Hacker News Reader

Comment by hooande | Hacker News Reader

I believe that Chinese hackers are the scariest thing in the world today. I think that the threat from cyber warfare might be slightly overblown (though the next pearl harbor will most likely be a cyber attack). The real threat is the fact that no digital information can be kept secret anymore. If Chinese hackers want what's on a given hard disk, there's no way to stop them.

People absolutely freak out when they suspect the US government of spying on a citizen. But chinese hackers, state sponsored or not, seem to be able to roam with impunity. Several US companies have had their ip stolen and their businesses ruined. Companies have lost as much as a billion dollars in ip in a single night. [1] There are so many of them with such diversity of skills that almost no one is safe.

I'm not trying to rattle sabers here, just pointing out that the world is facing a threat to privacy and secrecy that is greater than we have ever known. Chinese hackers have more power than the CIA, KGB and Gestapo combined, and nothing short of WWIII can slow them down.

[1] http://www.nytimes.com/2012/04/03/opinion/how-china-steals-o...

View on HN

From a US perspective, foreign hackers are a threat--but I think mostly to companies and to individual cases of identity theft.

I'd argue that a government spying on its own citizens is a much greater threat. If a Chinese hacker steals your identity, maybe you're out some (possibly significant) amount of money, and a lot of hassle. Your physical well-being is typically not threatened.

If, however, the government reads through your email, listens in to your Skype calls, and then decides that you've committed some crime (and by virtue of living day-to-day in our hyper-criminalized society, almost all of us are guilty of some crime these days), you can be harrassed physically, legally, and financially for what might be the rest of your life by our crushing-revenge-driven legal system--you might even be imprisoned.

Chinese hackers can't imprison you, or sue you until you choose to exit early. So from a regular person's perspective, we should be way more worried about what's going on at home.

> Companies have lost as much as a billion dollars in ip in a single night.

I guess the Chinese should know a thing or two about failing to keep ownership of "intellectual property" and the dangers associated on relying only on IP alone. I took this from here http://en.wikipedia.org/wiki/Silk_Road#Roman_Empire:

> Byzantine historian Procopius stated that two Christian monks eventually uncovered the way of how silk was made. From this revelation spies were sent to steal the silkworm eggs, resulting in silk production in the Mediterranean.[18]

Fwiw, they also had their tea monopoly stolen by the British in the 1800s [1].

Additionally, the US turned a blind eye to its own theft of Europe's IP in the 1800s and early 1900s as we were developing.

Not that we shouldn't defend against it when used against us, but it seems par for the course for developing nations to catch up this way.

[1]: http://en.wikipedia.org/wiki/Tea#Origin_and_history

Chinese hackers can be beaten. The reason they are so successful right now is that the average level of computer and network and security competence in the world is extremely low.

In corporate America, the average employee is not sophisticated enough to resist spearfishing, which is how the vast majority of Chinese intrusions begin. But if the IT dept puts in place technologies or restrictions to protect against spearfishing (like quarantined browsers or blocking attachments), the average employees complain bitterly about the impact on their habits. And they don't like training. When management sides with employees, well-known security holes are left open.

Even upgrading operating systems, which is one of the most effective tools against intrusions, is met with fear and anger at many organizations.

Even without those front-line defenses, it is possible to find, stop, and eject the Chinese from corporate networks...but it is extremely time consuming and expensive to do so. Although they would never admit it, it's likely that many corporations make the calculation of "how much" intrusion they are willing to fight, and tacitly permit the rest. What they really want is not to stop the Chinese "at all costs", but to stop the Chinese for a given cost.

> Chinese hackers can be beaten. The reason they are so successful right now is that the average level of computer and network and security competence in the world is extremely low.

I bet they're constantly having laughs at our expense. They must think of the US as a bunch of flubby overrated dimwits.

I hear that a lot, but the truth is that the next Perl Harbour has already happened. It was a surprise aerial attack on a strategic port city back in 2001. Almost 3,000 people were killed.

I don't believe any cyber attack is likely to be that dramatic or destructive for the same reasons that computer systems are hard to protect. Complexity. It's hard to protect a computer system because there are so many potential vulnerabilities. It's easier to take one down, but that won't necessarily result in much damage. To do that you need to take over a complex system and exercise sophisticated and dynamic control of it, to orchestrate very specific behaviour, which is not easy. For example shutting down the computers at a nuclear power plant may be feasible. However taking control of it and manipulating it with enough sophistication to engineer a meltdown, while overcoming all the computerised and physical safeguards would be a lot more complex to pull off.

"I hear that a lot, but the truth is that the next Perl Harbour has already happened. It was a surprise aerial attack on a strategic port city back in 2001. Almost 3,000 people were killed."

The Pearl Harbour attack was an attempt by a government to cripple an enemy's capability to project power in the Pacific ocean, with the attacker's intent to then establish dominance in that region. What you describe was nothing of the sort and to call it another Pearl Harbour is simply wrong.

If you define Pearl Harbour as a military attack, then yes. But if you look at the cultural and political impact of 9/11 and Pearl Harbour, then they are quite similar. Both did change US policy and politics, have both generated treatment in movies and books and perhaps most strikingly are used in a phrase like "The next ..."

The Pearl Harbour attack forced a nation that was reticent into an actual, real war against a serious foe that presented a genuine threat; a war that would dictate cultural and economic supremacy over the Pacific region for the next half-century. It also pushed the US into the genuine battle for national existence raging over the other half of the planet in which millions of people were already under the yoke of an invader. The ensuing economic activity towards the war effort created the situation post-war in which the U.S. dominated the world whilst at the same time providing massive, massive increases in living standards for the U.S. population and also in large parts of Europe via the Marshall Plan. The echoes continue to ring today.

Comparing this to 9/11 is like comparing a tank to a soap box racer. I might as well say that the price of pork belly futures is the next Pearl Harbour as that also affects US policy.

Well, hold on there. Think about the comparison: The 9/11 attacks DID force a nation into an actual, real war (two, actually, in Iraq and Afghanistan, and three if you want to count the generic "War on Terror" that was stepped up dramatically after the attack). The war in Afghanistan has become the longest in United States history, and those wars together HAVE clearly helped set in motion a series of events that will dictate the balance of power in the Middle East for a generation to come, from the deposition and removal of dictators by force to the Arab Spring to the ongoing civil war in Syria. Though there was no contiguous threat in the Middle East to rival Nazi Germany, the Middle East was and is still characterized by a number of oppressive dictatorships.

Did post-9/11 have the same economic effects for the US as the post-WWII era? No, but that's not really the effect of any particular difference between the events that precipitated WWII and the wars of the last decade. And, if anything, the post-9/11 landscape HAS seen a dramatic shift in the global balance of power, specifically in challenges to US supremacy and an internal reconsideration of how we project the power we do have.

The point to be made here, which I think backs up the whole "digital attack as next Pearl Harbor" argument, is that unconventional warfare is the new conventional warfare. We're less likely to see a direct military challenge along the lines of Pearl Harbor, and much more likely to see indirect challenges to US supremacy through digital or terrorist attacks. There are a lot of parallels to be drawn here, and you made many of them yourself.

"The 9/11 attacks DID force a nation into an actual, real war (two, actually, in Iraq and Afghanistan, and three if you want to count the generic "War on Terror" that was stepped up dramatically after the attack). "

The US was not forced into those wars. Iraq posed no threat to the US. Afghanistan posed no threat to the US. Pearl Harbour was an act of war by a nation; Japan had serious intent to dominate the Pacific and become the regional economic and military power, and was prepared to do serious damage to the US in order to achieve those aims. 9/11 was an act of terrorism by non-national actors. Iraq and Afghanistan were no threat; the US was not pushed into those wars. The US chose them.

Fine, if you want to be nit-picky about the necessity of the Iraq and Afghanistan Wars, you're more than welcome. But either way, it's abundantly clear that the 9/11 attacks precipitated both of those wars. There is simply no way the neoconservatives could have convinced Congress of the need to invade Afghanistan or Iraq without the 9/11 attacks. Pearl Harbor may have forced our hand more clearly, so to speak, but both attacks were deep provocations. You can separate out the intent of the attacks if you want to be precise--Japan's to establish military domination in the Pacific, and Al Qaeda's simply to wreak havoc, or what have you--but in broader terms each represented a physical challenge to the United States' influence over particular spheres. And besides, the point that's trying to be made here is exactly that: There may not be any more "Pearl Harbors," if you want to define Pearl Harbor as a military attack by a sovereign nation. But if you want to define "Pearl Harbors" as serious, potentially dangerous attacks against the US, they are more likely these days to be of a terroristic or digital nature. You're missing the forest through the trees, my friend.

Nit-picky about the necessity? Two countries were invaded without posing any threat to the US!

"Pearl Harbor may have forced our hand more clearly, so to speak, but both attacks were deep provocations."

What exactly was 9/11 a provocation to do? Most of the people involved were already dead, and they weren't state actors - they were private citizens. What exactly was that a provocation for the US to do?

"each represented a physical challenge to the United States' influence over particular spheres."

One represented a challenge to physically and economically dominate the Pacific for the foreseeable future. One represented a challenge to the structural integrity of some buildings in New York. The scale, effect and consequences are so fantastically different that I genuinely struggle to understand how they can be seen in principle as the same thing.

"But if you want to define "Pearl Harbors" as serious, potentially dangerous attacks against the US"

By this definition, 9/11, which was not a serious, potentially dangerous attack against the US, was not a Pearl Harbour. It was a criminal act that killed a lot of people and caused a lot of damage. It was not a serious threat to the US.

9/11 pushed the US into a war with Iraq and Afghanistan, created the climate in which things like the Patriot Act flourished and turned the US from a clear supporter of human rights into a nation whose use or non use of torture is a question of semantics. [1]

In addition my perception from outside of the US is, that since 9/11 US popular culture uses terrorists as villains in a similar manner as Nazis or Russian spies before that. (Atop of that, I have a hard time remembering a movie in which the torture of an SS member is depicted as a necessary evil.)

So I am not arguing that the twelve years 9/11 did change the world in a similar magnitude as WWII did, I am arguing that the cultural significance of 9/11 is similar to the cultural significance of Pearl Harbour. Especially considering that the US would have been drawn into WWII anyhow, while at least the Afghanistan war is a direct consequence of 9/11.

[1]https://en.wikipedia.org/wiki/Waterboarding#Classification_i....

"9/11 pushed the US into a war with Iraq and Afghanistan,"

I disagree. The US was not pushed into those wars; the US chose both those wars. Neither of those nations presented a threat to the US, and Iraq had no links to 9/11 (and Afghanistan's links were laughably circumstantial - some of the planners lived there; let's have a war!) - it was simply a convenient excuse for the US to launch into a badly thought-out war.

"Pushed" is indeed a poor choice of wording. But Bush would have had a hard time to get enough political support to invade without 9/11.

The 10-year prelude to each was similar also. The U.S. blockaded trade with Japan from about 1930 so Japan had almost run out of oil by 1941. The U.S. and allies ran a no-fly-zone over Iraq from 1991 onwards.

With somewhat different results, though. Japan blockade - Japan starts a war to secure the natural resources it needs. Iraq blockade - Iraq poses no threat and gets invaded anyway.

Fair point, I stand corrected.

I think the rest of my point in the second paragraph stands though.

this is why i love HN where reasonable people are willing to consider different perspectives and make their choices of conviction. thanks for the conversation.

Step #1 to protect your private data - Have a separate computer, Ubuntu (or some secure OS) installed and disconnect it from the internet permanently. If you want to access any data, just go use the computer and save the data then and there. If you want to transfer data from this computer to another computer, just use a separate encrypted pen drive to transfer between files securely.

If you don't want to use it, just turn it off. I'd love to see how the Chinese/Russian hackers can hack such a machine, unless they have physical access to them.

But what is a gigacorp to do? Make all their employees never use Windows/email/internet again during work hours, and run around the office building carrying USBs?

Also, how can you be sure that Ubuntu is secure? It seems to me that there is a general problem with all *NIX systems with regards of how they (mis)manage permissions (either file permissions or OS permissions), and I'm very sad that not even the newly-developed OSes (Android) have not fixed that!

How does Unix mismanage file permissions?

User, group, other and read, write execute has been around for decades. You won't find a simpler, more understandable system for file permissions. There are many more complex systems added on top of this, but the basics are simple and easy to manage.

All permissions are inherited by all user's processes, with no better granularity possible. That is a recipe for disaster and the core issue with most of our security problems. Android is a bit better, since it has specific permissions on a per-process level (or so it looks like), but you can't really manage them.

Didn't stuxnet spread itself to air gaped machines through USB sticks?

Step #2 migrate to OpenVMS ;)

If Chinese hackers want what's on a given hard disk, there's no way to stop them.

To which I answer, air gap.

Yes, the air gap can be compromised, but at that point you aren't just talking hackers in China. You're talking organized crime with cat burglars breaking into US facilities.

You're talking organized crime with cat burglars breaking into US facilities.

Another method is Social Engineering.

Sure we can secure a certain piece of information if no one has to ever access it. Hard drive in a locked box inside some bunker type of thing. It becomes hard when the information must be easily accessible to multiple persons operating from different places.

>I believe that Chinese hackers are the scariest thing in the world today.

I'm much more worried about nuclear weapons, Authoritarianism, and biological warfare.

Also drunk drivers, lightning strikes, and spiders...

Seriously, who actually experiences fear because of chinese hackers?

After reading the article, that would be me. Why do you think they've worked their asses off to be able to shut off our power grid? Can you think of an explanation that isn't just a little bit spooky?

You think the US government doesn't do similar things in China? Should people living in China be spooked?

Thats really not an answer.

Just because people in both countries can now face a new angle of attack doesn't mean that there is something to not be spooked about. People in both countries should be equally spooked.

The USA has more to lose in this battle - for a nation moving away from manufacturing and aiming to keep a tech lead for its economy - China's actions eventually would mean check mate.

Why would the Chinese want to shut off the US power grid? The reason why they built nukes to defend against Russia and none to defend against the US is they want to take over the US by immigrating there in large numbers. Australia/NZ and Canada today were just trial runs. There were 1 million ethnic Chinese in the US in 1990; by 2010 there were 3 million. Extrapolating the geometric series, 10 million by 2030, 30 million by 2050, and 100 million by 2070. Their students are coming to rent the houses, get jobs afterwards, then buy the houses. Americans will vote for the government that lets in more rich Asian immigrants, so house prices go up higher. By 2100, the US will be a majority Chinese nation, and the Ming Dynasty's big mistake of closing down Zheng He's 15th century treasure fleet will have been rectified.

Problem is, they would probably shut themself out if they turned off the power...

Any Engineering or Security employee on any non-Chinese big tech company. He'll I'm not even sure if Chinese companies, maybe the ones who are backed by China govt., are not worried.

The Chinese government?

I'm not exceptionally worried about China's nukes. They understand MAD. I'm more worried about the middle east.

Authoritarianism is more worrying if it's in the country I'm standing on.

My main fear with biological warfare is non-state actors. As it becomes possible to do more with less, the chances of fundamentalists and other malicious parties using biological agents for terrorism or worse go up.

The Chinese government made a statement last year about MAD. It basically boiled down to their population being so large and spread out so far across china that they would still have a large enough population base to continue on past past the Armageddon to rebuild while everywhere else would suffer a lot higher casualty rates because a lot of the developed world is concentrated in large cities.

IIRC one of the main reasons MAD was a threat to the Russians was because they're populated centres are mostly in one area of the country.

Its all saber rattling regardless I guess, as china develops they'll be more so concentrated in cities like everyone else.

All of the most populous, productive area of China are concentrated along the coast and around the four main inland cities: over 3/4s of Chinese GDP comes from these, which cover relatively little area. China might be less vulnerable than the USSR was to targetted nuclear strikes, but I doubt it is less so than the US, and I doubt Chinese leadership believe China would have the advantage against the US if a military conflict turned nuclear.

Who made the statement?

There was a Chinese general (Zhu Chenghu) who has made several controversial statements to this end, including that initiating nuclear war would be acceptable in case of US intrusion in Taiwan (still considered by most mainland Chinese as a Chinese possession). However, to the best of my knowledge he hasn't been in the press the last couple of years.

As far as I'm aware, their strategy is based on a scenario where the US can and does defeat it in a nuclear war.

And hence that strategy works to prevent that attack, not defeat it...

Have a bunch of relatively large (much larger that the US's) warheads strike American cities exclusively. Forget about military targets.

The Chinese nuclear arsenal was built to deter the Soviet Union. That is why it consists primarily of medium-range missiles. The Russian population is concentrated in European Russia, which is easily within range of a medium-range nuclear deterrent based in Western China.

This deterrent is ineffective against the United States. The medium-range missiles cannot even hit Seattle, much less Miami. The entire Chinese ICBM force consists of 20 missiles with non-MIRVed 5-megaton thermonuclear warheads.

Thus, in terms of nuclear weaponry, the United States outguns China by about 2000-to-20. This is why their plans assume defeat in a nuclear exchange -- because it is a virtual certainty.

http://en.wikipedia.org/wiki/People%27s_Republic_of_China_an...

You are correct on the number. But the part about the Soviet Union, Im not so sure...

> History

Mao Zedong decided to begin a Chinese nuclear-weapons program during the First Taiwan Strait Crisis of 1954-1955 over the Quemoy and Matsu Islands. While he did not expect to be able to match the large American nuclear arsenal, Mao believed that even a few bombs would increase China's diplomatic credibility. Construction of uranium enrichment plants in Baotou and Lanzhou began in 1958, and a plutonium facility in Jiuquan and the Lop Nur nuclear test site by 1960. The Soviet Union provided assistance in the early Chinese program by sending advisers to help in the facilities devoted to fissile material production, and promised to provide a prototype bomb.[12] In July 1960, however, during the Sino-Soviet split, all Soviet assistance with the Chinese nuclear program was abruptly terminated and all Soviet technicians were withdrawn from the program.[13]

Whatever the original reasons for China's atomic bomb program, they became completely irrelevant after relations with the Soviet Union deteriorated.

By 1964, when the first Chinese atomic bomb was tested, China was barely on speaking terms with the Soviet Union. By 1969, China and the Soviet Union were on the brink of war. The Soviets tripled their forces in the Far East during the 1960s, deploying fully one-quarter of the Soviet military along the Chinese border. (They did this without drawing down their forces in Europe, which placed quite a strain on the Soviet economy.)

After Nixon visited China in 1972, Henry Kissinger even gave security briefings to Chinese generals, supplying them with satellite imagery and the location of Soviet forces.

They have to say things like that, because you need the other side to believe you will use your nukes for them to be an effective deterrent. Nobody actually wants to use them.

> As it becomes possible to do more with less, the chances of fundamentalists and other malicious parties using biological agents for terrorism or worse go up.

I just thinking the other day, once home-made drones become capable enough of carrying loads of up to 5kg then what would stop such a potential malicious "non-state actor" of using such a drone fully-loaded with chemical nasty stuff to bypass all the obsolete ground-security system at a big open-air event (say, the Super-Bowl or any other sports event attended by 70,000+ people) and cause harm to most of all those present?

> People absolutely freak out when they suspect the US government of spying on a citizen.

Why would they only spy on citizens? They have a long history of sharing corporate espionage when corporate data is snatched in their net (http://archive.newsmax.com/archives/ic/2005/12/19/114807.sht... and https://en.wikipedia.org/wiki/ECHELON#Controversy). Economic espionage by governments began way before internet even was a thing.

Not that this makes it right for china to use hackers for the same goal, but at the same time it is nothing new. The biggest difference between NSA and the Chinese hackers are that the NSA are mostly passive listeners on the wire, passing along what they "hear" to corporations. Chinese hackers are more active listeners, and pass along what they "find" to corporations. Still, not much of a difference in my book.

>Chinese hackers have more power than the CIA, KGB and Gestapo combined, and nothing short of WWIII can slow them down.

A bit over the top? You really aren't suggesting a start to WWIII over a couple of nytimes articles right?

I don't think you know what saber rattling actually means.

If the U.S. government has deemed cyberattacks as "acts of war", and the superpowers are already lobbing such attacks at one another, I'd argue that we're already well into WWIII: https://plus.google.com/112353210404102902472/posts/T4THntTx...

Meanwhile... Touchscreens and centralized tabulators weren't nearly unreliable and insecure enough. The new thing is internet voting, meaning casting ballots via email. What could possibly go wrong?

The motivator is the election vendors are pushing for a per-registered-voter fee business model. Election integrity be damned.

@hooande: Sounds like you work for the Chinese Hackers. Anonymous > (beats) Chinese Hackers hands down any day.

Ref: http://www.huffingtonpost.com/2013/02/19/anonymous-hackers-c...

Reply on news.ycombinator.com