Why is it so rare to hear about Western cyber-attacks? | Hacker News Reader

Why is it so rare to hear about Western cyber-attacks?

bbc.com

29 pointspseudolus76 comments

Here is a hint:

"For instance, the leaks organisation says Marble has test examples in multiple languages: it is possible for a person creating malware to set their spoken language as being Chinese, Russian, Korean, Arabic and Farsi. Thus, CIA created malware could potentially be developed to appear as if it was emanating from another country. The CIA has not commented on the disclosures."

https://www.wired.co.uk/article/cia-files-wikileaks-vault-7

Couldn't, say the chinese or russians, do the same thing and develop malware in way that makes it look like it came from US?

No, because they cannot ask BBC to publish an article about that

Of course. Attributing attacks properly is extremely hard, if not impossible. It is far too easy to fool the used attribution methods.

I've analyzed the logs of failed login attempts to some SSH server of mine. The most common source AS'es are:

- AS9808 China Mobile Comms, China

- AS4837 China Unicom, China

- AS132203 Tencent, China

- AS211252 Delis LLC, US

- AS209605 Host Baltic, Lithuania

- AS4134 China Telecom, China

- AS16276 OVH, France

- AS134963 Alibaba, Singapore

- AS45102 Alibaba, China

"china bad" or not, i have hard data that most of this spam orginates from chinese or chinese-controlled ASes.

Same. 70% of SSH scanners we see is from some (red-)Chinese network. Distant seconds are Russia, Belarus, India. Sometimes, rarely, one sees some Western cloud provider or hoster, but there the activity is typically short-lived due to working abuse-handling.

Sibling comment mentions proxying, which would be an explanation. But still, there is absolutely no working abuse handling on Chinese or Russian networks. Either they do not care or are complicit.

On the one hand, blocking Chinese and Russian IP addresses is and has for a long time been a very efficient way of drastically reducing intrusion attempts. Like it really works.

It's not perfect though: Botnet activity isn't going to come from any particular ASN, but a wide array of unpatched smart fridges and compromised enterprise routers all over the world, so it doesn't crop up in this type of analysis.

Yup same here. I actually wrote a script to visualize this like 10 years ago, had to cap China because the circle would have occupied all of Asia :P

https://files.mastodon.social/media_attachments/files/022/47...

Bet there is someone on Chinese HN commenting the same, but with the location set in America

Check answers to this thread later, i asked a friend from Peking and he will grab some logs during the weekend. Will post the new list of AS'es here.

Or is proxied through them.

There’s pretty much no reason not to proxy through multiple international jurisdictions to avoid detection. Each hop raises the cost of investigation and delay by an order of magnitude.

When I did itsec work we joked that the #1 indicator of an attack from Russia was a sudden dropoff of connections from Russia. I immediately assume that traffic origin has been spoofed

This means very little beyond those hosts being potentially compromised as well.

Yes and no. In movies people talk about using proxies around the world, but network latency quickly gets terrible if you ever actually did this.

It’s inconvenient enough to suggest most western hackers attacking western targets would choose something else if they had the option. Thus either China’s cyber security is terrible and or these attacks are coming from Asia.

I thought that hacked machines usually used not as proxies for traffic from origin attack hosts but rather than large fleet of cheap throwaway attacking traffic origins themselves. There's a used to be fashionable definition "fog computing" for using computer resources like that. Except it criminals used this approach before definition emerged.

And as an attacker you couldn't care less about latency when you schedule a job of scanning bunch of ip addresses for vulnerabilities to one of thousands throwaway hacked home pcs in your fleet.

High latency still makes those machines less efficient to both compromise and them use to scan a bunch of ip addresses. ie US hackers hacking Chinese machines to then hack US machines is really inefficient.

Latency doesn’t prevent such things from working, but your better off hacking local resources and then using those resources to scan locally. So all things being equal either there’s a huge surplus of especially vulnerable Chinese machines or a surplus of Asian hackers.

To be clear there could just be a huge surplus of easily hacked Chinese machines, but that itself would be noteworthy.

Isn't most of the malware these days mostly automated? If so, why would the attackers care about latency? All they have to do is wait for a ping.

Even for automated systems, latency lowers throughout when you’re mostly opening and closing lots of connections.

That's because you have a server in a western country. Would be surprised if the stats were the same for a server in China.

Nope. Overseas offices in those regions still get attacked from the same locations in "the East". There is only a small local component, e.g. because some local ISPs filter SMTP on external gateways, but not internally, e.g. in South America.

Because attribution of cyber-attacks is a guessing game. One that is easily manipulated.

Together with wide-open networks, shitty endpoint security and missing abuse handling in Eastern countries, they could be originators or proxies for an attack. It isn't really possible to distinguish those, there can be hints, but those hints might as well be planted.

So all the "China is attacking us" panic might still be "Western criminals are attacking us, China is just helping through their gross negligence".

Throws me back to the Olympic Destroyer malware from 2018 and all the layers of red herrings that were stuffed into it.

You got my curiosity, where mIght I find more info on this? It sounds really interesting.

As someone else already mentioned, there's a Darknet Diaries episode about it. There's also a Wired [0] piece about it from Andy Greenberg who also adopted it into his (in my opinion) excellent book Sandworm: about how the Kremlin slowly got more and more dangerous in terms of cyber warfare capabilities.

[0]. https://www.wired.com/story/untold-story-2018-olympics-destr...

Darknet Diaries has an episode on it.

> Why is it so rare to hear about Western cyber-attacks?

Because they claim stuxnet was made by Israel. Deny, or pass the buck. We didn't do nothing, move along citizen.

Why not title it "An example of why Western journalism isn't journalism at all"?

Or perhaps "'Journalism' as driven by intelligence community press releases"?

Or even "More civilians die in CIA commanded drone attacks, but we'll never tell you. Ever wonder why?"

These are the same mindless parrots who label anything outside the narrative a conspiracy theory. Accuse them (i.e., self proclaimed journalists) of bias, blindspots, and/or being lazy? Again, conspiracy theory. According to them they're doing an outstand job as The Fourth Estate.

I can't decide if they actually don't realize what pathetic tools they are, or if they run stories like this to rub it all in our faces.

It's a sad state of affairs.

US security & intelligence organizations probably have ton of interesting insights into the human mind, applicative psychological research which hasn't yet been published.

Is it actually so rare? The stories seem to appear semi-regularly. Consider the last year's attacks on Russian ministries etc., or what Snowden revealed about the NSA, or things like this: https://arnt.gulbrandsen.priv.no/tmp/nsa.png

Last time I read about banking/phishing swindles, Florida was named as a main source.

> UPDATE (1/27/14): Shepard says she reached out to the seller and was told they entered the wrong tracking number. She hasn't received the package yet. She also says the new tracking details show that it has now been sent to Seattle, but to the wrong zip code, and "didn't ship until after [she] got the original notification email." That's left her unsure of "what to make of it and feeling paranoid," she told me via Twitter.

That's also a story about a western cyber attack. Unproven, uncertain, definitely a story, and given the address involved, definitely western.

After all the shenanigans we know the CIA and NSA have already done in the past, why should anyone assume they’re not involved in cyber attacks as well?

The question is not that are they doing it -- we know they are -- but why doesn't anyone talk about it more?

There is the obvious western media bias there, but we don't hear about it in Asian or African or other media, either.

My guess is that Western ops are slick, and that the Russians and Chinese are just so prolific in their attacks.

Well, the CIA wouldn't attack its allies. That leaves only a handful of targets in the world, chiefly, China and Russia - both of which have issues of language, media accessibility, and open internet.

Media Objectivity and Bias. Most people think journalists should be impartial by default. That's bullshit, of course. The (only) truth, that matters, is the one that makes your team (feel) stronger.

If we would celebrate (our) successful cyberattacks like blablabla, then the responsible institutions and companies would wrap it in some nice narrative and the media would tell the story a bit more often ...

Because covert attackers never talk and the targets of Western attacks are less likely to talk than Western targets of attacks are.

npr had an article about one nsa operation.

https://www.npr.org/2019/09/26/763545811/how-the-u-s-hacked-...

Ransomware attacks bother me enough that sometimes I fantasize that this sort of thing was the standard response. Sure go ahead and hit a US company with a ransomware attack. But be aware that there is a good chance it puts you in the crosshairs of a nsa battalion whose whole mission is to ruin your day. Perhaps not the smartest team but they are motivated, have incredible resources and the ability to operate while legally protected by the us government.

Then I sober up and realize why this is a terrible idea.

Tyrannies like China, Iran and Russia, the usual targets of such attacks, aren't interested in divulging that the "decadent West" was successful at conducting a cyber attack and hurting them.

What is the answer to the question in the title of this article?

https://chat.openai.com/share/2bfd7c50-284c-48f6-b6d3-816d21...

Because of the "we good, they bad" mentality. We are saints, right?

I should hope not, that would be depressing waste of taxpayer money.

FTA the West is just significantly better at playing this game.

We are most certainly engaging in cyber attacks against states that we are antagonistic against. Here are a few of the more public operations:

* Stuxnet: In 2010, the Stuxnet worm was discovered, which targeted Iran's nuclear facilities. It was widely reported that the United States and Israel were behind this cyber attack. The attack aimed to disrupt Iran's nuclear program by targeting specific control systems. Source: The New York Times - "Obama Order Sped Up Wave of Cyberattacks Against Iran"

* Regin: Regin is a sophisticated cyber espionage platform discovered in 2014. It is suspected to be a joint operation conducted by the "Five Eyes" intelligence alliance, consisting of the US, UK, Canada, Australia, and New Zealand. Regin targeted various entities, including governments, research institutions, and telecommunications providers. Source: Symantec - "Regin: Top-tier espionage tool enables stealthy surveillance"

* Flame and Duqu: Flame and Duqu were sophisticated cyber espionage tools discovered in 2012, believed to be associated with state-sponsored actors. While attribution is challenging, it has been reported that these attacks were possibly conducted by the US and its allies. The primary targets were in the Middle East, including Iran. Source: Symantec - "Flame: Questions and Answers"

* Equation Group: The Equation Group, classified as an advanced persistent threat, is a highly sophisticated threat actor suspected of being tied to the Tailored Access Operations (TAO) unit of the United States National Security Agency (NSA). It was responsible for developing and deploying sophisticated malware and exploits. The group's activities spanned several years and targeted various countries worldwide. Source: Kaspersky - "Equation: The Death Star of Malware Galaxy"

not saints but better

Better how?

For example not using cyber warfare as a tool for intellectual property theft on an enormous scale and fighting such attempts

Defending against unchecked aggression in europe

Preventing radical islamist organizations from attacking western soil

Fighting north korean attempts at nuclear blackmail and mass computer-based money stealing operations

And what about unchecked agression in Iraq?

So we're better because we think we can protect ourselves from colonialism coming back home?

All the things you're implying others do to us are things we have done to them or others.

intellectual theft? are there any western companies benefiting from economic espionage?

also please explain which examples of western colonialism are you seeing now or in the past 50+ years

This is the problem with western media's treatment of China. The relentless demonizing of China is either a coordinated effort in the mass media, designed by governments agencies, and/or exaggerated to get clicks/views by writing "China bad".

But many Americans swear that "freedom" means they don't drink any propaganda.

Country that is actively perpetrating genocide on its own citizens and sells organs of its people on the black market doesn't need any demonizing.

That's not even mentioning the communist regime. Humanity seems to have learned the lesson with fascism, but it somehow missed the same exact lesson with communism.

Look up Hong Kong bookseller for an example of what happens to dissidents. In America, they are given MSNBC spots. In China, they disappear permanently.

My grandfather was a dissident in Soviet union, so I have a pretty good idea.

Again, the point isn’t that China is doing problematic things. It’s that the media actively ignores or misrepresents the same behaviour by the West/USA.

>Country that is actively perpetrating genocide on its own citizens and sells organs of its people on the black market doesn't need any demonizing.

So we're now going to label "re-education camps for extremist muslims" as genocide? What do you think China should do prevent extremist muslims living inside China from randomly killing innocent people, which was fairly common? How would you label the US killing innocent muslim civilians and invading muslim countries? That seems more like a genocide to me.

This is my point. The amount of anti-China propaganda in western mainstream media is so blindingly strong that we can no longer have a logical conversation about China.

Does nothing click when you type “re-education camps” with your own hands?

Sure. A lot of things click. I actually happen to think that it's an imperfect solution to a very hard problem.

Muslim extremism is a worldwide problem. I suggest reading a few of Sam Harris' essays.

To me, re-educating them and removing the extremism is the imperfect solution to a hard problem. It's a hell of a lot better than invading muslim countries and bombing innocent them.

Millions of people are in those camps, I highly doubt even 1% are these extremists you think they are. You're waving away a serious problem because of your extremely pro-China stance as evidenced by your comments. You should reevaluate your beliefs with better information that isn't coming from Chinese propaganda.

<< The amount of anti-China propaganda in western mainstream media is so blindingly strong that we can no longer have a logical conversation about China.

<< What do you think China should do prevent extremist muslims living inside China from randomly killing innocent people, which was fairly common?

We can absolutely have a logical conversation.

Based on the information that we do have as a public, and it appears to be somewhat accurate, is 're-education camp' an euphemism or really just a school to adjust malcontents to the true way of life in China?

> We can absolutely have a logical conversation.

Maybe. But definitely not with the average westerner whose knowledge of China is from mainstream media.

Let me ask you this. When was the last time you read something positive about China in the mainstream media? If you can remember, how many negative stories to positive stories?

1.4 billion people and not a single good thing happens there, according to mainstream western media.

I kinda wanted to reflexively say no, but, the counter I was originally going to list was China space programme, and I read about those primarily from South China Monitor, Jazeera, while generic US news seemed less interested ( maybe with exception of AP ).

As such, I don't think you are not wrong about the 'positive mention/negative mention' ratio, but is it the nature of western media or media in general ( 'if it bleeds, it leads' format that caters to the lowest common denominator ).

FWIW, US media don't have a problem taking US down a peg when it fits the story. Conversely, can Chinese media to the same?

How do you expect you and I to have a logical conversation about China if all you've ever read/watched is from a negative point of view?

You’re going to argue “china bad” no matter what points I make because all you know is “china bad”. This is what happens in basically any debates about China on hacker news and pretty much anywhere in the west.

As opposed to what?

"$country good" propaganda narrative present in every system that cheers on its own efforts and will be just as blind as "$country bad'. Say what you want about US, but it has no problem taking itself down if there is money to be made on the sentiment.

I repeat the question. Can China say that?

You read negative, positive, and neutral posts about the US and its allies every day. Yet, you only read negative posts on China. So how can you honestly have a logical discussion on China?

You don't have a different point of view. You only know one thing, which is "china bad".

>Can China say that?

Who cares when when hundreds of millions went from hungry to prosperity in one generation? And hundreds of millions more are still hungry? You think they care about the things you care about in the US? Would being able to publish articles slamming the CCP increase GDP per capita faster than the current rate? Would infighting between parties increase tech innovation in China?

You can't simply apply whatever values that Americans value onto China. Different history. Different culture. Different phase in development.

And besides, millions criticize the actions of the CCP daily on Weibo already. They have more freedom than you think. Don't underestimate the Chinese's ability to overthrow governments whenever they want to. They've been doing it for thousands of years.

<< You read negative, positive, and neutral posts about the US and its allies every day.

Do I? All I see is various agendas and biases with varying degrees of deniability fighting for their slice of discourse. I will say even more. There is nothing neutral about those posts.

<< You don't have a different point of view. You only know one thing, which is "china bad".

Lets assume that I accept this statement; I don't -- I can easily counter that "china bad" is a perspective too; it is arguably a point of view that is, clearly, different from yours. But that does not invalidate it.

Still, lets say I do. Even if that is true. As an ambassador to 'china good' perspective, your task is to change my flawed perspective. I can't say I am convinced so far. All I get it is the equivalent of "you anti-China", which is not an argument at all. At best it is a statement. At worst it is a name calling ritual.

<< Who cares when when hundreds of millions went from hungry to prosperity in one generation? And hundreds of millions more are still hungry?

I mean.. I can recite propaganda slogans fed by US glorious regime as well ( I mean only tomorrow will our glorious leader -- may he lie for next thousand years - will be visiting our humble town to tell me how good I have it here and that inflation is a thing of the past; Bidenomics -- he unironically calls it that ), but I would like to think that on this forum we can dispense with bumper stickers and talk turkey.

<< You think they care about the things you care about in the US?

To an extent, sure. It is a similar extent to which US cares about things people care about in China. I can assume you know why that is the case.

<< Would being able to publish articles slamming the CCP increase GDP per capita faster than the current rate?

Assuming I understood your question correctly, yes[1][2][3]. Then again, it is not a big feat. I could just as easily find articles claiming the opposite. Articles of all kinds are published regularly ( frankly, I would be astonished if some were not generated based on your query alone ) - it is a hot subject after all.

<< Would infighting between parties increase tech innovation in China?

I am making a lot of assumptions about this question ( mostly, because I am not sure what it is trying to communicate ) with major one being that you mean major political parties in US, but the real response is that you may need to clarify this question a little. I mean, it might influence it, but it is hard for me to tell which way categorically. Not enough information is provided to make a good answer.

<< And besides, millions criticize the actions of the CCP daily on Weibo already.

For how long? ( Till they catch 'em, duh ). I am joking a little, but not that much.

<< You can't simply apply whatever values that Americans value onto China. Different history. Different culture. Different phase in development.

Why not? It is an honest question. I had a longer response initially, but I removed it, because it assumed a lot. Would you be willing to explain this line of thinking?

<< They have more freedom than you think.

I honestly do not think that is possible. I subscribe to a philosophy where freedom is an illusion.

<< Don't underestimate the Chinese's ability to overthrow governments whenever they want to. They've been doing it for thousands of years.

I am not sure how to interpret that fragment. Was it a veiled threat? Statement of fact?

No one is underestimating China. If anything, this is one of the first times, I see US government actually concerned that it may not be able to contain a defined adversary ( economic or otherwise ), which is one of the reasons you see all those frantic efforts to limit China's power now.

Come to think of it, is it in China's interest to overthrow US? I don't think the answer surprises anyone, who follows the money.

[1]https://www.aljazeera.com/features/2023/1/24/is-chinas-high-... [2]https://www.thebalancemoney.com/what-is-the-ideal-gdp-growth... [3]https://www.foreignaffairs.com/china/how-china-trapped-itsel...

Here's my challenge to you: For one month, take the side of China in HN anti-China posts. There are a lot of them posted here every day. Let's see how you do after a month.

Heh. You are on. I partake in discussions on various sides just as an exercise. One catch though. In the interest of balance, you must do the exact opposite. You have to take US side in anti-China posts.

Do we have a deal(1)?

(1) one month expires at the end of 07/28/23 in your time zone

https://www.cfr.org/backgrounder/china-xinjiang-uyghurs-musl...

Millions of people... millions. They're not all extremist Muslims that China is doing this to.

> Humanity seems to have learned the lesson with fascism, but it somehow missed the same exact lesson with communism.

Because the vast majority of people on this planet, when they learn about what communism is, learn about the ideas of it. The US is pretty much the only place where it's taught as "Whatever China is doing" and "whatever Russia did".

Imagine someone talking about North Korea and constantly talking about how democracy is the reason for everything bad that's going on there. What they're doing must be democratic... it says so right in the name. Or the Democratic Republic of the Congo.

What Pol Pot and Mao did are natural consequences of these ideas. The communist ideas themselves are a promise that if you jump off a roof and start waving your hands really hard, you'll fly. Intelligent people drive their conclusions on empirical data instead of theories, but you're absolutely right about the majority.

The problem is authoritarianism, not Communism. Fascism is authoritarian by definition. Communism CAN be authoritarian, but that is not built in by default.

Reply on news.ycombinator.com