Cyber Sleuths Track Hacker to China’s Military

http://www.wsj.com/articles/cyber-sleuths-track-hacker-to-chinas-military-1443042030

by vinnyglennon • 11 years ago

104 51 11 years ago

wsj.com

dogma11382• 11 years ago

Google redirect: https://www.google.co.uk/url?sa=t&rct=j&q=&esrc=s&source=web...

jstanley• 11 years ago

Still paywalled for me, even following that link.

dogma11382• 11 years ago

try opening it in a private tab, Google tracking cookies seem to break it for some reason.

spuiszis• 11 years ago

Copy and paste the article title into a Google Search and click the article link in the search results.

at-fates-hands• 11 years ago

If you get the paywall, I'd advise downloading the actual report from ThreatConnect it's far more detailed:

http://www.threatconnect.com/camerashy/

striking• 11 years ago

And if you want to get past the paywall, Google the link and open it from the search results.

billyhoffman2• 11 years ago

Why do companies, security companies even, do something like this... " Below are the document checksums for Project_CAMERASHY_ThreatConnect_Copyright_2015.pdf

MD5: b12f118840d0aa0d5ab2fb9aa052ede3 SHA1: dbd710751a6c32ba91401fb5e5623f46b4d2475f SHA256: da6b105f1e58f860ce67b2ad2db7b15ff7b637cfb37f7d0680a20eb633bcc741"

... when you are then providing both the PDF, and the list of its supposed hashes, over an unencrypted connection! It renders it meaningless. I can't trust those hashes or that document. And creating megabyte long PDFs with colliding MD5 hashes is not even a difficult challenge anymore.

The irony here is this page is say "hey open this document, it's safe, trust us" when the document is all about APT attack methods, which often involve compromising people's computers by opening untrustworthy documents! I doubt that's what's happening here, but still kind of silly when you think about it.

Please, all the companies out there. Stop adding a list of hashes to appear more legitimate when you clearly don't know what you are doing.

mizzao• 11 years ago

creating megabyte long PDFs with colliding MD5 hashes is not even a difficult challenge anymore.

Source, please? Suppose the hashes and PDF were provided over HTTPS. How would it be easy to create another document that collided with all 3 hashes?

Not trying to be facetious - just wondering.

ghshephard2• 11 years ago

Well, not meaningless. You can monitor the original values of the hashes, and verify they haven't been changed. The PDFs will be copied around and around.

Also - There is no known method to (within the lifetime of this universe) create a different document with the same MD5 and SHA1 and SHA256. Adding the MD5 doesn't weaken things, and might improve them.

arielby• 11 years ago

A few years ago it was popular to serve files via a not-really-trusted mirror (e.g. Sourceforge), while serving the website via a personal server.

bobmagoo• 11 years ago

Ugh, not these guys. Hopefully the WSJ article had a better source. ThreatConnect will take any random connection and a big brand name / country and crap out a report.

meowface• 11 years ago

I've found ThreatConnect's reports to be alright compared to many other security companies. Could you link a report with sloppy research?

antsar• 11 years ago

Without having read the full PDF report [0], the summarized version [1] makes the allegations seem quite weak. It comes down, seemingly, to the fact that a PLA domain name appears in the malware. Maybe I'm missing something.

[0] http://cdn2.hubspot.net/hubfs/454298/Project_CAMERASHY_Threa...

[1] http://www.threatconnect.com/camerashy-resources/

huac2• 11 years ago

Looks like PLA domain shares name with probable PLA employee social media handle. And the social media accounts were deleted immediately after the WSJ called the guy.

It seems pretty likely there is some PLA connection, though not necessarily to this particular guy - no way of knowing that a buddy didn't steal his handle for use elsewhere (seriously, not sharing the same hacking handle and the same personal username should be Tradecraft 101)

late2part• 11 years ago

I wonder if China online newspapers have stories about tracking hackers to USA's military?

halviti• 11 years ago

http://finance.qq.com/a/20130624/011309.htm

kposehn• 11 years ago

I think it is very important to understand that the timing of this report is likely no coincidence. With Xi set to have discussions today with Obama, this is effectively a slap across the face to Xi right before an important visit that he can't back out of, and effectively puts china on a lower footing by showing them to be lying directly to the US about their intentions.

Edit: this isn't to say publication/announcement was done at the administration's request, simply that the timing is extremely suspect. Other interests also want to see Xi brought down a few pegs. Politics :-/

aNoob7000• 11 years ago

I think Xi meeting with Silicon Valley business executives before meeting with Obama wasn't any better.

pasbesoin• 11 years ago

I have no doubt there is significant espionage going on.

What the last some years have done, however, is to make me rather distrusting of both sides.

I may be in the minority. But a democracy is in significant trouble when its own population no longer trusts and believes it, in the large. The leadership either turns increasingly autocratic, or it loses its power.

The t-word wins again. The lies told ostensibly because t-word, are proving to be far worse than the original risk of t-word.

And instead of effective oversight to harden our own systems, we have blindness, lack of accountability, and scapegoating.

It's not just the data collection that makes me distrust the Feds. It's its gross mis-management, abuse, and the insistence that I can't know what is going on.

So, pump out your stories about the Chinese. Many of you politicians sold us down the river, in that regard, years ago.

bsder• 11 years ago

But a democracy is in significant trouble when its own population no longer trusts and believes it, in the large.

Actually, democracy is safest when the people distrust it.

The real problem is that we have far too many people who are either completely trusting or totally inert.

mc32• 11 years ago

It's possible this was coördinated, but likely it's rather one of those current trends things. Like on HN, article on X comes up, and soon after article on tangent of X comes up shortly after riding the coattails of X.

Mr Xi is in town, what else related to Xi can give us more eyeballs now that all things Xi/China are in the news, what do we have? Oh, yes, of course, spying!

peter303• 11 years ago

Ironical MSFT and FB are fawning over Xi's visit giving him the royal tours. China treats these two companies very poorly. Nearly all MSFT software in China is pirated. China bans FB partly for censorship and partly to protect internal social networking products.

huac2• 11 years ago

Yes, so perhaps as a result, China will be more favorable to MSFT and FB.

wsterling• 11 years ago

MSFT and FB want to maintain and increase access to the 1.35 Billion people of China. Not ironic at all, those companies need to be in China even if treated poorly.

happywolf• 11 years ago

MS technically has ability to shut off and cripple any pirated Windows over the wire if it wants to. But in this case, it has chosen not to for a lot of Asian countries. The reason? Market share.

It wants users to get used to how Windows works, versus to other alternatives like Linux, Mac, etc.

webXL2• 11 years ago

"Grassroots" hacking isn't a good strategy for a state that wants to cover up its tracks. So I'm suspicious of these claims.

Perhaps the government makes it worth the hackers' while to hack the USG instead of it. Just sad that so many intelligent people would rather be powerful/wealthy than free (not that the USG is a shining example of that sentiment).

tellthetruth12• 11 years ago

You are Not free if you are poor and powerless!

webXL2• 11 years ago

I'm not sure I understand your point. What does material possession and power (I assume over others) have to do with freedom?

These hackers have power (their ability to obtain government data and subvert its power) and the Chinese government is perhaps wisely channeling it to its foreign adversaries.

mladenkovacevic• 11 years ago

WSJ, CNN, Fortune all lining up this latest PR story line right on cue.

It's embarrassing to see the flailing of the US intelligence apparatus trying to take attention away from their own abuses of power.

sandworm1012• 11 years ago

Having read many of these reports over the years, this one seems more manifesto than security report. It is full of carefully controlled language meant to appease a very specific audience: politicians and members of various agencies.

A huge amount of space is dedicated to tenuous ties between physical military activities and espionage on the assumption that all chinese agencies are coordinating with each other, that the Chinese are just better at conspiracy than any US operation. No actual intelligence officer would ever describe China in that way. It's a patchwork of poorly-connected operations all trying to put on a good show for the bosses, much the same as US intelligence agencies.

Certain key phrases suggest political motive. As example, the phrase "China’s ... military grade signals intelligence Unit" caught my ear. "Military grade" doesn't mean much in infosec. It does mean something to lifelong service members who labour under the assumption that military structures just do things better than civilian organizations. In some fields "military grade" is actually a bad thing, a reference to products built to conform to rarely-updated procurement standards. It's like still selling floppy disks because the computer on the stealth bombers haven't been updated in 20 years. The phrase appears right at the start of the takeaways section, right where most senior officials will probably start reading.

The drilling down upon a few people, to the point of tracking a man's movements and finding the bike he offered for sale, certainly plays into current US national security desires. Targeted killings based on poor intel is a big chip on the military shoulder these days. They aren't happy about it. So peppering a document with a few grains of seemingly accurate and specific intel about individuals is a good trick to win people over. The excessive reliance on google maps is just eyecandy. This gives the false impression of validity, a false suggestion that the rest of the report is based on equally detailed and reliable intel. if this were such intel, it wouldn't be released publicly.

the pdf: http://cdn2.hubspot.net/hubfs/454298/Project_CAMERASHY_Threa...

jgome3• 11 years ago

It's as if China was the universal scapegoat for infosec people in the US... Wait, this is a known fact in infosec circles.

sandworm1012• 11 years ago

A scapegoat would be innocent. I doubt even the Chinese would argue they haven't done anything. That's much of the problem generally and with this document specifically. If you latch onto things and investigate them to death you will in time run across actual wrongdoing. The danger is then that you cherry-pick these truths and spread them to each and every situation, giving the appearance of overwhelming wrongdoing. I think the people behind this document have done this knowingly.

ChrisArchitect• 11 years ago

Cyber Sleuths cyberespionage cyberwarriors cyberspace cybersecurity cyberintrusions cybertheft cyberspying cyber operations

pastycrinkles• 11 years ago

You forgot about the cyber military!

jkrejci• 11 years ago

China is fucking shady.

ldpg• 11 years ago

This sentiment is heard too often. It comes more from xenophobia and propaganda than from reality. In reality China is about as duplicitous as we are.

astaroth3602• 11 years ago

I mean isn't it already widely accepted that China has one of the world's largest and most active cyber warfare forces?

When is the US going to get its shit together and start worrying about cyberdefenses?

jgome3• 11 years ago

I mean isn't it already widely accepted that China has one of the world's largest and most active cyber warfare forces?

Do they? I thought the largest "cyber warfare force" (gotta love these buzzwords) was the NSA, and the US govt itself. The US practically controls the internet...

astaroth3602• 11 years ago

Well yes, I imagine the US force dwarfs most others, however that doesn't change my being worried about China's activities.

The whole world needs to start making protection of user data (private sphere) and citizen data (public sphere) a priority. Until that happens, there will continue to be massive hacks of sensitive data that end up hurting very large numbers of people.

It's well past time that the world as a whole started taking the issue of cyber security seriously.

w8rbt• 11 years ago

One of the most difficult aspects of cyber security is attribution. There's really no way to know for certain who did what. Also, it's easy and convenient (right now) for other nations to blame China as cover for their own cyber intrusions. Compromise a few systems in China, launch attacks from them then sit back and watch while others place blame.

CDokolas• 11 years ago

More like "Chinese military cyber-warrior doxed by the WSJ."

Bad guy or good guy, what I worry about is that man's fate... if he hasn't met it already :(

Cyber Sleuths Track Hacker to China’s Military

Related Stories