Slashdot Mirror
China Behind 96% of All Cyber-Espionage Data Breaches, Verizon Report Claims
colinneagle writes "Verizon's 2013 Data Breach Investigation Report is out and includes data gathered by its own forensics team and data breach info from 19 partner organizations worldwide. China was involved in 96% of all espionage data-breach incidents, most often targeting manufacturing, professional and transportation industries, the report claims. The assets China targeted within those industries included laptop/desktop, file server, mail server and directory server, in order to steal credentials, internal organization data, trade secrets and system info. A whopping 95% of the attacks started with phishing to get a toehold into their victim's systems. The report states, 'Phishing techniques have become much more sophisticated, often targeting specific individuals (spear phishing) and using tactics that are harder for IT to control. For example, now that people are suspicious of email, phishers are using phone calls and social networking.' It is unknown who the nation-state actors were in the other 4% of breaches, which the report says 'may mean that other threat groups perform their activities with greater stealth and subterfuge. But it could also mean that China is, in fact, the most active source of national and industrial espionage in the world today.'"
The report also notes that financially-motivated incidents primarily came from the U.S. and various Eastern European countries.
I kind of envy having a government so willing to go to bat for its native industry that it's willing to go as far as to steal IP for them. In my country, the government is more than happy to sit back and watch all its industries outsource and lay off everyone, and nationalism is regarded as a bad word. China, if nothing else, believes in China.
The cow says "Moo." The dog says "Woof." The Timothy says "Thanks, valued customer. We appreciate your input."
What part of Nigeria is China in?
"Always forgive your enemies; nothing annoys them so much." - Oscar Wilde
But their robots make a fine bowl of noodles!
What do all of these network/data breaches say about the overall state of security of connected systems? Regardless of who is behind them, all can't be blamed on mismanagement.
Serious question.
Any takers?
was divided among local, state and federal government in their tireless quest to shit all over the middle east and shred the constitution.
Good people go to bed earlier.
How many companies in the US have branches in China? How many of those put any kind of firewalling, other than any-any in the VPNs connecting those branches? Yup.
Just because they are siphoning up and stealing our tech secrets doesn't mean they don't love us.
Or at least our money.
-- Tigger warning: This post may contain tiggers! --
I have a dumb question: If your company does not depend on doing business with China, why not block their entire country within your firewall? My current company has no dealings with China, so I've blocked their national IP address range. My spam/attacks have gone down almost 90% since doing so. I did the same with Russia and most of the former Soviet nations.
[repeat dozens of times per day]
At some point, you realize that the only time you ever communicate with that part of the Net, is when you're receiving an attack of some sort. Before long, "The Great Firewall of China" isn't going to be something installed by the Chinese government; it's something the rest of us will have done.
Hmm... maybe that was the government's devious plan to combat internal dissent and external influences, all along!
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
I realize you were probably asking this in jest, but Verizon Business Security is independent of their cell phone business. What happened is their investigators got pretty darn good at rooting out hackers, both internal and external. Helping customers find external hackers in their networks led them to offering these investigation services to other corporations. I'm pretty sure that their security team is a profitable self-sustaining division these days.
The most important thing to the rest of us is they created a schema for recording incidents, and they publish the data (after anonymizing it.) With the number of investigations they perform, it becomes a statistically significant source of information about breaches, which had been a real black hole of information before.
Most companies are reluctant to announce anything about their breaches. They're always negative publicity, they lead to accusations of wrongdoing or incompetence, and they may reveal other sensitive internal information about the kinds of data they keep. By being anonymized through the DBIR, we all get to learn much more about the threat landscape without being able to blame a specific company for a specific loss.
John
How much Cyber-Espionage is going in the other direction....
While watching ssh brute force on some of my systems I found myself blocking whole subnets based in China. I also discovered some in the US. Long before this one of my machines (old slax bootable CD) at home had been attacked itself and used as a stepping stone for hacker for the few hours it had gone unnoticed, a slow internet has the advantage of when I hacker was on it would get unbearably slow. I rebuilt that machine even looking for MBR trojans. However a sufficiently fast internet might not be bogged down enough for people to notice and hackers can use machines as stepping stones. Couldn't we give China the benefit of doubt and suspect they are hacked? Just a thought.
This story may well be true, but I'm going to have to hear it from someone other than Verizon. They have not proven to be a reliable source of information about anything.
You are welcome on my lawn.
Admittedly not at all sufficient, but it really should be a default.
On the one hand you take life too seriously, and on the other, you do not take playful existence seriously enough. Seth
Sorry. Just a little skeptical here. I don't doubt that China does its share, but I'm guessing that it's pretty easy to make it look like an attack is coming from China even if it originates from Boise, Idaho.
Please do not read this sig. Thank you.
... since even Verizon is involved in the scam operations of TTI National (they own this company that does false billing of fake accounts).
now we need to go OSS in diesel cars
Now that's just racist! That's like saying 99% of the world's terrorism is perpetrated by radial Islamists! How can you be so bigoted?
I really wish people with mod points would read the guidelines. It would save me from reporting it.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
Just blocking access from China to your network?
But then the world's hackers will just use proxies in other countries -- Especially the Chinese ones, who do this anyway...
How much percentage points of GDP growth do they have more than if they didn't do this cyber espionage, I'm wondering?
For example, does hacking into a high-tech factory's servers allow them to immediately create a duplicate factory with trained staff that functions just as well?
I must be stupid, because to my understanding, the IP addresses an attack originated from is highly likely not the IP addresses of the attackers. I mean, there are things such as proxies, bots, zombies, etc. The only way to figure out where the attacks really came from is to go upstream at least one level and conduct forensic analysis of those machines. I am almost certain that Verizon didn't do that.
What is the Chinese social equivalent of the 30-year old hacker still living in Mom's basement?
Wo Fat is behind this.