China Criticizes US For Making Weapon Plans Steal-able, Alleges Attacks From US

Etherwalk writes "Huang Chengqing, China's top internet security official, alleged that cyberattacks on China from people in the U.S. are as serious as those from China on the U.S. 'We have mountains of data, if we wanted to accuse the U.S., but it's not helpful in solving the problem.' Huang, however, does not necessarily attribute them to the U.S. government just because they came from U.S. soil, and he thinks Washington should extend the same courtesy. 'They advocated cases that they never let us know about. Some cases can be addressed if they had talked to us, why not let us know? It is not a constructive train of thought to solve problems.' In response to the recent theft of U.S. military designs, he replied with an observation whose obviousness is worthy of Captain Hammer: 'Even following the general principle of secret-keeping, it should not have been linked to the Internet.'" A few experts think China's more cooperative attitude has come about precisely because the U.S. government has gone public with hacking allegations.

Comments

Oh FFS

[Anonymous Coward]

"This is what I was wearing when China stole my weapons schematics. Tell me I asked for it."

Fuck off with your victim blaming, China. Pricks.

Re:Oh FFS

[skywire]

They didn't steal it; they copied it.

Re:Oh FFS

[naoursla]

You have lots of room to complain. If you take away the expectation to complain it give criminals an excuse to commit the crime.

If you saw a Ferrari parked somewhere with a bunch of cash in the front seat, would YOU feel okay stealing it or the car? I would hope not. Stealing is wrong regardless of how easy it is. Why do you give others a pass for something you wouldn't do?

Re:Oh FFS

[LordLimecat]

The world is complex enough that multiple people can be at fault. If the Ferrari gets broken into, you are at fault for being naieve and foolish, and the thief is at fault for being a leech on society.

Who gets the blame? Both of them. Is the thief the bigger part of the problem? Sure he is, and the largest portion of the blame goes to him. But you still are responsible insofar as your foolishness left you wide open to being victimized and creating an opportunity for a crime that any reasonable individual could have predicted.

Re:um?

[SJHillman]

At least we're not Britain. I mean, seriously, what kind of permissions is 007 for a spy?

Can't fault China on this one

[Xest]

Whilst I'm not saying China doesn't do any state sponsored hacking I've pointed out before that China has the largest online population of any nation and has about 1/6th of the world's population. Statistically if you get non-state sponsored hackers in every nation it makes sense that you're going to see more from China than anywhere else.

It's quite possible that it's nothing to do with the US "going public" and everything to do with the fact that a large number of hack attacks from China against the US is pretty much a statistical certainty regardless of state actors being behind it or not.

I think all governments do state sponsored hacking, I certainly think China does, to what extent is unclear but I do think at least the claims against China are probably overhyped.

Which may not inherently be a bad thing anyway though I guess if it gets Western firms to take security a bit more seriously so maybe there's a silver lining regardless.

Re:Can't fault China on this one

[c]

Statistically if you get non-state sponsored hackers in every nation it makes sense that you're going to see more from China than anywhere else.

Yeah, but China has a firewall. Surely you're not suggesting that non-state sponsored Chinese hackers have figured out how to get around the national firewall?

Heh... actually, that wouldn't be a bad official response. Puts the Chinese in the position of either accepting responsibility for hacking, or admitting that their state firewall is actually pretty porous.

Re:Can't fault China on this one

[ranton]

Heh... actually, that wouldn't be a bad official response. Puts the Chinese in the position of either accepting responsibility for hacking, or admitting that their state firewall is actually pretty porous.

I doubt they care very much that there firewall can be compromised by people skilled enough to hack into government and corporate computers. The main point of the firewall is to assert control over the general population.

Re:um?

[camperdave]

At least we're not Britain. I mean, seriously, what kind of permissions is 007 for a spy?

Plausible deniability?

I don't get this.

[wcrowe]

I always thought it was a rule from Espionage 101 that you don't let the other side know when your side has been compromised. You use it as an opportunity to start sending out false information, and to learn their tactics and precisely who is involved. I don't understand why we are telling everyone in the world that the Chinese have stolen our information. It just makes us look inept in all sorts of ways.

Re:I don't get this.

[SuricouRaven]

To harm China diplomatically and economically. If they get a reputation for underhanded spy games then businesses will be more reluctant to do business there for fear of having their designs shamelessly copied and research stolen, and nations will be less willing to allow free trade if it is known that China seeks to favor domestic industry by impeding the operations of overseas competition.

Re:I don't get this.

[Maxo-Texas]

The problem with this position is that they have HAD a bad reputation for stealing IP for over 20 years now. And it hasn't changed anything.

People still do business with them. People still ship designs and formulas to them to produce.

What will reduce IP Theft is higher chinese labor costs which make local manufacturing a better solution than offshoring. And we've probably got another 8 years before chinese wages + fuel transportation costs == local labor costs.

Re:um?

[blane.bramble]

Sounds like perfect ones to me - read, write and execute everyone except himself and his group.

Re:Blah blah blah

[SuricouRaven]

I do hope that means a second space race. If China seriously looked like they were about to set the first man on Mars, or establish a long-term moon base, I think America would have to devote billions of dollars to doing it first just to defend their national ego. Again.

Then sic the RIAA on them

[Anonymous Coward]

According to the RIAA, that's worse.

Outsourced R&D

[Scot Seese]

WalMart has outsourced the production of plastic flower pots and patio furniture to China for decades - the Chinese are simply reversing the process! By letting U.S. taxpayers fund the billions of dollars per year we pour into military R&D, they save massive amounts of money and man hours, and are guaranteed the best designs that 17 year old Chinese Red-Bull & Cheetos-fuelled hax0rs can steal.

Take a copy-catted F22 Raptor, paint a Chinese air force insignia on it, and * VOILA! * Fifth generation air superiority fighter MINUS the 20 years of research and testing.
What you say? Their copy is only 85% as good as ours because they made shortcuts in the radar, or avionics, or missile systems? That's OK, our congress will keep paring down the final platform order until our air force ends up only getting 200 F22s, while the Chinese will manufacture 1,150 of theirs.

The current US military philosophy is starting to look more and more like WW2 era Germany, with absolute faith placed in a relatively small number of extremely expensive, extremely high quality weapons systems, which ultimately were smothered and overrun by a developing nation (the U.S.) with phenomenal industrial capacity capable of running M4 tanks, jeeps, B17 bombers, and numerous other things off assembly lines faster than the Germans could destroy them.

The comparative ironies to today's military situation are incredible.

Re:Outsourced R&D

[rahvin112]

Arm chair generals. Although the information they stole is valuable they haven't stolen information that's going to have them building Raptors. China has been trying to copy SU-27 jets for about a decade now, they can't get the engines built right and are at the point of having to go back to a Russia that vowed never to sell to them again to beg them for rights to purchase more advanced systems.

Even though they have working Russian built engines to compare against they weren't able to duplicate the engines. Any Engineer can tell you why, even with detailed schematics, if you don't understand the design you don't know where the critical sections of the design are or what processes to use during assembly that prevent catastrophic failure later. Most of these highly advanced weapon systems have decades of incremental experience built into the design. Even small differences in manufacturing can render parts unusable and it's experience that teaches you that, not schematics and working samples. Though the design information and working samples accelerate learning they don't do away with it.

Re:Outsourced R&D

[dj245]

Can you be more specific? I thought designs and schematics would detail all of these things to make sure someone else knows what to do. It's a bad idea to let critical information get stuck in the heads of your scientists and engineers in case they, you know, die.

Here's one.

My company sells gas turbines for generating electricity. These are based on a standard design which is analyzed to death and then built full-scale to make sure it performs. There is one main package (the gas turbine) and then small little modules which resemble small shipping containers (10x10ft, 15x20ft, etc) with equipment inside. The piping and electricals is run between the packages and the little modules.

Even if you had all the blueprints and design documents, you could easilly fall into the trap of thinking that "modular" implies a similarity to LEGOs and you can lay out the modules wherever you want, changing the placement to suit the site conditions. Maybe you want to move Module X from the left side of the machine to the right side of the machine, or move Module Y by 20 feet in order to try to hide a noisy piece of equipment from a residential area.

On the surface, this sounds quite easy! Just make sure your pipefitters have a little extra pipe, and the electricians have a little extra wiring so they can connect it up. The problem is that the system is completely and tightly integrated-

The piping has been analyzed in the standard design for friction losses and thermal stress. Move the module without considering this, and maybe the system doesn't get quite the pressure it was expecting. Maybe the pipes crack because of thermal expansion.

The Hazardous area classification has been studied in the standard design. Pressurized, airtight, explosion-proof electrical junction boxes are expensive, so they don't get used if they aren't needed. You use a regular one instead. Not a problem at all if you aren't in a hazardous area. Move that module 20 feet, however, and maybe you have put it in a dangerous location.

The entire layout has been planned for maintenance and construction. There is enough room to take everything apart and put it back together again. If you move a module to the wrong spot, maybe you can't remove Part Y from the machine. Or maybe you don't have enough room to put a wrench on equipment Z, so you can't install it in the first place.

The electricals have been designed as an integrated system too, and optimized to use the smallest wire possible while still being reliable and safe. If you make the length longer, however, maybe the resistance loss is high enough that the signal is unreliable.

As the GP said, if you are stealing plans for complicated equipment, you basically have to get to know the design as well as the original designer. If you don't, it is very easy to make a small change for reasons of improvement or localization which completely breaks the design. This can happen even if you have every drawing and document ever made for the thing. Inevitably you will have to change something, especially if you are stealing from the US since we use imperial measurements. It can be as simple as using 26mm thick steel plate instead of 1 inch thick steel plate.

US Infosec Incompetence summed up in one sentence!

[endus]

'Even following the general principle of secret-keeping, it should not have been linked to the Internet.'"

You think so??? Really? This is a novel concept to our American Information Security Industry, please, tell us more! Surely you don't mean that power plants and water treatment facilities and power grids and other sensitive facilities should not be linked to the internet...HOW THE FUCK ARE THE OPERATORS GOING TO GET TO FACEBOOK IF WE DISCONNECT THEM!?!?!?!?