Slashdot Mirror
Security Firms Say Chinese Hackers Behind US Ransomware Attacks (reuters.com)
An anonymous reader writes: According to four leading security firms, some of the recent ransomware attacks against U.S. companies have been performed by hacking groups working at the behest of China's government. From the report, "Security firms Attack Research, InGuardians and G-C Partners, said they had separately investigated three other similar ransomware attacks since December. Although they cannot be positive, the companies concluded that all were the work of a known advanced threat group from China."
>> ransomware attacks against U.S. companies
OK...so they get cash money for being a nuisance.
>> hacking groups working at the behest of China's government
But...it's for the communist Chinese government (the evil "ChiComs!!!"), because they what? Hate businesses? Need money? Isn't it more likely that ransom software that delivers money to specific criminals is being used by...mere criminals?
...How many of these "security research companies" are little more than one or two guys with a blog?
If you want news from today, you have to come back tomorrow.
Who benefits most from escalating cyberwarfare/diplomatic tensions in this area?
Most people don't understand how impossible attribution is in the case of cyber-warfare. It is trivial to include cultural references/grammar patterns from a foreign language in the code to indicate national affiliation(to say nothing of VPN/Tor exit node location).
The best you can hope for is to infiltrate the attacker PC with a RAT/keylogger and attempt to make conclusions about the nationality of the attacker, but this ignores the simplicity of getting a CIA/KGB/etc. spook to read the news in a foreign language under adopted/stolen ID.
One can invoke occam's razor and assume the puppet show is "totally legit" but this isn't the type of reasoning that should guide foreign policy. False flag attacks should be assumed in matters of international politics, and "follow the money" is usually the best method of understanding who is behind the specifics of the kabuki theater...
I've seen a 30x increase in emails with malicious payloads since the 1st. And that's after blackholes and the usual filtering.
These are messages that have been dropped for having known malware, or attachments that are blacklisted (Anything executable, many office file types, pass-worded zips, etc)
I'm pretty close to blacklisting zip files alltogether.
The poor cybersecurity stance of US firms puts information that is proprietary to their Chinese trading partners as risk, and thus affects the security of the Chinese state. But what can the Chinese government do about that? Call up the US government and say, "Make those clowns get their act together!"? The US government is paralyzed by even bigger clowns.
So what you do is pick out some of the worst offenders and shake them down. Not for so much money that they go out of business -- they are after al your trading partners -- but for enough that they decide to start running their businesses like grown-ups.
This has to be one of the most enlightened uses of realpolitik in modern history.
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
So 3 security firms told Reuters that this is the work of Chinese hackers, but for the past 2 years, all other cyber-security firms were saying that ransomware came from Russia. Nice job Reuters... now go back to politics and leave security news to the pros.
Reporting issues and facts is not hate.
I've seen some stupid AC shit. This one takes the cake. Who'll make your cheap underwear?
Over the last few years, there's been an absolute ton of progress made on the hacking side of things (especially cryptoware style viruses), and not really any meaningful defensive measures other than "block all attachments." Corporate AV only seems effective a few days after the virus launches, but that's way too slow.
For example, a client got hit with Feb 16th's locky virus, which managed to get past the firewall AV scanner (Fortigate), the mail server AV scanner (Sophos), the local workstation AV (TrendMicro), and Google's AV scanner (because the email in question was also forwarded to a google business account of mine). That's not very inspiring.
I'm not really seeing much of anything from the AV guys, other than their research results. I'm starting to run out of things I can lock down on the network, not to mention that's an inherently reactive strategy anyway. And I certainly can't wait around for the government to take China and Russia (and others) to task over it.
The aspect slashdot should have learned about was that any code from any ip could be another ip range and have a different nation as the origin.
All the classic code review shows is all the expected code fragments, ip ranges and time of day results found point back to "expected" nations and their mil and their govs.
The idea that smarter coders are just working for other efforts, mils and govs using this surge of reported activity as cover to mask their own efforts stiff seems to be unimaginable.
Generation of efforts like the Equation Group https://en.wikipedia.org/wiki/... efforts can come from any nation or working groups between govs.
Strange how the easy public reporting efforts seem to be focused on ransomware while a lot of nations contractors and mil, gov efforts just always slip past.
Domestic spying is now "Benign Information Gathering"
If you feel insecure because of your lock system, please feel free to call us and we will be there to help you feel secured. We render mobile locksmith services for Pacific Beach, Mission Beach and La Jolla efficiently and have gained people’s appreciation.
"... Although they cannot be positive, the companies concluded that all were the work of a known advanced threat group from China."
They can't be positive and concluded this? Where are the proofs?
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).