Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!


Forgot your password?
China Government Security United States

U.S. Calls On China To End Hacking; Start Cyberspace Dialogue 160

New submitter trickymyth writes "For the first time, the United States has mentioned the People's Republic of China in relation to cyber crime, officially acknowledging what has been long suspected by private security experts and the U.S. business community. The Obama Administration seeks to get the Chinese government to acknowledge the problem, to cease any state-sponsored hacker activity, and to start a dialogue on normative behavior on the internet. This announcement follows the recent 60-page report from the American cybersecurity firm Mandiant, who spent two years compiling evidence against the so-called 'Comment Crew.' They traced IP addresses, common behavior, and tools to track the group's activity, which led to a Shanghai neighborhood home to the People's Liberation Army (PLA's) Unit 61398. This tracking came at the behest of the Times, who has experienced some trouble with hacking in the past. The Chinese government rejected the report as 'unprofessional' and 'lacking technical evidence.' This announcement also comes amid a delicate leadership transition in China and numerous new reports on the vulnerability of U.S. business and government networks to attack."
This discussion has been archived. No new comments can be posted.

U.S. Calls On China To End Hacking; Start Cyberspace Dialogue

Comments Filter:
  • by Anonymous Coward

    This is the same country they has a national firewall infrastructure to use against its own citzens. I'm sure their morals will guide them right when it comes to using hacking as a weapon of war.

  • Good Luck With That (Score:5, Interesting)

    by Farmer Pete ( 1350093 ) on Tuesday March 12, 2013 @03:23PM (#43151845)
    I hope this ends well, but I have a feeling that either nothing will come out of this, or the Chinese will ramp up efforts since they don't have to worry about hiding their efforts.
    • by Synerg1y ( 2169962 ) on Tuesday March 12, 2013 @03:31PM (#43151925)

      Cyber war = rise of the nerds?

      • by K. S. Kyosuke ( 729550 ) on Tuesday March 12, 2013 @03:41PM (#43152011)

        Cyber war = rise of the nerds?

        In case of Chinese government-fed hackers, it's rice of the nerds.

      • by Anonymous Coward

        If that's the case were toast. They have more nerds, government support, training and no fear of legal consequences on their side. We have a bunch of lone wolf types with very little training, government condemnation, legal threats ever looming and no peer support. Point being there is very little in the way of approved security training / college level beyond the week long class type from SANS. We really don't have anything at the scale needed to compete at any level and that is why we are routinely owned.

        • by richlv ( 778496 )

          If that's the case were toast.

          if it's the same level of spelling in the code, "your toast" indeed :>

        • And more rice... we shall counter with Starbucks and McDonalds... they'll be too fat and over-caffeinated to counter. Or we could just send Dennis Rodman.

    • by Anonymous Coward

      Well, China did respond angrily when some US hacker resources were pointed at finding out where all the Chinese hacking was done from. That was a sort of subtle 'we know where you live' message to those actually doing the spying for China.
      Depending on how the diplomats take the message, this declaration is either an admission of failure (not likely considerring the prior story), a meeting of equals, or a mild threat with the implication that US hackers could do a whole lot worse than just tracking the atta

  • We can not allow a cyberspace gap!
  • by Anonymous Coward

    the desire to ship a product to maximize revenue rather than quality is the objective of many companies. The license agreements are better coded than most software.

  • by A nonymous Coward ( 7548 ) on Tuesday March 12, 2013 @03:30PM (#43151911)

    It's ok for the US but no one else?

    Guess some left hand isn't talking to the right hand.

    • by 0123456 ( 636235 )

      More like someone just realised that America is about 3,000,000% more vulnerable to such attacks than Iran or North Korea.

    • by Anonymous Coward

      Let's see...
      Hacking military installation to stop uranium enrichment beyond what is necessary for commercial power generation
      Hacking civilian companies to uncover the Chinese person/persons who leaked info on Wen Jiabao family's fortune in order to intimidate/punish them.

      And in your mind these are equivalent?

    • Yes (Score:1, Insightful)

      Call me hypocritical, but preventing Iran from having a nuclear bomb for the safety of the middle eastern region (and global security) is definitely worthwhile.

      What is the purpose of China's hacks? Mostly economical, not exactly an apples to apples comparison here.
      • The Middle East itself disagrees with you.

        • No, only Iran disagrees, plus maybe Iraq, Syria, Lebanon, the PLA. That are the only allies it has in the ME, and even those countries might not like a too powerful neighbour.
      • Re:Yes (Score:5, Insightful)

        by Uberbah ( 647458 ) on Tuesday March 12, 2013 @08:12PM (#43154657)

        Call me hypocritical

        Okay. You're a hypocrite.

        but preventing Iran from having a nuclear bomb

        Iran has no nuclear weapons program.

        for the safety of the middle eastern region (and global security) is definitely worthwhile.

        So when are you going to invade Israel to dispossess them of their ~200 nuclear weapons?

        U.S. and Israeli bitching about Iran is like Biff Tannen bitching that Stephen Hawking has made a retaliatory threat to run over Biff's toes with a wheelchair if Biff attacks him first.

    • by gmuslera ( 3436 )
      Is nice to throw the first stone and then complain if someone else want to play that game too.
  • by Anonymous Coward on Tuesday March 12, 2013 @03:34PM (#43151955)

    Silly Times, if you are scared of the Chinese hackers, you can just insert this code at the top of your site:

    < h1 > tiananmen square < /h1 >

  • It will fade away (Score:5, Interesting)

    by Spy Handler ( 822350 ) on Tuesday March 12, 2013 @03:40PM (#43152005) Homepage Journal

    China is about to have an epic crash when their real estate bubble bursts:

    60 minutes on China Real Estate Bubble [cbsnews.com]

    When that happens, their economy will tank... similar to what happened in U.S. in 2008. And that will bring out people demonstrating in the streets. The Chinese security apparatus will have its hands full trying to stifle online dissent and stop people from plotting against the government. Cyber attacks on external targets will fade.

    • by Anonymous Coward

      That logic assumes the Chinese government won't blame "foreign interference" for each and every possible thing that goes wrong, and attempt to fool the population into thinking it's "them, not us" that is the problem. This is one of the favorite excuses of an authoritarian government when things go wrong.

    • Re:It will fade away (Score:5, Interesting)

      by ljw1004 ( 764174 ) on Tuesday March 12, 2013 @04:58PM (#43152871)

      China is about to have an epic crash when their real estate bubble bursts

      A different view, published a week after your CBSNews report:
      http://www.forbes.com/sites/kenrapoza/2013/03/11/chinas-non-bubble-housing-bubble/ [forbes.com]

      "By comparison, China’s housing bubble is a non-bubble... There’s also nothing close to a mortgage backed securities bubble and no sub-prime lending...'You don’t see the same amount of bank stress that you see in the U.S. because the debt levels are significantly lower, both for the builders and for the buyers'."

      • by Spy Handler ( 822350 ) on Tuesday March 12, 2013 @05:31PM (#43153301) Homepage Journal

        that's true, China doesn't have the mortgage-backed securities and subprime lending we saw in the U.S.

        But while those things certainly help fan a bubble, you can still have a bubble without them. There was no subprime lending or Tulip-backed securities, yet the Tulip bubble still took place.

        • The bubble won't pop unless we have a global currency war in which all major nations start to purposefully devalue their own currency in order to bolster exportation of goods and services. China has publicly stated they are ready for this "war" (financial, not militarily...though could lead to that...) with Japan and the US egging them on. And to be fair, it's the Chinese partially to blame for keeping their on currency under valued in fact. Hypocritical of course.

          Basically, cities like Shanghai will only i

        • by AmiMoJo ( 196126 ) *

          China's leaders have been very careful to avoid a bubble after seeing what happened in other east Asian countries that the US heavily invested in. That is why China lent the US so much money - it gives them control they can use to prevent the US doing it again. Obviously they wont do it themselves.

    • You're whistling in the dark.

      I for one hate to see Americans including the US Govt being so
      dumbassed obviously anal towards the Chinese.
      They, Americans, used to be smart, across the board.

      Better shape up. China will bury you. Do you even know how many
      there are to 1 US [delusioned, fatigued -- like you] citizen?

      • by Anonymous Coward

        You're whistling in the dark.

        I for one hate to see Americans including the US Govt being so
        dumbassed obviously anal towards the Chinese.
        They, Americans, used to be smart, across the board.

        Better shape up. China will bury you. Do you even know how many
        there are to 1 US [delusioned, fatigued -- like you] citizen?

        As an American, I wanted to respond, but ran out of breath typing this...

  • I believe we possess all the resources and talents necessary. But the facts of the matter are that we have never made the national decisions or marshaled the national resources required for such leadership. We have never specified long-range goals on an urgent time schedule, or managed our resources and our time so as to insure their fulfillment. JFK 1961 ppl who who don't know history are doomed to repeat it
  • You know, the US could just turn off their overseas Internet connectivity and isolate itself. Or you know, be part of the international community and accept they are no more special than any other netizen with attempted hacks on their IP addresses.

    • by sjames ( 1099 )

      Or just cut links to China and keep talking to the rest of the world.

      • Or just cut links to China and keep talking to the rest of the world.

        But then how would Wal-mart get their orders filled?

        • by sjames ( 1099 )

          Build a factory in some other 3rd world hellhole and exploit those people for a while, of course.

      • by gtall ( 79522 )

        Wow, you really don't get the internet, do you?

        • by sjames ( 1099 )

          Sure I do. I'm not the one who thinks it runs on spooky action at a distance. Block the routes to China at the routers and as far as the U.S. internet is concerned, there is no China.

          That still leaves the possibility of hacking themselves a proxy in some other country, but it greatly increases the chances that a U.S. inquiry would get it shut down.

    • by invid ( 163714 )
      The internet, just by being the internet, is far more damaging to China than Chinese hackers are to the Unites States.
      • Except that there is nothing worth stealing from china....

        (I am referring to electronic goods/documents, not rare-earth materials which cannot be downloaded over the internet)
    • Blocking overseas network traffic will just mean that the hackers will start using US based places to start hacking from. Just blocking China won't work since the hackers almost exclusively use intermediate (hacked) computers that are not in China to do their stuff from. The fact that China isn't really hiding their economic hacking doesn't mean that other countries aren't doing just that as well. Don't forget that commerce and government are more or less the same in "communist" China. This is nothing but i
  • by rhysweatherley ( 193588 ) on Tuesday March 12, 2013 @04:08PM (#43152291)
    Any headline where the US is demanding that some other country stop doing something can be simply answered with "You First Sparky!".
  • How could any government control the actions of 1 billion people....oh wait a minute.

  • by jfengel ( 409917 ) on Tuesday March 12, 2013 @04:17PM (#43152383) Homepage Journal

    Seems to me that this is like asking for a truce when we're losing. They've got no reason to say yes.

    Fortunately, this isn't a battle we have to lose. Yeah, I think we have to admit that every grandma-box running Windows 98 is going to be a spam-spewing zombie for the foreseeable future, but the corporations that make the juiciest targets should also be capable of at least some self-defense. If thy IP block offends thee, cut it off. Social engineering is always going to trump user education, but we can at least make it an arms race.

    At least it's not nukes, which are harder to walk away from. That means we also don't have Mutually Assured Destruction. They're going to do it even if they sign a treaty saying that they won't, so we're going to have to hunker down and deal. Asking them to call it a draw isn't going to get us anywhere.

    • by lennier ( 44736 )

      but the corporations that make the juiciest targets should also be capable of at least some self-defense.

      You might think that, but apparently no. For example, here's this January 2013 report from the Defense Science Board [osd.mil], which I'm surprised hasn't made it to Slashdot yet. It's very sad and sobering reading.

      After several months of researching best practices of cyber metrics in commercial, academia and government spaces, the Task Force determined that no metrics are currently available to directly determine or predict the cyber security or resilience of a given system. .... Even knowing if a system is compromised is very difficult. ...
      In the process of conducting this study, it became apparent that the full spectrum cyber threat represented by a Tier V-VI capability is of such magnitude and sophistication that it could not be defended against. ...
      Organizations in the Department today, however, do not generally share details about cyber attacks that have compromised their systems. Instead, system compromises are often classified, keeping people in the dark who must be aware so they can anticipate similar attacks. Consequently, DoD organizations are trying to field defenses based only on partial knowledge of what kind of vulnerabilities are being exploited. ...
      For more than 15 years, the Department has invested significant resources (people and funding) in an effort to prevent, detect and respond to a full range of cyber threats. ... Strong authentication based on the Common Access Card (CAC) and Public Key Infrastructure (PKI) capabilities and other Defense in Depth mechanisms added to the overall “assurance” of the networks. Then, based on a significant infection of the Unclassified but Sensitive Internet Protocol (IP) Router Network (NIPRNet) and the Secret Internet Protocol Router Network (SIPRNet) in 2008, deployment of additional technologies, e.g., Host Based Security System (HBSS) and other hardening and situational awareness tools were accelerated.

      While well-intentioned and strongly supported, these and subsequent initiatives have not had the desired impact on the overall IA posture of the Department. Defensive measures implemented at the boundaries between the NIPRNet and the Internet proved to be only marginally effective in blocking successful intrusions or reducing the overall attack surface of DoD networks and systems. Mobile platforms (smart phones, tablets, etc.) exacerbate this already challenging problem. Red teams, conducting operations during military exercises or at the request of Military Department and Agency officials, continue to have a nearly perfect success rate breaking into the systems.

      Within classified networks, once thought to be safe for military command and control traffic, our adversary has successfully penetrated vulnerabilities created by poor user practices and a lack of discipline at all levels of the command structure. Operation BUCKSHOT YANKEE was clearly a wake-up call, suggesting that every system relied on for the conduct of war fighting operations is at risk of exploitation by an increasingly sophisticated adversary; an adversary ready and able to exploit any technical or human weakness to achieve their objectives.

      Emphasis mine, but this is scary stuff. Even the classified US military IP networks have lousy security and have been infected by viruses.

      I've never seen this announced before, but it's basically game over for network defense. The DoD can't keep their boxes patched. That's why they're talking about offensi

  • Looks like governments start noticing that 'the terrorists' are no longer an effective bogeyman and need to conjure up a new one.
  • All the US needs to do, is sit back and wait for these Chinese hackers to download too much copyrighted material. Just wait, it'll happen soon enough. Then their ISP will cut down China's bandwidth to like, really really slow. They won't be able to really get any hacking done then.
  • "You first, fuckers!"

    I think we can all see where this is headed...

    Wouldn't you prefer a nice game of chess?

  • by lexsird ( 1208192 ) on Tuesday March 12, 2013 @05:06PM (#43152975)

    China has been hacking US gamers for years. I get notifications from Guild Wars 2 that someone in China tried to access my account, please change my password. Welcome to the world wide web, Mr President and Congress, we need smarter policies, not more neolithic special interests pandering bullshit. Set up a firewall that you can monitor the hits on it, you will find that China is a beehive of hacker activity.

    We do have people highly qualified and capable of not only securing our country's systems, but being our scalpel as well. Let's not panic for fuck's sake.

  • That's what the US State Dept is crying over in Beijing right now.

  • The Obama administration really needs to learn some tact. Did they really need to launch this initiative RIGHT now? Could it not have waited 6 months since it has taken them 2+ years so far to gather the evidence? The Chinese government has always used the "it wasn't me" and "As I told you, it would be absolutely, totally, and in all other ways inconceivable" arguments. All this will do is raise their hackles while we deal with a true international crisis that we need and have finally started getting Ch

  • Issue sanctions? Stop it, it hurts to laugh.

  • 1. Some company gets hacked
    2. Some security company (Mandiant) investigates and makes a non-peer-reviewed report (PDF) with very thin evidence that jumps to conclusions [mandiant.com]
    3. Sensational press repeats claims from report without investigating
    4. Government uses "evidence" of what now seems a big problem and a certain source to start a war
    5. Profit...

    I'd like some smart Slashdot reader to read the report and tell us what you think. It contains a lot of random facts and then draws some very unscientific conclusions

  • China owns the US
    China owns networks in the US
    China has complete visibility of everything that happens in the US

    We surrender. Please don't hurt us.

  • by WindBourne ( 631190 ) on Tuesday March 12, 2013 @08:58PM (#43155067) Journal
    China ignores all their treaties. For example, they recently joined the UN in condemning NK and promising that they would stop NK's slush fund if found. OK. So, America obviously KNEW where it was and points it out. What does China do? Nothing.
    Then you have their treaty with USA and WTO. They were required to drop most of their tariffs (around 90 at the time), no subsidies for exported goods, no dumping of exported goods, and free their money. Instead, they now have over 400 tariffs, subsidize many key items, are constantly dumping in foreign nations, and manipulate their money.
    Likewise, they have a treaty with Japan that requires them to have pollution control on all new cement and coal plants. Sadly, the Japanese made a mistake in not requiring them to turn on the controls. As such, China simply turns off the controls most of the time. They only turn it on when Chinese gov. tells that they must and for how long (typically a special event or somebody coming to check the environment).

    And now somebody thinks that CHina will keep their word? Not a chance.
    • Probably about the same chance that the USA would keep their's!

      I remember a US president saying on TV, that America had No Intention of bombing Hanoi! Not too long after that, Hanoi was bombed! In fact, I read that Hanoi was the most heavily defended city (in terms of anti-aircraft defences) ever to be bombed. Much to their surprise, the North Vietnamese managed to shoot down some B52's1!

  • ...get their Most Favored Nation status taken away.

  • I know China isn't going to stop. You know China isn't going to stop. Obama knows China isn't going to stop. China sure as hell knows it's not going to stop. So most likely this is grandstanding so Obama can say he's "doing something" to his more clueless buddies in business.

  • While everyone is crying politics... did everyone forget about all of the god damn sshd and email password cracking on random targets by Chinese ip space?
  • You tried. (Score:3, Insightful)

    by zyphyrus ( 2714297 ) on Tuesday March 12, 2013 @11:33PM (#43156025)
    So what incentives exactly does China have to stop hacking? Stop a cyber war? Their hackers are better than yours. Afraid after sanctions? It's unlikely enough countries would be willing to stop trading. Best thing to do imo is to upgrade US's digital infrastructure. Solve the root of the problem.
  • I bet a long list of security appliance manufacturers are sweating bullets after reading this.
  • President Obama and his administration has raised the level of urgency in protecting the government and domestic businesses from the increased level of cyber attacks. However, U.S. leaders have avoided calling China out by name in the past. http://www.cuuhomaytinh.info/ [cuuhomaytinh.info]
  • We can ask till we are blue in the face. Unless we get something on them that is without refute, nothing will change. Even then, if we did have something like that it would be handled in a very hush-hush manner as to not hurt someones feelings in the international community; it will be back-door. We need to upgrade our security, or just outright ban foreign IPs from certain companies. This is one of those problems where there really isn't a good solution.

"If it's not loud, it doesn't work!" -- Blank Reg, from "Max Headroom"