Politics The New Cold War - The Matrix, aka organized hacking

rogue49 · Feb 20, 2013

Anonymous
Stuxnet
Nigerian phishers
Bots
Chinese Hackers

I've been in this world battle...but I don't truly want to be drawn into it.
Too much time, too much effort, no trust, all risk.

Me, I just want to be a defender, correctly setting up the roles, privs and organization,
Encryption and continuous Auditing...with periodic analysis and self-probes & tests.
Beyond parameter security, which most forget.
Being even half-way diligent with followup and follow-thru, not just protocol enforcement.

But these will become even more and more apparent and pervasive as time goes on.
Companies need to be come smarter and just be consistently aware.
Like locking your doors, setting the alarm, and watching the area.
That will stop most attacks...but most just set firewalls and passwords...you need more.

Just doing things because a nice software tells you there's a "fail" is not enough to secure,
you've got to understand WHY it's saying it, verify it, define it, test it...and WATCH it even beyond, every day.
Have a true "hands-on" subject matter expert, not just an ex-cop with a check list.

I can tell you that the companies that do it right, haven't been stolen from.
But this unfortunately is not typical...most just are inconsistent.

China Army May Be Behind Web Attacks, Security Firm Says
By Bloomberg News - Feb 19, 2013

China’s army may be behind a computer-hacking group that has attacked at least 141 companies worldwide since 2006, according to a report by a U.S. security firm.

The attacks, mainly directed at U.S. companies, were carried out by a group that is “likely government sponsored” and is similar “in its mission, capabilities, and resources” to a unit of the People’s Liberation Army, Mandiant Corp. said in a report today.

Mandiant said it traced the group, labeled Advanced Persistent Threat 1, to four large computer networks in Shanghai. Two of the networks serve the Pudong New Area district, where a secret army unit called 61398 is based, the report said. Corporations and government agencies are increasingly finding themselves under attack from sophisticated adversaries, many of them from China.

“It is time to acknowledge the threat is originating in China,” Alexandria, Virginia-based Mandiant said. “Our research and observations indicate that the Communist Party of China is tasking the Chinese People’s Liberation Army to commit systematic cyber espionage and data theft against organizations around the world.”

A recently prepared U.S. secret intelligence assessment, described Feb. 11 in the Washington Post, said the country’s economy is endangered by a massive and prolonged computer- espionage campaign from China.

Server Addresses

Publishing detailed information about the hacking group, including the Internet Protocol addresses of its servers, will make it harder for the intruders to escape detection, said Dan McWhorter, managing director of Mandiant’s intelligence unit. It could take weeks or months for them to set up new servers and write new malicious software, McWhorter said.

“They’ll have to go back to the drawing board,” he said. “My guess is the group will go very dark for a while.”

The details Mandiant disclosed can help corporations spot hackers in their own networks, ahead of similar government actions that would happen under an executive order signed Feb. 12 by President Barack Obama.

The order calls for sharing of secret government information on the operations of Chinese hackers and other cyber threats. It directs the government to develop voluntary cybersecurity standards for companies operating the nation’s vital infrastructure, such as power grids and air traffic control systems.

‘Grab Everything’

The attack Mandiant described is comparable in size and sophistication to the one that hit Google Inc. and dozens of other companies in 2009, said Alan Paller, director of research for the SANS Institute, a Bethesda, Maryland-based computer- security research and training organization.

Attacks from China often bear different hallmarks than those from other countries, Paller said.

“The Chinese have a technique called 1,000 grains of sand -- these guys in China go grab everything that you have and then sort it out back home,” he said. “Because the Chinese get so much, and they really don’t seem to worry about getting outed. They’re noisier. Whereas the tradecraft of the other guys is very much like the tradecraft of the U.S. -- getting caught is equivalent to failure -- the Chinese don’t seem to care about being caught.”

The New York Times last month reported that its computer systems were breached by Chinese hackers, a claim China has denied. The Wall Street Journal outlined similar attacks on its systems, while Bloomberg LP, the parent of Bloomberg News, said there have been unsuccessful attempts to infiltrate its network.

‘Unfounded Accusations’

China’s Foreign Ministry said today the country opposes computer hacking and that it is a victim of attacks. The U.S. is the biggest attacker of China’s Internet, said Hong Lei, a spokesman for the ministry. Making “unfounded accusations” is not conducive to resolving the issue, Hong said when asked about the report at a regular briefing today.

“It’s inaccurate and unprofessional to accuse the Chinese military of Internet attacks,” the Ministry of Defense said by fax today in response to a Bloomberg News request for comment on the Mandiant report. “China’s military has never supported hacking and the country has always cracked down on relevant criminals.”

A spokesman for President Obama’s National Security Council said the U.S. has “substantial and growing concerns” about cyber threats, and the administration is aware of the Mandiant report and its contents.

Raising Concerns

“We have repeatedly raised our concerns at the highest levels about cyber theft with senior Chinese officials, including in the military, and we will continue to do so,” the spokesman, Tommy Vietor, said in an e-mail.

Vietor didn’t draw a specific link between China and hacking attacks. “The U.S. and China are among the world’s largest cyber actors and it is vital that we continue a sustained, meaningful dialogue and work together to develop an understanding of acceptable behavior in cyberspace,” he said.

Obama has direct experience with the hacking group described in Mandiant’s report. Bloomberg News reported in July that the hacking team stole policy briefs and other information from his 2008 presidential campaign, as well as the campaign of Senator John McCain, an Arizona Republican.

In the summer of 2011, the group hacked the president of the European Union Council, a Washington law firm working on an anti-dumping case involving China, an immigration magistrate in Canada and a nonprofit group working on democracy issues in China, Bloomberg News reported.

Sensitive Files

Bloomberg News also reported in November that hackers from China broke into computer systems at Coca-Cola Co. in 2009 and pilfered sensitive files about Coca-Cola’s attempted $2.4 billion acquisition of the China Huiyuan Juice Group.

Investigators at dozens of commercial security companies suspect many Chinese hackers are either with the military or take their orders from some of China’s intelligence or surveillance organizations, Bloomberg Businessweek reported this month.

APT1, the Chinese group, has attacked companies in 20 major industries, and 87 percent of the targets are based in countries where English is the first language, according to the Mandiant report. Targets were based in countries including the U.S., Canada, the U.K., India and Singapore. Mandiant’s research was reported earlier by the New York Times.

®2013 BLOOMBERG L.P. ALL RIGHTS RESERVED.
Click to expand...

ASU2003 · Feb 20, 2013

What concerns me, is that it wouldn't be that hard to compromise a Chinese server and route all of your traffic through it. And maybe the media companies have paid off people to do this in order to have a story...Maybe it is the computer security companies trying to drum up business...

It makes a good story, and I have to wonder what some of these companies are doing with their security and computer procedures. Everywhere I have worked, you had general computers that were on the internet and accessible to the outside, and internal computers that didn't have any networking whatever. They also didn't have USB ports or anything. It still doesn't really deal with an insider threat though.

For the big companies that need a web presence, there are plenty of commercial security tools and updates. Usually if your job is in computer security then you know how to handle this type of thing.

rogue49 · Feb 20, 2013

Oh yes, and this comes up again today at work.
Only the question is...which is the standard we use for "best-practices" on security?

And my response back was, well...which entity are we talking about? which standard? There are many.
One uses this, another uses that...many have NIST as a base-line, but which one...version? update?
Many have one for their specific environment.
Some have it for specific methods.
Some for specific app...roles...vendors...and so on.

Well, what about a software that checks all of this?
It depends...what definition do they use?
Were the devs for the product faithful to that definition they're marketing.
How deep do they go? Are the reports detailed?
Can you automate?
Can you exclude? (IF your own environ needs that item, or deviates it, or simply can't be corrected easily or not too much cost)

Which one is the best? don't know...all pretty much the same. Not like anyone really knows who'll be questioning you anyway.
It's about followup, follow-thru...and making sure you have a person who truly knows and can execute.

--------------

On another note, I think some hacker groups are "crowing" a bit too much for their own good.
It's not an ego thing nor do I care...It's just making yourself a target.
The government has unlimited funds, resources and unending tenacity.
While they may not be the most complete of SMEs...sooner or later, they'll get you...if you give them reason to.

I'd stick with corporate, don't tweak the nose of Big Uncle.
Leave that to the other insane nation-states who have some big sticks to negotiate with. (and even they are asking for it)

cynthetiq · Feb 20, 2013

rogue49 said: ↑

Oh yes, and this comes up again today at work.
Only the question is...which is the standard we use for "best-practices" on security?

And my response back was, well...which entity are we talking about? which standard? There are many.
One uses this, another uses that...many have NIST as a base-line, but which one...version? update?
Many have one for their specific environment.
Some have it for specific methods.
Some for specific app...roles...vendors...and so on.

Well, what about a software that checks all of this?
It depends...what definition do they use?
Were the devs for the product faithful to that definition they're marketing.
How deep do they go? Are the reports detailed?
Can you automate?
Can you exclude? (IF your own environ needs that item, or deviates it, or simply can't be corrected easily or not too much cost)

Which one is the best? don't know...all pretty much the same. Not like anyone really knows who'll be questioning you anyway.
It's about followup, follow-thru...and making sure you have a person who truly knows and can execute.

--------------

On another note, I think some hacker groups are "crowing" a bit too much for their own good.
It's not an ego thing nor do I care...It's just making yourself a target.
The government has unlimited funds, resources and unending tenacity.
While they may not be the most complete of SMEs...sooner or later, they'll get you...if you give them reason to.

I'd stick with corporate, don't tweak the nose of Big Uncle.
Leave that to the other insane nation-states who have some big sticks to negotiate with. (and even they are asking for it)
Click to expand...

And thus since the target moves setup for failure.

rogue49 · Feb 21, 2013

cynthetiq said: ↑

And thus since the target moves setup for failure.
Click to expand...

Can you clarify, sir?
This isn't clear to me...and I'm interested.

Are you saying that people should also be prepared for a breach,
and should have audit to trace...and backups to restore and understand the legalities and so on?
If so, I agree.

cynthetiq · Feb 21, 2013

rogue49 said: ↑

Can you clarify, sir?
This isn't clear to me...and I'm interested.

Are you saying that people should also be prepared for a breach,
and should have audit to trace...and backups to restore and understand the legalities and so on?
If so, I agree.
Click to expand...

Yes.

It's just a matter of time.

The challenge too is to make the executives understand that a breach doesn't mean that the security group isn't doing what they are supposed to. It's always an escalating war in this area. So it is a matter of staying on top of the trends and potential exploits. It is always a best as best can.

The breach normally isn't going to be your normal opening anyways. It's going to be a social engineered exploit. Even if it is an open email exploit it's still a social engineered breach and not a 0 day attack style.

Knee jerk reaction is to fire the security team if there is a breach. That's not necessarily the best course of action, but executives like to find faults and place blame and once done think that it won't happen again. Well, duh. It can happen again, it's just a matter of time.

rogue49 · Feb 22, 2013

cynthetiq said: ↑

Yes.

It's just a matter of time.

The challenge too is to make the executives understand that a breach doesn't mean that the security group isn't doing what they are supposed to. It's always an escalating war in this area. So it is a matter of staying on top of the trends and potential exploits. It is always a best as best can.

The breach normally isn't going to be your normal opening anyways. It's going to be a social engineered exploit. Even if it is an open email exploit it's still a social engineered breach and not a 0 day attack style.

Knee jerk reaction is to fire the security team if there is a breach. That's not necessarily the best course of action, but executives like to find faults and place blame and once done think that it won't happen again. Well, duh. It can happen again, it's just a matter of time.
Click to expand...

And to confirm your point, it seems that even hackers are hacked.
Anonymous has their twitter feed drilled into...

hmm...I wonder if there is such a thing as Hack Insurance.

Log in or Sign up

Politics The New Cold War - The Matrix, aka organized hacking

rogue49 Tech Kung Fu Artist Staff Member

ASU2003 Very Tilted

rogue49 Tech Kung Fu Artist Staff Member

cynthetiq Administrator Staff Member Donor

rogue49 Tech Kung Fu Artist Staff Member

cynthetiq Administrator Staff Member Donor

rogue49 Tech Kung Fu Artist Staff Member

Log in or Sign up

Politics The New Cold War - The Matrix, aka organized hacking

rogue49 Tech Kung Fu Artist Staff Member

ASU2003 Very Tilted

rogue49 Tech Kung Fu Artist Staff Member

cynthetiq Administrator Staff Member Donor

rogue49 Tech Kung Fu Artist Staff Member

cynthetiq Administrator Staff Member Donor

rogue49 Tech Kung Fu Artist Staff Member

Useful Searches