Slashdot Mirror
A Look At Advanced Targeted Attacks Through the Lens of a Human-Rights NGO
An anonymous reader writes New research was released on cyber-attacks via human-rights NGO World Uyghur Congress over a period of four years. Academic analysis was conducted through the lens of a human-rights NGO representing a minority living in China and in exile when most targeted attack reports are against large organizations with apparent or actual financial or IP theft unlike WUC, and reported by commercial entities rather than academics. The attacks were a combination of sophisticated social engineering via email written primarily in the Uyghur language, in some cases through compromised WUC email accounts, and with advanced malware embedded in attached documents. Suspicious emails were sent to more than 700 different email addresses, including WUC leaders as well as journalists, politicians, academics and employees of other NGOs (including Amnesty International and Save Tibet — International Campaign for Tibet).
The study will be presented at USENIX on August 21, and the full paper is already available.
Why is it important to mention that "World Uyghur Congress" is an NGO (Non-Governmental Organization)? Why can't they just call it an "organization"?
Quite a few computer systems used by climate scientists get targeted as well.
no post tell a lot about slashdot readership
to learn why The Chinese government has designated the WUC and its affiliate groups as a terrorist organisation, people must understand where NGO's came from and why they exist. "non-governmental organization" only came into popular use with the establishment of the United Nations Organization in 1945. it however intensified throughout the cold war as a means by which capitalist nations (namely the united states) could covertly do everything from back the nicacaguan contra to overthrow the government of Iran. At best, they are a destabilizing force as evidenced in Action Aid and Christian Aid which effectively condoned the 2004 US backed coup against an elected government in Haiti. NGO's cheerlead for projects like privatized water and healthcare in mozambique as they are not formally held to standard and adherence within the host country. 'showcase' projects and parallel programs that prove to be unsustainable can and do often show up alongside, but not in partnership with, government efforts.
the World Uyghur Congress is headed presently by an exilee in the United States since 2005 after six years' imprisonment in China for leaking state secrets. it is an umbrella term for an organisation of once small, weak and fractious Uyghur nationalist groups, including the World Uyghur Youth Congress, formed in November 1996. it is at most a separatist group with a line-item budget in the federal government and a testament to americas schitzophrenic relationship with china. We hate communism and dictatorial rule, but the 213 billion in trade this year seems to revise our outlook considerably. We sure hate terrorism but when the 2009 Ãoerümqi riots struck, we couldnt be bothered to care about how our NGO orchestrated and planned the event.
Good people go to bed earlier.
In the article, they mention that the group attacking WUC was using vulnerabilities in Acrobat Reader, but stopped after Adobe added sandboxing to Acrobat - and then promptly switched to using vulnerabilities in MS Office. Why is it that sandboxing isn't a standard for all popular office software? It seems like had MS sandboxed Office, these attacks likely would've ceased altogether for lack of a vector.
The U.S. (both government and wealthy organizations and persons) on one hand finance terror, which they "have to counter" with the other hand a day later. The best U.S./ U.K. buddy Saudi-Arabia does this on a even larger scale.
Cui Bono ?
The arms industry and Israel.
Slashdot is getting as bad as the conventional tech press in your inability to mention the Operating System that the vast majority of these cyber-attacks run on or require to vector the malware onto peoples 'computers'.
We fuck your shit up - China
Harrison's Postulate - "For every action there is an equal and opposite criticism"
Slashdot is getting as bad as the conventional tech press in your inability to mention the Operating System that the vast majority of these cyber-attacks run on or require to vector the malware onto peoples 'computers'.
The OS doesn't matter. According to TFA, the exploit used Adobe Reader and then MS Office documents. Office exploits have been successfully used against activists on both Windows and OS X hosts.
When you're dealing with vulnerable software like Office, it doesn't matter what OS you use. (And Office is just the easiest target. It could just as easily be Flash or Java or whatever.)