Hacker News Reader

Comment by benmccann | Hacker News Reader

A lot of the comments about this presume that the victim could have avoided such trouble with better security knowledge. It's worth noting that the Chinese have hacked Google, Yahoo, Adobe, Lockheed Martin, and over a hundred other companies, which have many more security resources available to them than Solid Oak does. No small business in America would ever be able to defend itself from a sustained attack backed by the resources of one of the most economically powerful nations on earth. For example, does anyone here think they could defend against years of attacks from the NSA?

View on HN

As somebody who made dismissive comments about the victim in this case: No, I'm not saying he could have avoided a nation state attack with better security knowledge.

I'm saying that - at least the way TFA describes it - the victim doesn't have enough security knowledge to tell if he's been attacked by script kiddies, a nation state, or a roll of toilet paper.

I'm sure the real story is a bit more nuanced, but nothing about the description gives me any confidence that the allegations are even broadly aimed in the right direction.

Is China a major vector of security attacks? Yes. Does that mean it has anything to do with this particular incident? I wouldn't bet serious money either way, and pocket money against.

"He had no idea who was behind it until last August, when he provided malware samples to a security firm at the request of a Bloomberg reporter. A forensic analysis of the malware by Joe Stewart, a threat expert at Atlanta-based Dell SecureWorks, identified the intruders who rifled Solid Oak’s networks as a team of Shanghai- based hackers involved in a string of sensitive national security-related breaches going back years."

What does that prove? The Bloomberg reporter doesn't show much evidence of being able to discern what is a valid analysis and what is not. What is a malware sample? Is it so easy to tell if a malicious script was actually used by a group, or merely copied by a script kiddie?

To give you an idea of how stunningly bad conclusions can be drawn from technobabble inferences, I present this:

http://www.foxnews.com/tech/2012/05/30/powerful-flame-cyberw...

Powerful ‘Flame’ cyberweapon tied to popular Angry Birds game

The most sophisticated and powerful cyberweapon uncovered to date was written in the LUA computer language, cyber security experts tell Fox News -- the same one used to make the incredibly popular Angry Birds game.

LUA is favored by game programmers because it’s easy to use and easy to embed. Flame is described as enormously powerful and large, containing some 250,000 lines of code, making it far larger than other such cyberweapons. Yet it was built with gamer code, said Cedric Leighton, a retired Air Force Intelligence officer who now consults in the national security arena.

FOX News claims that Angry Birds is a delivery vehicle for a virus because both of them are programmed in Lua. And who can blame the reporter? Her source is a former intelligence officer in the Air Force who is likely paid way more than every developer on HN to hype up such threats.

Your question is not fair. I am sure there are cases where NSA tried an attack and failed. It is a matter of how badly they want the attack to succeed. Just because you are being attacked by "the Chinese" does not mean they will put all their resources behind it.

I'm sure the amount of resources the Chinese government needs to put behind a successful attack on a small US business is minuscule.

The resources united states government would be even less.

It doesn't matter. The main problem here is not hacking. It is piracy as the Chinese government stole their software.

I wonder what would happen if Anonymous decided to target China over matter like this. Sure would be impossible to bring a government like that to their knees. But at least the public would gain some awareness on this matter.

Kill that noise right now.

Before you grabbed that little war drum, if you thought of the consequences you really wouldn't want to start such a conflict in the first place.

The quick, unorganized retaliatory response from an anonymous actor is usually such that it puts innocent services and people directly into the crossfire. Not to mention an anonymous moniker allows anyone to act on the behalf of anyone.

Who said it has to be quick and unorganized? While officially the US can't 'engage' China in this way, another NGO could start and perform long term campaigns against Chinese corporations and assets similar to what is detailed in this article. I'm also not naive enough to think that this hasn't already begun.

It doesn't work that way. If the U.S. government condones cybercrime, it cannot allow an NGO to engage in it towards a country that you have diplomatic relations with. I agree with "Kill that noise right now" comment above.

Reply on news.ycombinator.com