Slashdot Mirror
Chinese Hackers Hit US Firms Linked To South China Sea Dispute (bloomberg.com)
Chinese hackers have launched a wave of attacks on mainly U.S. engineering and defense companies linked to the disputed South China Sea, the cybersecurity firm FireEye Inc. said. From a report: The suspected Chinese cyber-espionage group dubbed TEMP.Periscope appeared to be seeking information that would benefit the Chinese government, said FireEye, a U.S.-based provider network protection systems. The hackers have focused on U.S. maritime entities that were either linked to -- or have clients operating in -- the South China Sea, said Fred Plan, senior analyst at FireEye in Los Angeles.
"They are going after data that can be used strategically, so it is line with state espionage," said Plan, whose firm has tracked the group since 2013. "A private entity probably wouldn't benefit from the sort of data that is being stolen." The TEMP.Periscope hackers were seeking information in areas like radar range or how precisely a system in development could detect activity at sea, Plan said. The surge in attacks picked up pace last month and was ongoing.
"They are going after data that can be used strategically, so it is line with state espionage," said Plan, whose firm has tracked the group since 2013. "A private entity probably wouldn't benefit from the sort of data that is being stolen." The TEMP.Periscope hackers were seeking information in areas like radar range or how precisely a system in development could detect activity at sea, Plan said. The surge in attacks picked up pace last month and was ongoing.
News at 11
I get hit thousands of times a day from port scanners, http/SSH vulnerability probes daily from IP addresses all pointing back to China, Korea, the Middle East and Amazon.. You're just now noticing?
Harrison's Postulate - "For every action there is an equal and opposite criticism"
It ain't right and it ain't fair, but if you attract controversy you attract people who want to make your life difficult.
So Amazon, LLC is part of the Chinese hack?
Or are you talking Amazon Women who are attacking the US?
The latter may not be bad especially if there's an invasion and I'll be rounded up and executed by Snu Snu.
You allow Russia to hack you and don't retaliate, you can't really expect other people from not doing some consequence free hacking of their own.
ha ha ha.
You're funny.
How about going to Predict It and putting some money on it.
I love taking money from saps like you.
If you're scared of your govt then you need to further restrict its powers
Vote 3rd Party in 2016 and beyond
"They are going after data that can be used strategically, so it is line with state espionage..."
Keep the parts of your internal network that have "crown jewel level" information unreachable from the outside as much as possible.
If you have to allow data to be moved to the "outside world - for example, so a manager can compose an email that contains summaries of important information - do it in a way that is heavily controlled and audited and extremely difficult to "penetrate from the outside" without triggering alarms. Also do it in a way that limits the amount of data that can be stolen.
There are even ways of moving data between the "hardened" network to the "non-hardened" network using "to dumb to be used as a hacking tool" air-gap data storage devices. Pro-tip: USB devices are usually too smart unless steps are taken to "dumb down" the USB interfaces on the "hardened" machines to the point that they are seen as nothing more than data-storage device.
Air-gapping isn't always needed:
A firewall/security device that has a "skinny pipe" to the secure network a "skinny pipe" to the "less secure in-house network" and a third "skinny pipe" to one or more "firewall management workstations" can be enough, provided that firewall audits all traffic, raises alarms and/or cuts off/modifies traffic as needed, and otherwise does its job can be enough for most environments.
---
You can still do this even if you have a multi-site network, but it won't be cheap.
It will cost you, but you can contract with long-haul telcos to run data over a "virtual private" non-IP-based network that never touches the public Internet. You can then control access to that network by controlling physical access to the endpoints. It goes without saying that all of your traffic should be encrypted site-to-site if to endpoint-to-endpoint using a combination of proven, publicly known encryption algorithms and additional encryption layers that are known only in-house (security through obscurity is hardly ever sufficient, but it can make an adversary's life a bit more difficult), so that a compromised telco provider won't be able to ex filtrate data.
Couldn't something be done to choke off more suspicious incoming traffic? Or does it fan out to non-aligned proxy nations to be disguised and forwarded?
"Knowing everything doesn't help..."
Let's hire more women and minorities.
Wouldn't not hiring them mean leaving half of your potential workforce unused? Are you going to wait until another World War before sending the ladies to work?
“Common sense is not so common.” — Voltaire
Don't you mean mandawin?
It appear's Uncle Sam's recent willingness to drop trou and put his bum in the air for Putin has been noticed elsewhere.
So now China's trying it on.
I wonder who will be next to have a go. Pretty soon, US cyberspace is going to look like Gangbang Night at a Hell's Angels clubhouse.
I've calculated my velocity with such exquisite precision that I have no idea where I am.
Sophisticated attacks are masked as legitimate traffic. Deep packet inspection (DPI) screens are generally build using regular expressions, also known as signatures. Most vendors have those in open access. Knowing the regex it isn't hard to build an attack, that would avoid being detected this way.
Filtering out China's IPs won't work, just blocks noise from port scanners. Dedicated attackers will use hacked servers in US or other countries to proxy the attack, they go ten dollars per bunch in deep web.
> They just don't bother to monkey in our elections, because they're already winning either way.
Has anyone actually looked into that? They have an organization of paid online trolls and I have no idea why they wouldn't push China's view of things with respect to the US elections as they do on every other matter.
Deny ALL; Allow Whitelisted_IP might help some
Apocalypse Cancelled, Sorry, No Ticket Refunds
Had to block 2 more subnets today ... 80.211.128.0/18 out of Italy and 86.49.128.0/17 out of the Czech Republic.
Already block Chinese mainland the last 8 yrs, but they know how to use VPNs.
Thousands of attempts against ssh, email and web servers ain't fun.
Uhh, you do know that foreign hackers have been doing the same things for basically as long as there's been an internet, right?
Did you never wonder why people wanted to, say, block China from hitting their SSH ports?