Chinese hackers exploit VMware bug as zero-day for two years | Hacker News Reader

Chinese hackers exploit VMware bug as zero-day for two years

bleepingcomputer.com

46 pointsfortran779 comments

Amusingly, when the hackers were previously identified as the Chinese government they changed their signatures.

So revealing the signatures in public is not a good idea.

"While past Mandiant blog posts related to UNC3886 have shared atomic indicators like file names and hashes, this particular attacker has been observed replacing indicators mentioned in publications in under a week after their release. For this reason, this blog post focuses on highlighting the tactics and methodologies utilized by the attacker with the aim to be able to detect and respond to this attack path regardless of the exact malware being deployed or commands being run."

How do they know they’re Chinese? If they’re doing something as dumb as using a Chinese IP or entering Chinese text, why not just ban China/Chinese characters

Cybersecurity firm Mandiant has identified this threat actor as "UNC3886".

https://www.mandiant.com/resources/blog/vmware-esxi-zero-day...

The heuristics used by security researchers are not really based in externals as you suggest. There is significant energy devoted to classifying and categorizing threat actors, and the main takeaways here are (1) nation-state-level power/funding and (2) not on our side.

Cybersecurity is a cat and mouse game, nobody made their methods public, on any side. How do we know that you aren't from Chinese intelligence who is trying to figure out why they could trace back to the Chinese hackers in this case?

If Mandiant said they caught a Chinese hacker red handed by tracing the connection to his house in Beijing, and they were able to record his keystrokes, would you believe them?

When Kapersky said they discovered zero days by US intelligence, they gave no evidence either:

[FSB] goes on to claim without evidence that the attacks amount to a plot between Apple and the NSA to build a powerful surveillance infrastructure to snoop on those with ties to Russia.

https://www.darkreading.com/endpoint-security/apple-zero-day...

> If Mandiant said they caught a Chinese hacker red handed by tracing the connection to his house in Beijing, and they were able to record his keystrokes, would you believe them?

Probably

> When Kapersky said they discovered zero days by US intelligence, they gave no evidence either

I listened to the Kapersky talk. They didn’t attribute it to anyone. The FSB is not Kapersky. No, I don’t believe the FSB precisely because they have no evidence.

They don't know. Its war monger karma farming. These guys are quacks.

You tend to comment "it's war mongering" and how nobody actually knows who the attackers are, but you seem to say this out of alliance with no technical background in how these connections are made.

Yes I do. I am having a slow motion break down so I am sorry if it gets annoying.

The naming of ethnicity/nationality in articles like these seems governed by "geopolitical" tides.

There is no way there is some forensic way to figure out where somewhat competent hackers are from.

Dude, did you even read the article?

Last time they identified the hackers, those guys changed their "signatures" AKA the things they did to give themselves away.

Even the best hackers etc slip up.

The exact method to identify them is irresponsible to reveal because the malicious party will use it their advantage.

Reply on news.ycombinator.com