Forgot your password?
typodupeerror
China Security Your Rights Online Politics

Chinese Hack New York Times 116

Posted by samzenpus
from the protect-ya-neck dept.
Rick Zeman writes "According to a headline article in the New York Times, they admit to being hacked by the Chinese, and covers the efforts of Mandiant to investigate, and then to eradicate their custom Advanced Persistent Threats (APT). This was alleged to be in reaction to an article which details the sleazy business dealings of the family of Wen Jiabao, China's newest Prime Minister. China's Ministry of National Defense said in denial, 'Chinese laws prohibit any action including hacking that damages Internet security.'" Update: 01/31 15:00 GMT by T : The Times used Symanetic's suite of malware protection software; Symantec has issued a statement that could be taken as slightly snippy about its role in (not) preventing the spyware from taking hold.
This discussion has been archived. No new comments can be posted.

Chinese Hack New York Times

Comments Filter:
  • Re:Must be bullshit (Score:5, Informative)

    by DaMattster (977781) on Thursday January 31, 2013 @09:43AM (#42749905)

    Everyone knows the hacking threat is made up by the US government, as I am continually reminded every time I try to talk about it.

    No, it's not bullshit. I don't know how you draw that conclusion. I look at my family business' firewall logs and see lots of intrusion attempts coming from Chinese IP addresses. It got so bad that I moved the company's website to a VPS and moved our mail server to a cloud-based solution. Now, we just block all foreign IP addresses at the firewall by default.

  • Re:Must be bullshit (Score:5, Informative)

    by andy1307 (656570) on Thursday January 31, 2013 @11:45AM (#42751029)

    I block the entire country of China.

    If you read the article, you'll notice that they used hacked machines at US universities as a jumping off point.

  • Re:it was windows (Score:2, Informative)

    by Anonymous Coward on Thursday January 31, 2013 @12:45PM (#42751841)

    The linked articles say no such thing. You need to read more critically. The BBC quoted a guy from Sophos, who wasn't involved in any way, making some general statements about Windows machines. It doesn't say anything about what OS was compromised in this attack.

    From your link : "Graham Cluley, senior technology consultant at security company Sophos, which often helps companies cope with intrusions by hackers, "

    Note that he's not directly related to this story in any way. They wanted a quote from a "computer security expert", they did not find someone with direct knowledge of or who was involved with this particular situation.

    From your link :"Mr Cluley speculated..."

    Which is another way of saying "a completely imaginary, but somewhat plausible scenario I just made up is..."

    It could have been Linux boxes compromised. It could have been BSD, A/S 400, SCO Unixware or BeOS for all the information in the articles about it. Or, yes, Windows, in fact, it's most likely it was. But we don't know, and there isn't any information in these articles to tell.

  • by SuricouRaven (1897204) on Thursday January 31, 2013 @01:04PM (#42752057)

    They are officially communist, but unlike the USSR they were able to acknowledge that communism isn't always the best solution to every problem and turn to market solutions when appropriate.

  • Re:the weak link(s) (Score:4, Informative)

    by Anonymous Coward on Thursday January 31, 2013 @01:05PM (#42752075)

    The article makes no mention of the operating system of the compromised computers. This would be like an article on safety faults in automobiles that did not mention the make and model. Can't we have better security reporting from the grey lady? There is mention of a "domain controller" that was compromised to obtain password hashes and that a rainbow table must have been used to crack passwords. Is there anyone who does not think that it was windows computers that were compromised? I can't help wondering if M$ and the NYT have some sort of agreement about how they report on computer security.

    The articles make it pretty clear that the vulnerabilities that were exploited was (A) social engineering and (B) excessive user privileges, not an OS or application flaw. It was nothing but a targeted email worm. This kind of thing could have easily been prevented on Windows with proper policies, and would have happened just as easily on a similarly (mis-)configured Mac or Linux machine.

    In other words, the weak link is what they always were: the users.

  • by Attila Dimedici (1036002) on Thursday January 31, 2013 @02:08PM (#42752929)
    Which tells you more about Ronald Reagan's willingness to listen to people who disagreed with him than it does about Krugman's expertise. If you look at what Krugman says about his time working in the Reagan Administration (as an adviser to an adviser) you discover that he claims that even then he thought the answer to problems was more government as opposed to Reagan who thought the cause of most problems was government..
  • Great NYT Article! (Score:5, Informative)

    by Midnight_Falcon (2432802) on Thursday January 31, 2013 @03:04PM (#42753573)
    Amidst all the discussion of the paywall and how long it took slashdot to post this, I think the real point here has been missed:
    The New York Times wrote a GREAT article disclosing in full, with technical detail, how they were compromised.

    Kudos to them for this in-depth transparency.

    The article described in detail how targeted malware attacks were brought against NYT employees. Those were launched from compromised university computers within the US. From there, the custom malware allowed them to hack a Windows AD Domain Controller, and obtain the NTLM hashes. They ran the NTLM hashes against a rainbow table and got 56 user passwords that they used for VPN access.

    From there, they were tracked by a security consulting company using an intrusion detection system. They employed a great strategy of not knee-jerk kicking the hackers out, but of watching their moves and determining the scope of compromise. They used forensics hard drive analysis to recover logs and figure out exactly what data was being accessed.

    Sounds like what I would do if I was called in for incident response. Except, NONE of my clients would ever allow a story of this detail to be published!!!

    Hats off to the NYT for this level of transparency.

Get hold of portable property. -- Charles Dickens, "Great Expectations"

Working...