Cyber Sleuths Track Hacker to China’s Military
wsj.com
wsj.com
Edit: this isn't to say publication/announcement was done at the administration's request, simply that the timing is extremely suspect. Other interests also want to see Xi brought down a few pegs. Politics :-/
What the last some years have done, however, is to make me rather distrusting of both sides.
I may be in the minority. But a democracy is in significant trouble when its own population no longer trusts and believes it, in the large. The leadership either turns increasingly autocratic, or it loses its power.
The t-word wins again. The lies told ostensibly because t-word, are proving to be far worse than the original risk of t-word.
And instead of effective oversight to harden our own systems, we have blindness, lack of accountability, and scapegoating.
It's not just the data collection that makes me distrust the Feds. It's its gross mis-management, abuse, and the insistence that I can't know what is going on.
So, pump out your stories about the Chinese. Many of you politicians sold us down the river, in that regard, years ago.
Actually, democracy is safest when the people distrust it.
The real problem is that we have far too many people who are either completely trusting or totally inert.
Mr Xi is in town, what else related to Xi can give us more eyeballs now that all things Xi/China are in the news, what do we have? Oh, yes, of course, spying!
It wants users to get used to how Windows works, versus to other alternatives like Linux, Mac, etc.
For example, nobody wanted Windows Mobile, so they paid Nokia to install it. Failing that (<4% mkt share), they bought Nokia.
X-Box is another product they're paying customers to take, in exchange for living room share. It's lost billions overall since its beginning.
If we do we will also see it to be equally as futile as trying to stop torrenters.
Perhaps the government makes it worth the hackers' while to hack the USG instead of it. Just sad that so many intelligent people would rather be powerful/wealthy than free (not that the USG is a shining example of that sentiment).
These hackers have power (their ability to obtain government data and subvert its power) and the Chinese government is perhaps wisely channeling it to its foreign adversaries.
[0] http://cdn2.hubspot.net/hubfs/454298/Project_CAMERASHY_Threa...
It seems pretty likely there is some PLA connection, though not necessarily to this particular guy - no way of knowing that a buddy didn't steal his handle for use elsewhere (seriously, not sharing the same hacking handle and the same personal username should be Tradecraft 101)
MD5: b12f118840d0aa0d5ab2fb9aa052ede3 SHA1: dbd710751a6c32ba91401fb5e5623f46b4d2475f SHA256: da6b105f1e58f860ce67b2ad2db7b15ff7b637cfb37f7d0680a20eb633bcc741"
... when you are then providing both the PDF, and the list of its supposed hashes, over an unencrypted connection! It renders it meaningless. I can't trust those hashes or that document. And creating megabyte long PDFs with colliding MD5 hashes is not even a difficult challenge anymore.
The irony here is this page is say "hey open this document, it's safe, trust us" when the document is all about APT attack methods, which often involve compromising people's computers by opening untrustworthy documents! I doubt that's what's happening here, but still kind of silly when you think about it.
Please, all the companies out there. Stop adding a list of hashes to appear more legitimate when you clearly don't know what you are doing.
Source, please? Suppose the hashes and PDF were provided over HTTPS. How would it be easy to create another document that collided with all 3 hashes?
Not trying to be facetious - just wondering.
If its not over HTTPS, it doesn't matter there are 3 hashes. I change the doc. I generate the 3 hashes for my changed doc. I can serve those new hash values.
Also - There is no known method to (within the lifetime of this universe) create a different document with the same MD5 and SHA1 and SHA256. Adding the MD5 doesn't weaken things, and might improve them.
The person who posts PDFs on websites with MD5/SHA1/SHA256 hashes adds a watchdog to verify that those hashes aren't changing - Once you get the framework together, adding a new page with hashes to the watchdog takes just a few seconds. That way, if the random ISP(s) or third parties are modifying those sums on the fly, will trigger the watchdog.
As to whether most people check the sum - I have no idea, but at least anybody who wants to take 90 seconds to authenticate the document can just go:
x=Project_CAMERASHY_ThreatConnect_Copyright_2015.pdf ; md5 $x; shasum -a 1 $x; shasum -a 256 $x;
Keep in mind - I totally agree with you that this isn't a great mechanism, but I would argue it's better than nothing at all. (as long as someone has a watchdog to confirm the hashes aren't being modified in flight - they could probably help their case a little by at least serving those pages with HTTPS).
A much better mechanism would be to use OpenBSDs signify (http://www.openbsd.org/papers/bsdcan-signify.html) which solves this whole problem of trying to sign documents with something simple that doesn't involve byzantine chains of trust in a very elegant way.
They could just create a key pair:
signify -G -p threatpub -s sec
untrusted comment: signify public key
RWQw2u3UPjm6spK9OYJxylK2jSKz2agskG2EKPsxwFN4IjHVw66dYPhT
signify -S -s sec -m Project_CAMERASHY_ThreatConnect_Copyright_2015.pdf
untrusted comment: signature from signify secret key
RWQw2u3UPjm6svkWhs4fgy1Qi0P72hp+uDuTxX8bDSvd/qr/7vc55v+PndgDdWOWj0JiLco/CCfOzw6Alau9RTi5gBiHSzuRHAs=
signify -V -p threatpub -m Project_CAMERASHY_ThreatConnect_Copyright_2015.pdf
A huge amount of space is dedicated to tenuous ties between physical military activities and espionage on the assumption that all chinese agencies are coordinating with each other, that the Chinese are just better at conspiracy than any US operation. No actual intelligence officer would ever describe China in that way. It's a patchwork of poorly-connected operations all trying to put on a good show for the bosses, much the same as US intelligence agencies.
Certain key phrases suggest political motive. As example, the phrase "China’s ... military grade signals intelligence Unit" caught my ear. "Military grade" doesn't mean much in infosec. It does mean something to lifelong service members who labour under the assumption that military structures just do things better than civilian organizations. In some fields "military grade" is actually a bad thing, a reference to products built to conform to rarely-updated procurement standards. It's like still selling floppy disks because the computer on the stealth bombers haven't been updated in 20 years. The phrase appears right at the start of the takeaways section, right where most senior officials will probably start reading.
The drilling down upon a few people, to the point of tracking a man's movements and finding the bike he offered for sale, certainly plays into current US national security desires. Targeted killings based on poor intel is a big chip on the military shoulder these days. They aren't happy about it. So peppering a document with a few grains of seemingly accurate and specific intel about individuals is a good trick to win people over. The excessive reliance on google maps is just eyecandy. This gives the false impression of validity, a false suggestion that the rest of the report is based on equally detailed and reliable intel. if this were such intel, it wouldn't be released publicly.
the pdf: http://cdn2.hubspot.net/hubfs/454298/Project_CAMERASHY_Threa...
When is the US going to get its shit together and start worrying about cyberdefenses?
Do they? I thought the largest "cyber warfare force" (gotta love these buzzwords) was the NSA, and the US govt itself. The US practically controls the internet...
The whole world needs to start making protection of user data (private sphere) and citizen data (public sphere) a priority. Until that happens, there will continue to be massive hacks of sensitive data that end up hurting very large numbers of people.
It's well past time that the world as a whole started taking the issue of cyber security seriously.
Bad guy or good guy, what I worry about is that man's fate... if he hasn't met it already :(
It's embarrassing to see the flailing of the US intelligence apparatus trying to take attention away from their own abuses of power.