China Blamed For Attack On Australian Bureau of Meteorology (abc.net.au)

New submitter ElectronF sends news that officials within the Australian government are blaming China for an attack on computer systems at the Bureau of Meteorology. "The bureau owns one of Australia's largest supercomputers and provides critical information to a host of agencies. Its systems straddle the nation, including one link into the Department of Defence at Russell Offices in Canberra." China has denied involvement, saying, "We have stressed that cyber security needs to be based on mutual respect. We believe it is not constructive to make groundless accusations or speculation." The Bureau's systems are still fully operational, though officials say the breach will require significant investment to recover from.

Comments

Isn't it interesting...

[mitcheli]

"We have stressed that cyber security needs to be based on mutual respect. We believe it is not constructive to make groundless accusations or speculation." Then why do you keep doing it? Respect is earned, not given. Isn't it interesting that the brand new stealth fighter introduced by China looks an awful lot like the F-35 strike fighter produced by the US? And that the release was a short time after the release of the F-35.. which took decades to design?

Re:Isn't it interesting...

[Anonymous Coward]

fighter introduced by China looks an awful lot like the F-35 strike fighter produced by the US?

Dude, it's the F-35. That was a cunning plot by the Yanks to saddle China with an overpriced, underperforming aircraft to remove any future threat from their airforce.

Re: Isn't it interesting...

[DMJC]

Nah not stealth, just the shitty vtol those idiot marines put in. Jack of all trades master of none and too many cooks make for a dud plane.

Flabbergasted

[Errol backfiring]

"We have stressed that cyber security needs to be based on mutual respect."

Call me a pragmatist, or just call me a web programmer, but for me security is based on a healthy distrust.

Re:Flabbergasted

[Coren22]

China controls this huge firewall on every connection to the greater internet. Anyone hacking from China by default has the blessings of the government, or the firewalls and people doing the monitoring would have put a stop to it.

Re:Flabbergasted

[_merlin]

Yeah, I'm sure the operators of the Great Firewall could identify sources of hacks and DDoS after the fact, but it's just not within the scope of their responsibilities. They're just there to enforce government policies that most of them don't even agree with, it's just a day job. They're not going to go out of their way to make China friendlier to the rest of the Internet.

VPN exit points in China are most useful for businesses outside China doing business with Chinese customers or suppliers. It lets you check what your web presence looks like from inside China. Many things that people take for granted don't work from inside China, e.g. lots of sites suck in JavaScript frameworks from Google APIs, but this doesn't work from China because Google APIs servers are blocked. You can test for these kinds of issues by browsing via the Chinese VPN exit point.

I'd say the Great Firewall does more now that it used to. A decade ago, there wasn't really a Great Firewall as such, and ISPs were responsible for blocking what the government told them to, so you got different behaviour on different ISPs. Some ISPs would redirect you to a "this is blocked" page, others would give "connection reset by peer", while still others would black-hole traffic. At least now the government deploys the filtering and sets the policies now, so you get consistent behaviour across ISPs.

Yeah, some hacking comes from China. Some of it is just botnets of pwned PCs that could be operated from anywhere. That part of it isn't any worse per capita than anywhere else in the world. The Chinese government probably has some offensive hacking capability, and I wouldn't want to be on the receiving end of it. It's probably used for very targeted attacks on high-value targets. But I don't think half the things blamed on China really come from China at all.

Re:Attacking the *Met* Office?

[fustakrakich]

Guess you didn't read the article. It can be a pathway to juicier targets. Also, China doesn't like seeing smog reports they can't censor.

Proof?

[Crowd Computing]

I keep reading news about Chinese state-sponsored network attacks. Is there actually independent, third-party, non-government proof about this? I can think of a scenario where the IPs all come from China but the attacker is from some place else. Wouldn't it be possible the IPs come from compromised computers? How do yu distinguish a state-sponsored attack from an attack by the Chinese equivalent of Anonymous?

Re:Proof?

[Anonymous Coward]

The people that track down these events are security researchers doing it for prestige and networking opportunities to land contracts.

Or just making shit up for publicity / covering up what a shit job was done securing it in the first place by blaming the China bogeyman.

Re:Chinese blamed for ...

[HiThere]

Yeah, you're right. But I tend to believe this claim anyway. Some of the things China is blamed for they actually do.

OTOH, it's not clear that this was an action by the Chinese government. (The summary didn't say that was even claimed.) And if it were, it's not clear that it would be the policy of the government rather than some loose cannon. (I assume they've got just as many as we do.)

The reported response, however, seems more PR than anything else. (Again, just based on the summary.) This shouldn't be surprising. I bet China's government is even more labyrinthine than ours.

obvious to anyone in the security field

[raymorris]

To anyone who does information security, the fact that the Chinese government has the world's largest offensive infosec program is as obvious as the fact that the sun shines during the day time. Most attacks come from China, from behind the great firewall, with a large percentage of sophisticated attacks coming from IPs allocated to the Chinese military.

One particular facility is especially notable, it is a Chinese military installation that is listed as secret - its purpose is not published, a huge amount of attacks come from this facility, and they hire comp sci graduates. Now either ALL the compsci grads have had all of their computers controlled by Russian hackers for years and admins at this secret military facility haven't noticed gigabits of attacks constantly coming out of the facility, or they are the ones initiating the attacks.

It is not at all unusual for US networks to block all access from some very large IP ranges from China because these IPs have been a major, major source of attacks for -years-.

Speaking of government sources, if you speak infornally to the government people tasked with defense of US networks, chat with them in the smoking area by the loading dock, you'll find they are very afraid of what China is doing; the US is far outmatched in this area.

If you compare the US Navy vs China it is clear the US capability is far superior. For infosec (or"cyber"), it's the same but in reverse. You don't need top-secret clearance to see that the US Navy is the world's largest by far and the Chinese cyber command is by the world's largest.

For all the crap the NSA is accused of...

[MikeRT]

"We have stressed that cyber security needs to be based on mutual respect. We believe it is not constructive to make groundless accusations or speculation."

Attacking public systems like this is not one of the things they're much known for doing or even aiding and abetting. One has to wonder what China would do if suddenly the NSA and GCHQ were to take the kid gloves off and do to Chinese industry and civilian agencies what they've been doing to ours.

The only real electronic escalation would be attack on critical systems aimed at killing people. Once Chinese state-backed hackers start doing that, it's only a matter of time before the federal government escalates it into a formal war. So the question is, what does it take to get "mutual respect."

Why a public facing network again and again?

[AHuxley]

Why would Australia put any interesting part of its Department of Defence on an open network facing system? If its so important dont connect it to the outside world...
Thats what vaults and air gapped networks are for. Then only cleared staff can use an internal network as to their security clearances.
All the out sourcing, public private partnerships, privitization just invited everybody on the world facing "internet" deeper into once very secure gov and mil networks.
If "critical information" is so very secret, keep it secret and dont allow to be stored, created, updated on open, public facing networks.
How about some real, working, in use Australian only developed encryption? So when the public facing networks have issues, the rest of the world gets nothing?
What is with nations around the world and their mil/gov that a generation of well paid gov/mil experts over the past decade cannot understand about the public internet and keeping a nations data secure?