Slashdot Mirror
Security Firms Say Chinese Hackers Behind US Ransomware Attacks (reuters.com)
An anonymous reader writes: According to four leading security firms, some of the recent ransomware attacks against U.S. companies have been performed by hacking groups working at the behest of China's government. From the report, "Security firms Attack Research, InGuardians and G-C Partners, said they had separately investigated three other similar ransomware attacks since December. Although they cannot be positive, the companies concluded that all were the work of a known advanced threat group from China."
more shenanigans from the Yellow Peril.
Now that the Opera browser is being sold to a Chinese tech company with direct ties to the Chinese government, it's all falling apart...
>> ransomware attacks against U.S. companies
OK...so they get cash money for being a nuisance.
>> hacking groups working at the behest of China's government
But...it's for the communist Chinese government (the evil "ChiComs!!!"), because they what? Hate businesses? Need money? Isn't it more likely that ransom software that delivers money to specific criminals is being used by...mere criminals?
...How many of these "security research companies" are little more than one or two guys with a blog?
If you want news from today, you have to come back tomorrow.
Who benefits most from escalating cyberwarfare/diplomatic tensions in this area?
Most people don't understand how impossible attribution is in the case of cyber-warfare. It is trivial to include cultural references/grammar patterns from a foreign language in the code to indicate national affiliation(to say nothing of VPN/Tor exit node location).
The best you can hope for is to infiltrate the attacker PC with a RAT/keylogger and attempt to make conclusions about the nationality of the attacker, but this ignores the simplicity of getting a CIA/KGB/etc. spook to read the news in a foreign language under adopted/stolen ID.
One can invoke occam's razor and assume the puppet show is "totally legit" but this isn't the type of reasoning that should guide foreign policy. False flag attacks should be assumed in matters of international politics, and "follow the money" is usually the best method of understanding who is behind the specifics of the kabuki theater...
I've seen a 30x increase in emails with malicious payloads since the 1st. And that's after blackholes and the usual filtering.
These are messages that have been dropped for having known malware, or attachments that are blacklisted (Anything executable, many office file types, pass-worded zips, etc)
I'm pretty close to blacklisting zip files alltogether.
The poor cybersecurity stance of US firms puts information that is proprietary to their Chinese trading partners as risk, and thus affects the security of the Chinese state. But what can the Chinese government do about that? Call up the US government and say, "Make those clowns get their act together!"? The US government is paralyzed by even bigger clowns.
So what you do is pick out some of the worst offenders and shake them down. Not for so much money that they go out of business -- they are after al your trading partners -- but for enough that they decide to start running their businesses like grown-ups.
This has to be one of the most enlightened uses of realpolitik in modern history.
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
Do they NOT get enough money from us from buying everything they make??
So 3 security firms told Reuters that this is the work of Chinese hackers, but for the past 2 years, all other cyber-security firms were saying that ransomware came from Russia. Nice job Reuters... now go back to politics and leave security news to the pros.
Hate Chinese, Russian and former and current communists because they are trying to hack and steal technology.
Hate India and every other third world country because they are taking our jerbs with H1B.
Slashdot has turned into a Trumpesque hate fest lately.
I'm not saying that Chinese, Indians etc are not doing it but to label billions of people under a brush instead of specific violators and people is fostering hate.
Good enough for me! Nuke the Chinese!!!
Although they cannot be positive, the companies concluded
good enuff for me
even coming from the stupid propaganda machines in the west. The chinese government doesn't need petty cash from lowly ransom-ware attacks, and it would never lower itself to that level. But of course it's easy to get the average sheep angry and hateful towards the chinese by just posting stupid shit like this.
Over the last few years, there's been an absolute ton of progress made on the hacking side of things (especially cryptoware style viruses), and not really any meaningful defensive measures other than "block all attachments." Corporate AV only seems effective a few days after the virus launches, but that's way too slow.
For example, a client got hit with Feb 16th's locky virus, which managed to get past the firewall AV scanner (Fortigate), the mail server AV scanner (Sophos), the local workstation AV (TrendMicro), and Google's AV scanner (because the email in question was also forwarded to a google business account of mine). That's not very inspiring.
I'm not really seeing much of anything from the AV guys, other than their research results. I'm starting to run out of things I can lock down on the network, not to mention that's an inherently reactive strategy anyway. And I certainly can't wait around for the government to take China and Russia (and others) to task over it.
Nobody is actually paying attention
If you feel insecure because of your lock system, please feel free to call us and we will be there to help you feel secured. We render mobile locksmith services for Pacific Beach, Mission Beach and La Jolla efficiently and have gained people’s appreciation.
"... Although they cannot be positive, the companies concluded that all were the work of a known advanced threat group from China."
They can't be positive and concluded this? Where are the proofs?
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).