Does China's Cyber Offense Obscure Woeful Defense? 132
Gunkerty Jeb writes "The official line in Washington D.C. is that there's a new Cold War brewing, with an ascendant China in the place of the old Soviet Union, and cyberspace as the new theater of war. But work done by an independent security researcher suggests that the Chinese government is woefully unprepared to fend off cyber attacks on its own infrastructure."
Cyber war (Score:1, Offtopic)
Re: (Score:2)
So what you mean roundeye, pirated XP machines no good security?
Yu Dum.
Re: (Score:1)
On that topic, I ran a vanilla XP (no service packs) until 2008. Zero virii.
Firewall + anti-virus + only 3 users, all of whom weren't computer illiterate.
Often it's not the OS, it's the users or admin. That said, on an office machine, updates would be pretty much mandatory. But then, with huge amount of machines, wouldn't it be more sensible for China to fork their own linux distro for government usage?
Re: (Score:2)
On that topic, I ran a vanilla XP (no service packs) until 2008. Zero virii.
I'm sorry, I not familiar with these hard english words like that. What is a "virii"? It isn't anything that I've ever heard of before.
Back on topic, did that computer get any viruses?
Re: (Score:2)
Hence, firewall that stealths all ports and doesn't allow any software you haven't specifically OK'd out.
Re: (Score:2)
Step one: do not use IE for anything other then company/personal intranet. Block it on software firewall level from accessing anything else.
Step two: Install firefox.
Step three: Install the following add-ons: Adblock+, noscript. Properly white-list things you need.
Step four: Sandbox your browser if paranoid (sandboxie etc).
Step five: Avoid visiting shoddy sites.
You can never make a possibility of infection zero without rendering your machine completely autistic, just as you cannot totally nullify a risk of
And this is why... (Score:1)
...the US government is keeping mostly mum about the threats coming over from China. That and they want to keep getting their money.
Re:And this is why... (Score:5, Insightful)
What the 6% of our debt they own?
About the same amount the Japanese own.
Where does this "The Chinese own the US" myth come from?
Re:And this is why... (Score:5, Insightful)
From the interpretation that sensationalist news services give to the words of scaremonger politicians.
Re: (Score:3)
And if people stopped being scared for a moment and thought (which they won't), they'd realize exactly who has whom by the proverbial short hairs on the debt issue. China doesn't want to undermine our ability to pay, say by totally cutting off cash to fund our *deficit* (a different but obviously related issue). They can turn down the cash spigot and make us hurt, but not *too* much, and it'd probably be for our own long term good.
Re: (Score:1)
Re: (Score:1)
Re: (Score:3)
It might be the rate at which they're acquiring our debts.
Re: (Score:3)
http://en.wikipedia.org/wiki/United_States_public_debt#Foreign_ownership [wikipedia.org]
Is a good starting point. Basically 25% of our debt is in foreign hands, 23% of that the Chinese own. This means they own about 6% of the total US federal debt.
Re: (Score:2)
Anonymous coward with a "fact" and no source.
Quick someone needs to mod this guy informative.
Sure about that? (Score:1)
Basically 25% of our debt is in foreign hands, 23% of that the Chinese own. This means they own about 6% of the total US federal debt.
Err..
Re: (Score:2)
I honestly had not seen that addition.
I only knew the 2007 numbers.
Re: (Score:1)
Funny. I looked at the same article.
1,160.1, estimated, as of December 2010.
The debt end 2010 was listed as 13,529.
Divide one into the other and you get 8.6%
A bit larger than 6%.
Re: (Score:2)
Seems to be correct sir.
Of course if you don't want higher taxes on the wealthy this is the price you pay. Either we tax them or we devalue the currency, when they are the ones making the campaign contributions this is what you see.
Re: (Score:2)
Re: (Score:2)
Where does this "The Chinese own the US" myth come from?
From the same place that "The Japanese own the US" myth came from in the 80's... Ironically the British owned the most US assets followed by the Dutch then the Japanese in the 80's... I have no idea who owns what in what capacity these days.
Re: (Score:3, Informative)
http://www.treasury.gov/resource-center/data-chart-center/tic/Documents/mfh.txt
I'd say the amount china owns is substantial. I'm against sensationalism as much as the next guy but a trillion dollars held by a foreign country is a shitload no matter how you slice it. Sure Japan has over 75% as much as china but there is a HUGE drop off after that. If we're going to say Japan owns almost as much as China to downplay foreign debt, we should also say Japan and China hold almost as much US debt as
Re: (Score:1)
Re: (Score:1)
Re: (Score:1)
Re:And this is why... (Score:4, Insightful)
Well, they own all your factories.
Re: (Score:1)
Re: (Score:2)
Probably from their currency manipulation schemes that lower the value of their currency (and, in turn, lower the cost to buy their goods). That scheme subsidizes Americans more than any debt ownership. Still, we're mutually dependent, I'm not worried about them.
Re: (Score:2)
Probably from their currency manipulation schemes that lower the value of their currency (and, in turn, lower the cost to buy their goods). That scheme subsidizes Americans more than any debt ownership. Still, we're mutually dependent, I'm not worried about them.
While China does something to work itself out [indiatimes.com] from the "mutual dependency" with US, what is US doing (or even able to do)?
Re: (Score:1)
I don't know about your numbers, but I do know that there is beginning to be a ... well what appears to be a planned and deliberate media attack against China. Yes I know China appears scary because they have grabbed so much power so quickly and they really do not have the finesse to know how to use it, work with it or manage it effectively, but they are in an accrual phase anyway.
Case 1 for me was the frenzy last weekend about the "Chinese church stopped from having Easter services". This was sheer BS. The
Re: (Score:2)
Re: (Score:2)
I disagree about it being US propaganda, because the US can royally lose and lose big in a pissing contest these days. China can do three things in less than 24 hours to royally fsck the US and her economy:
1: Allow the yuan to trade freely.
2: Push for a "currency basket", or have oil be traded by the yuan.
3: Start arming countries or factions that don't like the US. For example, if the Taliban started getting access to UCAVs from a mysterious source. Or Ahmadinejad showing off his new technology of ICB
Re: (Score:3)
And price Chinese manufactured goods out of reach? Yeah, that would fsck the US economy. It would fsck the Chinese economy a whole lot more.
#1 is a precondition to this.
Re: (Score:2)
Been there and done that, during the Cold War. That wouldn't royally fsck the US economy by any means.
Last time, the US was very successful at it. For every dollar the US spent in Afghanistan, the Russians needed to spend a hundred dollars. A stinger missile is a lot cheaper than a helicopter. The massive overexpenditure on the military is usually held up as one of the main reasons for the fall of the USSR. The Star Wars program also helped this - it didn't work as a defence shield, but the Soviets thought it did, so they thought that they needed ten times as many ICBMs to ensure that enough got through
Re: (Score:2)
The Chinese can't allow the yuan to trade freely. Their economy is heavily dependent upon exports, if they were to allow the yuan to strengthen they'd have to completely redo their economic policy, hence why they refuse to do it. Remember that even with the growth of their economy, they still don't have enough to go around, and that's assuming that they allowed the rural workers to get a piece of it.
Re: (Score:2)
China is no longer a communist nation, it is a corporate fascist nation. An autocracy largely run for the benefit and ego of those at the top.
They intrinsically will do nothing that threatens the power and wealth of those at the top. Of course those at the top will use the power of the Government of China for their personal advantage mainly locally but also more internationally in the future.
Corporate wars are very likely to have a made in China origin. Executive corruption, blackmail and even eliminat
Re: (Score:2)
Really? (Score:2)
The official line in Washington D.C. is that there's a new Cold War brewing
Since when?
Revised story (Score:5, Funny)
The official line in Washington D.C. is that there's a new Cold War brewing
The official line from Fox News is that there's a new Cold War brewing
Re: (Score:1)
Yeah, but it's the fox news office with the white house in the background.
Re: (Score:2)
The official line from Fox News is that there's a new Cold War brewing
The official line from Fox is we have always had a cold war with Eastasia.
Re: (Score:1)
The official line in Washington D.C. is that there's a new Cold War brewing
Citation needed. Oh wait. It's in the summary. You can make up whatever bullsh#t you like. Nevermind.
Retaliation? (Score:2)
Re:Retaliation? (Score:5, Interesting)
TFA answers your question:
A lot of what is running in China is developed in-house by Chinese firms. They're not using Western products or open source platforms, because they don't trust them or they're worried that someone might put a back door into them.
So they are rebuilding from the ground up without taking advice from other people who have tried it. Eliminates back doors (unless your own coders are putting them in) but it seems the front door is wide open...
Re:Retaliation? (Score:4, Insightful)
I wonder why China never thought of securing their systems more tightly. Surely they must have realized that retaliation would come their way at some point, no? I mean, aside from the fact secure systems are usually preferably to ones that are not...
Quite so. It is also worth noting that we have never actually seen anything that looks like evidence for the Chinese state organising "cyberattacks" on the US - all we have to go on is allegations spread on places like /. in the form of rumours.
Can it really have escaped anybody's attention that it is extremely easy to spread false rumours, especially on the internet, and it is extremely easy to spoof the origins of any attack?
And how can anybody credit a tall tale about some anonymous source "knowing" that some "Chinese secret service" is orchestrating hacker attacks? It that really all that likely - a guy sits in his parents' garage and just knows this? What happened to simple, common sense and critical thinking? I mean, with Wikileaks you have documents - mr Assange doesn't go around saying "somebody told me ...", does he?
Until this kind of accusations are accompanied by sound references, I can't regard it as more than an attempt to poison the well.
Re: (Score:2)
Re: (Score:2)
It is also worth noting that we have never actually seen anything that looks like evidence for the Chinese state organising "cyberattacks"
Of course not. It could just be a total coincidence that all the top known Chinese hackers just happen to be employed by the government [thedarkvisitor.com] in some capacity.
Re: (Score:1)
Re: (Score:2)
When you have enough indications that a thing is happening, that thing eventually becomes the sensible assumption, and the burden of proof switches to those who want to deny it.
The danger of this view, as I am sure you realise, is that it is so easy to whip up a lot of "indications" without ever saying anything explicitly. And there is no lack of groups and individuals who for whatever reason see their advantage in doing so.
It is the same in every country - America have a large number of 'patriots' who play with vigilante activism, and there is no reason to think that China doesn't have its share of morons too. You know how easy it is to organise cyber attacks, and it is only a sh
Re: (Score:3)
I wonder why China never thought of securing their systems more tightly. Surely they must have realized that retaliation would come their way at some point, no? I mean, aside from the fact secure systems are usually preferably to ones that are not...
That might be related to their lack of confidence in their enemies' ability to attack. Alternatively, they might be considering it like nuclear warfare, in that there's no way to do a perfect job, so the threat of retaliation is more potent. Therefore, they're focusing all resources on aggression.
Additionally, everything is built in-house (for a very large "house"), so they have some security-through-obscurity for the items that aren't just forked F/OSS projects. If I were them, I'd lull other nations
Re: (Score:3)
More tightly than what? The article says the US is as bad or worse. There are no large, well-secured networks. It has never been demonstrated that it is even remotely feasible to do such a thing. Day after day we see these articles about security issues, and eveybody saying, "how could this happen?" as if vulnerabilities were avoidable and abnormal, in the absence of any evidence that this is the case.
Re: (Score:3)
There are no large, well-secured networks.
Actually we have multiple large VERY well secured networks. The drawback is that they're only used by government agencies for transmission of classified data and not by our general infrastructure/industry. To my knowledge those have never been victim to attack except by insiders. It would be nice if we had kind of a "yellow" network in between the "green wild west level and "red" classified networks for use on power grids and the like.
Lessons from football (Score:2)
"Best defense is a good offense"
If you can attack them quick and well enough, they won't have any non compromised systems left to come back at you. :)
Re: (Score:2)
But "Defense wins Championships."
Re: (Score:2)
Yeah well, but the Referee System seems to have been compromised... :P
Re: (Score:2)
I vaguely remember a super bowl from the early 2000's where the Baltimore Ravens defense pretty much -was- the game. They did their job and the offense's job and won the Superbowl all by themselves.
Wikipedia says it was superbowl XXXV, and Ray Lewis (a linebacker!) was named superbowl MVP, if you want an idea just how dominate that D was. All 16 of the Giants possessions ended with punts or interceptions.
Re: (Score:2)
spend some time with one of the head coach games. You can get head coach 09 used for like $5 now, and it's a tremendous game. it will tickle all your favorite nerd micromanagement strategy places, while simultaneously giving you an appreciation for football.
Re: (Score:2)
Re: (Score:2)
Don't be too sure (Score:1)
and then the us can bill china 1B for his death (Score:2)
and then the usa can bill china 1B for his death.
Re: (Score:1)
I miss the cold war (Score:2)
Re: (Score:3)
Re: (Score:2)
Re: (Score:2)
"everything on the server was running as root" (Score:2)
Another example is China's National University of Defense Technology. They had a bunch of Web servers that weren't using SSL or HTTPS
This is basic stuff...good lord are they bad.
I'd estimate that 40% of logins are user name and either all numerical or all lowercase passwords. There are no hash or space characters.
I'm just going to stop here.
MicroSoft Security is US gift to the world (Score:4, Interesting)
Re:MicroSoft Security ?? is US gift = poison (Score:2)
and it got only one Trojan within one year of operation
in contrast to a European and US version!
Re:MicroSoft Security?? is US gift = poison (Score:2)
-
It caught 1 Trojan over three years of operation
in contrast to a European and a US copy of XP
Re: (Score:2)
Premise: Trojans try to make themselves really obvious so I can easily spot them and remove them.
Observation: I've never noticed a trojan in my system.
Conclusion: I've never had a trojan in my system.
Re: (Score:2)
Stuxnet included !
China doesn't need as much defense as the West... (Score:1)
This sounds crazy, but why does China need to put effort into as much defense as other places?
If one thinks about it, they really don't have much to lose, compared to American or European businesses. Militarily, China may have trade rivals, but no true enemies. They have no terrorist groups wanting to level Shanghai, there is no such thing as an Al-Qaeda like threat to the PRC in any shape or form.
Because China really has no world enemies, combined with the fact that their IP is already known to others, a
Re: (Score:3)
They have no terrorist groups wanting to level Shanghai, there is no such thing as an Al-Qaeda like threat to the PRC in any shape or form.
The Uyghurs are trying. They aren't half the threat that the PRC makes them out to be (the same could be said for Al-Qaeda), but they are still a threat and they still do blow stuff up and kill people.
Re: (Score:1)
"The Uyghurs" are trying? As an entire race? Really?
If anyone here says something along the lines of "the Muslims are trying to level NYC" they'd be buried. Rightfully.
The feeling is mutual (Score:1)
well, noone is really prepared (Score:2)
"the Chinese government is woefully unprepared to fend off cyber attacks on its own infrastructure."
I don't think anyone is, or even can be, prepared to fend off large-scale "cyber attacks".
If there's one thing that you can rely on, its that big organizations are always several years behind on implementing new technology in a large scale. Sure, the NSA etc might be doing cutting edge security research and stuff, but how long does it take to get defences against new attacks actually implemented across the re
Re: (Score:2)
Yep - physical isolation. That's what has protected the Iranian nuclear program's computer so thoroughly :)
Re: (Score:1)
Just imagine what would have happened if those machines had had direct internet access....
Meaningful security does not imply complete security. The fact that the machines were depending solely on the airgap (which was bridged by unsecured USB keys) for security wasn't all that good either. They needed ACLs and a locked down system at minimum.
Rosetta Stone? (Score:1)
China CERT? (Score:1)
USA Infrastructure (Score:1)
I'd be interested to see how well prepared our (USA) infrastructure is.
Let me guess...
Re: (Score:2)
In truth I doubt either government is prepared (Score:2)
It has already started (Score:2)
It's a trap! (Score:2)
There firewall is fully operational!
Re: (Score:2)
Good. (Score:1)
I was at Google when the Chinese attacked, and I felt personally violated. I would be more than happy to see the favor returned.
And anyone who doesn't think it was actually the Chinese intelligence agency that mounted that attack against Google is a victim of wishful thinking.
Propaganda News Reporting? (Score:1)
Re: (Score:2)
The cyberwar hype exists to sell juicy defense contracts to supply snake oil. That's it. That's the whole "threat".
Story avoids saying the bloody obvious (Score:2)
That there is not and never has been a credible threat from China on this. That the entire purpose of the cyberwar hype is to generate juicy defense contracts selling snake oil to the government. Your taxes at work.
Maybe (Score:2)
I don't think there's been much discussion of China's vulnerability, mainly because their society seems so much less DEPENDENT on tech than the West (particularly the US).
To pick a superficial example:
- person A has a top of the line firewall, and orders all their groceries online every other day
- person B has a garden and farm animals.
Clearly, person A has far better 'defenses' than person B, but who's really more vulnerable.