible" is laughable. Apparently you missed all the attacks by small groups of hackers, up to and including the theft of 250,000 Twitter account details a few days ago.

I bow before the superior intellect, Khan.

You really are a dick, aren't you?

You mean the kind of "made public" like when the newspapers you attacked run stories about it and the entire world knows about it?

So they both have motivation to prevent that happening. What is your point again?

I can tell logic and reading comprehension are not your strong points.

Re:Yea. Me Too.

[AmiMoJo]

Yeah, if I were hacking some foreign state I'd be sure to start bang on 8:00 local time, just in case they didn't get the hint that it was my country doing it.

Re:Yea. Me Too.

[Forty Two Tenfold]

Where?

Attack details?

[griffjon]

Has anyone seen any details on how to detect this specific method of attack, malware signatures, or similar? Cause that just might be of use, seeing the widespread nature of this.

Also, who hasn't been attacked? Bueller? Bueller?

Re:Attack details?

[Anonymous Coward]

I know a newspaper from a small Kansas town that hasn't been attacked. It's produced by a 80 year old man with his mechanical typewriter. Maybe these major American news organizations could learn a thing or two from him.

Re:Attack details?

[astralagos]

APT attacks are well understood, it's just that they're not very technologically complex. They are, fundamentally, con jobs. You research somebody with a public identity, send a forged email with a trojan, and wait for somebody to open it. The success of the attack is dependent on finding a large enough group that somebody will open the mail. If you want an early example of a discussion of this, read Shishir Nagaraja's and Ross Anderson's "Snooping Dragon" paper.

As for malware signatures, they've been increasingly ineffective for years. Attackers can buy AV as well, and it's easier for them to tweak their software to evade AV then it is for defenders to generate new signatures. AV's very good at protecting you from yesterday's attack. If you don't have a signature though, it usually takes month to identify a subverted host.

Re:Attack details?

[Sulphur]

I know a newspaper from a small Kansas town that hasn't been attacked. It's produced by a 80 year old man with his mechanical typewriter. Maybe these major American news organizations could learn a thing or two from him.

William Allen White?

--

Its all Post facto.

Re:Attack details?

[guttentag]

Disclosure: I am a former Washington Post employee

The Post doesn't seem to officially be divulging details. Sure, they're reporting on it now that the word is out through a former employee's blog citing an unnamed former employee (neither of those people are me) as a source, but the article actually has a Post spokesperson denying one of the claims of the article (that the Post handed over one of its servers to the NSA for study). This isn't the paper contradicting itself – it's what ethics look like in practice at a good newspaper. The paper can report on itself even when the top brass don't want to.

However, in the New York Times story on its own intrusion, it was stated that AT&T "monitors" the company's network and noticed unusual traffic patterns. AT&T alerted athe Times, who asked them to keep an eye on it, and then brought Mandiant in to consult.

Going back to The Post's story, the company's claim that it did not turn over a server to the NSA casts the issue of China hacking U.S. newspapers in a new light... if you read between the lines. Newspapers (especially The Post and The Times) see themselves as a fiercely-independent check on the government. Watergate-era readers would be as appalled at the idea of The Post handing over servers to the NSA as MacWorld attendees were in the 90s at seeing Bill Gates's face on screen during Job's speech. From a PR perspective, it just looks wrong. China might actually do more to harm these papers by getting them to run into the arms of the U.S. government. It's one thing to think China may have found out you're talking to a reporter... Quite another to think both the U.S. and China may later discover you were the anonymous source for a story they didn't want out. It's unlikely that the NSA is rooting around the server looking for political whistleblowers, but the idea of it has a chilling effect on potential sources who think of The Post as the institution that protected Deep Throat's identity for decades, at great risk to itself.

Re:Attack details?

[PCM2]

This brand of cynicism is dull, and it creates its own form of self-fulfilling ignorance.

If nothing you see in the media is true and every journalist is a puppet of either advertisers or the government, then where do you get your news from, exactly?

There is only one possible answer, and that is: You make it up. You hear what people tell you, decide you're going to believe the opposite, and then you go around railing on the news for not saying what you believe.

In other words, you are a dolt.

Re:Attack details?

[Anonymous Coward]

Two consulate attacks happened on the same day, one by a protesting mob and one by ex-rebel fighters with all qaeda ties. This is in addition to many other mobs that gathered to protest the anti-islam video produced in the US. The attack was quick and I don't believe any of them identified themselves to allow it to be radioed back. There was confusion I'm sure, and the special mission in Benghazi and elsewhere should have had more security. It's a story, but I'm not sure it's as big as you've made it out to be. It also doesn't necessarily paint Obama in a negative light, as the private sector security they had guarding the place sounds more like a republican answer than a democratic one. A bill had also failed in congress that would have appropriated more security to these places.

I think generally the people harping on the issue are delusional. US intelligence isn't omnipotent, and the only reason Benghazi was a hot topic is because of the election. The NYT is a distinguished publication even despite their problems, and I contest that they worked to get Obama elected. They didn't harp on there not being any WMD in Iraq, or that the Bush administration didn't heed a report warning of the 9/11 attacks.

Re: Attack details?

[Tablizer]

Hillary was talking about the immediate aftermath, not categorization in general.

In other news, ...

[Anonymous Coward]

Let's just list the companies that have been verified not to have been attacked by the Chinese.

I figure...

[Xenna]

Symantec has probably been hacked by the Chinese too...

Did they also hack Slashdot?

[peterindistantland]

Is that why I was modded down last time?

How is this not an act of war?

[OS24Ever]

I'm curious why repeated attacks "by the Chinese" have invoked no response from the government? It seems odd that we have US Companies being attacked on US soil and there's not even a peep about it.

I'm not saying bomb people but tis seems.....weird...

Re:How is this not an act of war?

[mitchaki]

Maybe it has something to do with the large amounts of money the US owes China. It could also have to do with the US government trying to hide the fact that the Dept. of Homeland Security is completely inept and a huge fail when it comes to cybersecurity.

Re:How is this not an act of war?

[pushing-robot]

Because...

(a) We can't be sure the attack originated in China, it could have simply been proxied through there (there are plenty of vulnerable Chinese systems).
(b) Even if it was, we can't prove it was organized by the Chinese government (there are plenty of non-state hackers in plenty of countries).
(c) Even if it was, lots of governments engage in low-level espionage (including your own) without significant diplomatic repercussions.

Gathering intelligence isn't typically considered an "act of war" unless it is seen as a prelude to invasion or otherwise causes physical harm.
If it was, intelligence agencies would have started World Wars 3 through 17 by now.

Re:How is this not an act of war?

[__aaltlg1547]

What are you on about? The government talks about this all the time.

Re:How is this not an act of war?

[Anonymous Coward]

You forgot about the part where the current administration tends to minimize most things that would be considered "egg on the face" of any other administration. Most people will never know about this, and they definitely should.

They've got the media in their pockets, and they know it.

They've got most of *you* in their pocket, and we know it.

Let the illogical defending begin. Always fun to watch on slashdot.

Re:How is this not an act of war?

[Anonymous Coward]

No citations but let's assume you're right.
When the US does that, Slashdotters never say "Well [somebody else] does it too. This is a non-story." Rather, most of us are righteously indignant and critical of such actions. Now, When [somebody else] indeed has done it, it seems the general consensus is "The US does it too. This is a non-story"

How about some consistency in standards?

Re:How is this not an act of war?

[oodaloop]

What do you want the DHS to do? Go into every company and tell them how to set up their networks?

Re:How is this not an act of war?

[oodaloop]

(a) We can't be sure the attack originated in China, it could have simply been proxied through there (there are plenty of vulnerable Chinese systems).

...which were associated with Chinese military? These weren't random machines. The proxies the Chinese used were random machines in the US, and the attacks were traced back to machines associated with the Chinese govt. This has happened many times in the past, and we know of large Chinese military units engaged in cyber warfare. How many attacks like this have to happen before people realize what kind of war we are in?

Re:How is this not an act of war?

[guttentag]

I'm curious why repeated attacks "by the Chinese" have invoked no response from the government? It seems odd that we have US Companies being attacked on US soil and there's not even a peep about it.

I have three simple answers for you:

• When the U.S. military conducts a "cyber" strike on another country, they're not going to tell you. Not even a peep. No one died, no maimed vets missing legs, so no one needs to know. The odds are they were already "at war" with China in "cyberspace" before this happened.
• These intrusions are not worth risking a real war.
• The U.S. government is just as interested in knowing who reporters are talking to as the Chinese are. Why would they want to stop this when China is pushing the newspapers into the arms of the FBI and NSA?

Re:How is this not an act of war?

[Anonymous Coward]

Those of us who have traced APT through a few proxies (typically only one) back to a large building owned by various Chinese government agencies can assure you that a very large scale industrial espionage program is underway, with occasional sidelines into attempting to trace methods and sources. There are mountains of evidence, most of it feed into shredders under the instruction of corporate lawyers. And most US corporations are so dependent on deeply flawed Microsoft technologies and caught so deep in political games that most of the time they'd rather bury their head in the sand and ask subordinates to delete all evidence than actually do anything proper about it. IT is a cost center, and you can't demonstrate security ROI in a way that passes modern MBA scrutiny. All corporate divisions exist only to bump the stock price this quarter, which means we have to keep cutting cost and overhead. With few exceptions, investment is basically dead in the US corporate world.

Re:How is this not an act of war?

[MikeMo]

I'm curious why repeated attacks "by the Chinese" have invoked no response from the government? It seems odd that we have US Companies being attacked on US soil and there's not even a peep about it.

How do you know we're not doing anything about it?

Re:How is this not an act of war?

[dkleinsc]

How many attacks like this have to happen before people realize what kind of war we are in?

One in which nobody's died?

Re:How is this not an act of war?

[oodaloop]

Good idea. Let's do nothing and wait until it's too late to save lives. Skate to where the puck's gonna be. Our power grid is going smart, meaning more and more things are connected to the internet, including all of our critical infrastructure. The internet of things is growing, with things like stoves and coffee pots hooked up to home networks (highly secure, I'm sure). China, Russia, Iran, and even North Korea (believe it or not) all have robust cyber offensive capabilities. This is where the next war will be fought, and the nerds here seem to want to make every excuse to avoid believing it.

Re:How is this not an act of war?

[mjwalshe]

Do you think any response has to be overt - there is more than one way to apply pressure as FDR said sneaking softly sometimes means you don't have to use the big stick.

Re:How is this not an act of war?

[ahabswhale]

If "IT is a cost center" then you're not doing it right.

Re:How is this not an act of war?

[c0lo]

How many attacks like this have to happen before people realize what kind of war we are in?

You don't feel good you don't define a situation as being "at war", don't you?

Re:How is this not an act of war?

[DNS-and-BIND]

China, due to the Great Firewall, is slow as shit, lossy, and the worst place on the planet to route your traffic through. Not when there are Botswana, Russia, Belarus, etc. However if you're with the Chinese government, you get an unblocked clean line that is just as good as 1000mbps DSL in Korea.

Re:How is this not an act of war?

[oodaloop]

I don't know if I don't understand what you're trying to say, don't I.

Re:How is this not an act of war?

[c0lo]

(perhaps I should have replied to the OS24Ever OP) I'm a bit sick of the "being at war" ethos. In which:
* every attack is categorized as "being at war", disregarding how harmless or serious the attack actually is (I'd see Aaron Swartz as a victim of such a mentality: from where else the need "to make an example of him"?)
* "war on concepts" are no longer just metaphors

Without being a symptom that's unique and defining the "disease", it is highly consistent with "former giants about to fall": inability to control any longer the "great destiny that once was" and the unwillingness to rationally accept this situation; a combination mostly manifesting itself as an aggressive pride.

(I'd suggest a change in you signature. I feel the "The land of the repossessed home. Free of the brave" describe more accurate the situation).

Re:How is this not an act of war?

[c0lo]

I'm curious why repeated attacks "by the Chinese" have invoked no response from the government? It seems odd that we have US Companies being attacked on US soil and there's not even a peep about it.

"Citizen, you want to be safe of intrusion? Well, it's mandatory everybody releases to us their private encryption key..."

Would you still want govt to step in?

Re:How is this not an act of war?

[Maudib]

Saying something and doing something are not the same thing. If the government is doing something, talking about it would quite likely be very dumb.

Re:How is this not an act of war?

[gmhowell]

Do you think any response has to be overt - there is more than one way to apply pressure as FDR said sneaking softly sometimes means you don't have to use the big stick.

Wrong Roosevelt.

Re:How is this not an act of war?

[mjwalshe]

oops it sit corrected

Re:How is this not an act of war?

[mitchaki]

Haha..of course not, I have no trust in them when they can't even defend their own .gov domains. Is there any other insights that you can offer? Or do you just ask silly questions?

Kinda strange...

[Anonymous Coward]

So do those people really think that the Chinese are the first to hack into their servers?

Something tells me they don't actually reveal that Americans have been hacking into their servers for years aswell, because they want to hype up the entire cyber-terrorism and warfare thing. You know, makes it easier for politicians to push through even more bills that kill off the internet.

Attack Vector(s)?

[SirBitBucket]

Has this info been made public?

What, Security?

[10101001 10101001]

"The story also notes that the Post relied on software from Symantec, the same security software that failed to detect intrusions at The New York Times for many months."

Golly, it's almost as if relying upon detection after the fact or at entry point is no real protection. Oh, but you say, defense in depth! Well, defense in depth is great. But, intrusion detection of the sort is like tissue paper when you might get thousands of attacks daily. The only real defense is actually having software that isn't exploitable. And that means having (a) open software you can analyze, (b) developers/vendors of that software who will quickly address problems, (c) open disclosure so you don't have to wait months to find out you might already be being hacked--giving you the option to simply stop using software if it's hackable--, (d) multiple servers running multiple software stacks so you have something to switch to for (c), and (e) having a strong push for possible problems so you don't have to rely upon (b) because (b) is just a bad hack to the truth that no software is perfect--as that's a broken record if it's said all the time, as it's meant to explain the *occasional* security bug.

Oh, and I think this also highlights the whole point that treating security as a joke shows the joke's on you. The real thing to worry about is just how bad the US Government's security score is. If you at all believe that government is generally worse than private industry--not something I particularly believe given just how bad private industry is--, then the US as a whole is fucked at least as far as any concerns for keeping US Government held data private from the Chinese or other hackers. All things considered, it makes one wonder if the data China has--not necessarily even their government--would put Wikileaks to shame.

Re:What, Security?

[colfer]

Symantec, I wonder what goes on there. Hope the engineering is better than the fairly ridiculous adventure I had with customer service. I was reporting a bug in the "Verified" seals for my paying client: the web wizard generates the wrong seals because the product matrix has not kept up with the threeway conversion of Verisign, Symantec and Norton. On the fourth customer service rep I finally had someone who knew what he was talking about. Refreshingly, he was blunt and did not end by asking me if I had any other issues, but just signed off! He sent me the code I needed, but I'm not sure he reported the bug.

Let's hope that means the server security and SSL cert teams are no-nonsense engineers, not bereft souls in a chaotic marketing enterprise.

Blame the software?

[Murdoch5]

What is the point on the IT department if your going to blame off the shelf software. The software is a rough first stop but in no way a completely solution for prevention. Before you blame the software also blame the IT department.

Re:Probability

[oodaloop]

I guess that might make even the slightest amount of sense if a Norwegian farmer and a Zimbabwean goat herder had the same likelihood of using a computer owned by the Chinese military.

THE CHINESE

[Anonymous Coward]

That monolithic entity known only as THE CHINESE.

Odd that when Anonymous deface a bank's website we don't say THE AMERICANS hacked it.

Re:THE CHINESE

[edibobb]

I suspect the Mongoliad.

Sophisticated?

[edibobb]

Of course it's a sophisticated attack. It happened to a big company, and they cannot be held responsible. If it happened to me on my home PC or at a small business, it would be my own fault for having inadequate security.

Re:Lie factory

[guttentag]

The Washington Post is a company that sells propaganda to suckers. They lie for a living. Why should anyone believe them now?

Citation please.

This could cause some confusing headlines

[istartedi]

If the main story on the front pages is "Hacked by Chinese", was that supposed to be the main story or is it just script kiddies bragging?

Re:Lie factory

[93 Escort Wagon]

Thank you for sharing your opinion, Mr. Liddy.

Looks like Bad Things DO Happen in Fours

[ohnocitizen]

http://it.slashdot.org/story/13/02/02/0340220/twitter-hacked

Looks like bad things do happen in threes — Twitter's report comes on the heels of disclosures of hacking attacks on the WSJ and NY Times.

Can we please get rid of that ridiculous expression?

Re:Looks like Bad Things DO Happen in Fives

[dkleinsc]

Not only have 4 other bad things happened, we've also failed to get rid of that ridiculous expression!

Can someone remind me who wrote Stuxnet?

[jools33]

Can someone remind me who wrote Stuxnet? - and how is this any worse?

Re:Can someone remind me who wrote Stuxnet?

[mbkennel]

One is trying to stop a religious dicatorship from making nuclear weapons.

The other is trying to intimidate people (and imprison them) who look into and talk about the corrupt financial shenanigans of a secular dictatorship.

If Stuxnet were directed at a German newspaper which printed a story about Dick Cheney's purloined billions, then it would be pretty comparable, but the U.S. government isn't actually going to do something like that, because, believe or not, some of the people in charge of doing the operation might believe it to be immoral.

The Onion says Me Too, too!

[billstewart]

The Onion, America's Finest News Source, recently posted an article saying they'd also given all their passwords to the Chinese.

Re:The Chinese, such ingenius hackers

[mbkennel]

Why is obscuring the origin of their attacks their intent? Perhaps being tracked to China is one of the points of it.

It's like poisoning a dissident with polonium: the unmistakable message of "don't fuck with Putin".

Newspapers arrogant and bad at security?

[gelfling]

Next thing you'll be telling me sometimes the government lies.

Wen Jiarbo has $2 billion?

[iMactheKnife]

The Premiere of the PRC managed to sock away $2 billion in various banks, including the US banks, in violation of anti-corruption laws in China and the US. All the while, the average rural Chin family cannot afford medical care or education and still works for coolie wages in this Communist paradise. Do you think this might be embarrassing to the Communist Party? They are not hacking to fix the problem. They are hacking to find out who squealed.