Marriott Data Breach Traced to Chinese Hackers, US Readies Crackdown on Beijing

https://www.nytimes.com/2018/12/11/us/politics/trump-china-trade.html

by jumelles • 8 years ago

195 136 8 years ago

stcredzero2• 8 years ago

Given the long history of nation-states engaging in false flag premises for both diplomacy and "diplomacy by other means," how much scrutiny should we give to nation-states claims of hacking? How easy or hard is it to fake such claims? I should think it's much easier to fake than hiding nuclear weapons or instances of armed violence.

NegativeLatency• 8 years ago

Could’ve contracted it out too. It’s not necessarily the Chinese State, could’ve been freelancers hired by someone else.

mc327• 8 years ago

People do this all the time when they don't want to believe. At one point people didn't want to believe North Korea was the perpetrator of the Sony Hack, for political reasons, but then for other political reasons people were sure it was North Korea. Just like the email hacks --people tend to believe or not believe depending a lot on their ideology and how it aligns with them, unfortunately.

colordrops• 8 years ago

Typically these situations where belief follows political lines are an indicator that there isn't strong evidence to support either interpretation.

netsharc• 8 years ago

I also wanted to mention the Sony hack, and on the Wikipedia page there's a section quoting experts who doubted that it was them who did it. Associating this with sanctions against Chinese networking companies makes me think that it's just too convenient of an excuse.

stcredzero2• 8 years ago

People do this all the time when they don't want to believe.

I'm fine with the prospect of China hacking the US. It fits in just fine with my world view. However, there's also the sinking of the Maine, the Gulf of Tonkin incident, and Iraqi WMD. Skepticism is called for.

freeflight8• 8 years ago

People do this all the time when they don't want to believe.

People do this all the time because people working in the sector know [0] that attribution, with anything "cyber", is near impossible, if the attackers know what they are doing it actually is impossible. As such most attribution usually boils down to guessing games based on code samples and used attack vectors but rarely, if ever, on anything actually solid.

[0] https://www.schneier.com/blog/archives/2015/01/attack_attrib...

adventured• 8 years ago

For over a year there has been widespread reporting of a surge in Chinese hacking, since the trade conflict began with the Trump Administration. Before that, the Obama Administration managed to get a brief cease fire, during which reports of Chinese hacking plunged dramatically.

So what exactly was the Obama Administration getting an agreement on? China was doing it before, stopped after a publicly acknowledged agreement with the Obama Admin, and then it's so far fetched that they'd start up again during an increasingly aggressive trade war as to be worthy of false flag considerations - I don't think so.

If it was China in this case, it's nothing more than par for the course for how they've been behaving for the last decade plus. It's an invaluable tool in their arsenal for dealing with the US in a variety of regards.

varenc• 8 years ago

I'd be really interested in seeing the declassified intelligence the article mentions that points the finger at Chinese-intelligence. While proving that the attackers originate in China might be easy, clearly connecting this to a government-supported operation seems quite a challenge involving long chains of reasoning. It's probably not feasible to release all the info needed to independently verify this, but we'll see.

I can also imagine how this line could be blurry... perhaps the government quietly permits more profit motivated blackhat operations in exchange for some intelligence sharing. And really the perfect "cyber attack" shouldn't be attributable at all.

n-gatedotcom2• 8 years ago

Replace Chinese with Russian and ask yourself if you still want to see the declassified Intel.

i_cant_speel• 8 years ago

I'm not sure what point you are trying to make with this comment.

pretendscholar• 8 years ago

Why wouldn't we want to see the declassified intel on Russian hacking? What does that even mean?

thanatos_dem• 8 years ago

Yes, I would like to see all declassified intel indicative of any foreign power performing a cyber attack on us. Is that somehow controversial?

cyphar• 8 years ago

You should always ask for evidence for claims. A quick reminder that the US intelligence community lied to the Bush administration about WMDs in Iraq, as well as about the existence of PRISM and related programs. Trusting the intelligence community, in the absence of evidence, is hardly a reasonable standpoint.

Why would it matter if the claim were Russia, China, or North Korea?

striking• 8 years ago

You've violated the prime directive. /hackernews/2017/08/22/0/

meroes• 8 years ago

Are you just trying to sow doubt for China's sake or do you legitimately have issue with what was said by the two sources and Just Dept case.

NotAnEconomist• 8 years ago

perhaps the government quietly permits more profit motivated blackhat operations in exchange for some intelligence sharing

I've long wondered if we're going to see cyber warfare "letters of marque" at some point.

In retaliation to cyber attacks on US companies, the US government could designate Chinese firms with connections to the Chinese government (and particularly those which support the Chinese military) in letters of marque, allowing retaliatory IP theft, permission to cause damages, etc.

If the Chinese government is behind these attacks on US companies, than we are in a de facto state of warfare.

bitxbitxbitcoin• 8 years ago

If we see cyber warfare "letters of marque" imagine if they allow for the takedown of internet pirates without allegiance to any particular country.

nradov3• 8 years ago

I doubt we'll see formal legal letters of marque until and unless we're in a state of open war. The US government already has a policy of using kinetic means to retaliate against serious cyber attacks and other governments take similar approaches. So unleashing a bunch of mercenaries without clear constraints would create a dangerous risk of unexpected escalation.

But federal law enforcement could simply decline to pursue private actors who attacked adversary states. Plausible deniability, to an extent.

acct17715• 8 years ago

The open warfare can't come soon enough, as far as caring about the stability of our infrastructure is concerned.

onetimemanytime• 8 years ago

But total war might follow.

Live by the sword...What if NSA already did the same to China? That's their mission, isn't it? China's "NSA" succeeded but became public.

Our NSA might have succeed dozens of time but China keeps it a secret.

meowface3• 8 years ago

You're right, but there also may be highly sensitive intelligence at play here. If US intelligence has a mole in Chinese intelligence, and/or access to Chinese government systems, they could have smoking gun proof. They may have been able to trace it to them with high confidence even without that proof, but we'll probably never know for sure, since they'll never publicize the real details.

est• 8 years ago

Chinese government is a complex hierarchy. Documented, planed, coordinated attacks are really rare. Most of the breaches are carried out by Chinese civil hackers or contractors, The harvested data was later funneled to government agencies by various markets and cooperative projects.

I've seen one these "lone wolf" actor preemptively collecting emails of a very high profile target via sophisticated penatration (APT? LOL), then sold these data to a state-owned enterprise. In exchange his hacking violations were cleared.

The government simply kept a loose end to these kind of foreign hacks. For domestic offense, the rules are very strict. Some dude famously posted some kind of minor XSS vulnerability of a random PLA veteran management site, then the hole public disclosure site was shutdown by the government and site admin was jailed. LMAO. So today the Chinese underground market was more active than ever before, because there are no more free bugs.

resters• 8 years ago

The article mentions that the US Government has not attributed the hack to China. This step has been done by private security contractor firms who "notice a lot of similarities" with other hacks attributed to China.

This is extremely weak reasoning. Any state actor would have the ability to cover its tracks, and more importantly to frame other state actors.

The article ends with a bit of classic anti-communism fear mongering.

jonnybgood2• 8 years ago

It wouldn't be the first time a private security firm exposed Chinese hacking.

https://en.wikipedia.org/wiki/PLA_Unit_61398

Mandiant's report: https://www.fireeye.com/content/dam/fireeye-www/services/pdf...

jonnybgood2• 8 years ago

While proving that the attackers originate in China might be easy, clearly connecting this to a government-supported operation seems quite a challenge involving long chains of reasoning.

Connecting to a government-supported operation has already be done before [0]. There probably isn’t that much difficulty to do it again.

[0] https://en.wikipedia.org/wiki/PLA_Unit_61398

mancerayder2• 8 years ago

But while top administration officials insist that the trade talks are proceeding on a separate track, the broader crackdown on China could undermine Mr. Trump’s ability to reach an agreement with Mr. Xi.

Mr. Trump, in an interview with Reuters on Tuesday, said that he would consider intervening in the Huawei case if it would help serve national security and help get a trade deal done with China. Such a move would essentially pit Mr. Trump against his own Justice Department, which coordinated with Canada to arrest Ms. Meng as she changed planes in Vancouver.

I wonder if it's because Huawei's equipment or staff played a role, or if they just want to use Meng as a bargaining chip in the demands regarding cybersecurity and IP.

jorblumesea2• 8 years ago

Meng's father, Ren Zhengfei, is an ex-PLA officer and has deep connections to the CCP. Her arrest and the timing of it are not coincidences. Notice the reaction of government media outlets in China.

It's a direct method of pressuring China's political elite.

acct17715• 8 years ago

Where would an English speaker be able to do this?

mancerayder2• 8 years ago

Someone downvoted me, but I'd like to point out to the genius that did that, today's FT article titled, "Trump makes Huawei CFO a bargaining chip" (FT, Dec 13, 2018) which is what I was asking.

wybiral10• 8 years ago

People demanding to see evidence here have to realize that information like that tends to stay classified for some time as ongoing operations are put in jeopardy just by announcing this.

It's also from the justice department, meaning multiple groups of eyes were on this decision, not a few anti-China hawks. China does have a history of this kind of behavior.

King-Aaron3• 8 years ago

I honestly find it quite concerning how much pro-chinese-government support bubbles up on platforms like HN, etc. Nothing against individuals in China, but as an entity the government (as with all governments) should be heavily scrutinized.

It's definitely the government's SOP to try and exfiltrate data from the west, and it's no small secret. I feel everyone is getting pretty nonchalant about it.

wybiral10• 8 years ago

I've noticed that too. Some of it might be suspicious but I suspect there's just a lot of misinformation, disinformation, and feelings floating around.

solotronics• 8 years ago

I made a comment (that was the top comment on an article about fentanyl) criticising the Chinese for promoting labs making illegal and highly dangerous drugs such as fentanyl which they send to the west. My post was flagged and taken down!

joejerryronnie2• 8 years ago

This is what a concerted government propaganda campaign looks like in today’s digital world.

Edit: witness the downvotes - my point exactly.

nodesocket• 8 years ago

I think it's fair to acknowledge there is a non-trivial amount of users from China on HN, with their own agenda. Just as I am American, and pro-America, I am sure they are pro-China.

With that said, China has a history of bad behavior, especially with regards to cyber-warfare against US companies.

dillondoyle• 8 years ago

I would love to see an analysis of HN comments. I don't even know if there is already a dataset of all HN comments to analysis or if someone would have to scrape..

It feels to me either my personal bias of where I think the world opinion stands is off (e.g. # of ulta-defensive of China comments > I expect), or there is in fact organized pro-china comments. Maybe a mix of both!

kochikame• 8 years ago

Just yesterday some people were commenting how there has been a marked rise in ANTI-Chinese government comments on HN recently

I think there might be a lot of confirmation bias going on

zaptheimpaler7• 8 years ago

My problem with it is that the US government does plenty of horrible shit, including spying, warfare and torture.

The Snowden leaks showed without a doubt that US intelligence has no qualms collecting and admitting to spying on ALL communication between non-US citizens. Without telling anyone... hacking a marriot database is peanuts in comparison.

Somehow whatever the US does to protect its interests is moral but when another country does the same its evil or "concerning". Bullshit US paternalism.

blackoil• 8 years ago

HN is now a pretty global community with enough presence outside western world. So as an Indian, I have no dog in fight (except that I stayed in Marriott, so my data is probably leaked), but I have absolutely no trust in both US and Chinese government and media and for that matter Indian govt and media.

It is very much possible that Chinese hackers got this data because they could and it is lucrative and then sold to players including govt. And US intelligence is only passing selective info. to show Chinese govt as the primary perpetrator.

saltedonion• 8 years ago

Isn’t the justice department under the executive branch? With head appointed by the president? Or are they the judicial branch and have independence?

wybiral10• 8 years ago

It's exec but a decision like this would still require numerous people.

Not that situations haven't arisen where exec is in disagreement with intel (Iraq, for instance) but that's pretty rare. And it's hard to tell exactly until more info comes in and other agencies corroborate.

My point was that this isn't one person trying to start something. Multiple people had to be involved if what the Times is reporting here is correct.

Not everything is a conspiracy.

mindslight• 8 years ago

People demanding to see evidence are already falling for a trap of a narrow Overton window. The Internet is hostile noise, and it does not really matter "who" hacked whatever - what matters is who created and maintained such ridiculously insecure systems. And no, I'm not talking about the actual servers themselves - but the business practices of keeping a surveillance log of every hotel guest ad infinitum.

nradov3• 8 years ago

The US government lost all credibility for this type of claim in 2003 when they manufactured intelligence to justify the Iraq war. So it's not surprising that people now demand verifiable evidence.

wybiral10• 8 years ago

That was the administration vs the intel community. There were CIA reports advising the administration that there was no clear evidence but the admin pushed the WMD narrative really hard because of a potential.

Even then, it was more complicated than that because Iran was on the verge of attacking Iraq (which is probably why the admin and military were pushing to move in the first place).

Tangent aside, it's different when US administrative, US intelligence, and multiple other countries are in agreement about Chinese hacking and intellectual property theft.

AndrewKemendo2• 8 years ago

The sad reality is that the tech community has basically zero faith in the US government.

This is not my position, but it's very clear that is the most vocal sentiment being expressed and seems to be the most prevalent even among those who aren't very vocal.

wybiral10• 8 years ago

I don't think that the faith in China is much greater among most of those people. It's just that the censorship among anti-China sentiment is more aggressive than anti-US.

duchenne• 8 years ago

Thanks to Snowden, we have hard proofs that the USA have been using hacking on a very large scale for multiple goals including industrial espionage.

Now, they say that their #1 economic rival is using hacking to steal data. But, there is no evidence.

At least, before the Irak invasion, the US made some efforts to forge some fake proofs that Sadam had weapons of mass destruction.

HillaryBriss• 8 years ago

what is it about China and Marriott hotels?

there was also that time they made the company fire that employee https://news.ycombinator.com/item?id=16515274

ArchD• 8 years ago

“China firmly opposes all forms of cyberattack and cracks down on it in accordance with the law”

"In accordance with the law” is the sneaky part that lets them add all kinds of 'Chinese characteristics' to whatever topic is being discussed. Their 'law' is often phrased very broadly and interpreted with lots of freedom and in practice is whatever the CPC wants. This is how they say one thing and do another, always "according to the law".

tamizhar• 8 years ago

This is how they say one thing and do another, always "according to the law".

Wasn't there a country that alleged yellow cake, WMD and other things in order to facilitate a grand mess in the Middle East. All perfectly legal according to the law, right?

meowface3• 8 years ago

Yes, but there is not yet any proof that Bush or Cheney lied about these things to start the war. Many in the CIA were genuinely convinced that Saddam had WMDs and/or resources to create WMDs. They turned out to be completely wrong, but it was their belief at the time. I wouldn't exactly be flabbergasted or Bush or Cheney willfully lied, but just because that's a common narrative doesn't mean it's substantiated.

Gulf of Tonkin would be a much better example.

jorblumesea2• 8 years ago

I really hope the Western countries severely curtail China's ability to operate in the West. Ban their companies, ban party officials and employees operating in the West, completely lock them down and out of the rest of the world.

They need to understand there are real consequences for these actions.

golfer2• 8 years ago

Ban their companies, like Foxconn, that builds all iPhones?

What about all the hundreds of billions of dollars in other goods that are manufactured there that the West is reliant on?

I also want to see consequences for these actions, but the situation is more nuanced than you seem to realize.

abc-xyz• 8 years ago

It's not like China is the only country capable of building iPhones and other goods. Taiwan, Thailand, Vietnam, etc all seem like good alternatives until the goods can be manufactured in democratic countries with the help of robots.

Would the western countries, companies and consumers suffer economically? Sure, but sometimes it's necessary to make sacrifices for the greater good, and it would be very shortsighted to ignore the threat China poses to the world.

fiblye• 8 years ago

Foxconn is a Taiwanese company. They'd be unable to export things from their Chinese factories, but I doubt it'd affect them much.

ShorsHammer• 8 years ago

Do you think the average voter cares more about this than being able to buy an iPhone?

verroq• 8 years ago

I doubt turning China into the next North Korea will help it develop into a modern democracy.

zachguo• 8 years ago

Hey, how about voting for another Chinese Exclusion Act? I think all Chinese people gonna thank you for bringing those talents settled in US back home.

joshfraser• 8 years ago

Anytime the government claims that a hack originated from a specific country, assume it's politically motivated.

Angostura2• 8 years ago

... or that they have evidence that the hack originated from the specific country. One or the other.

SmellyGeekBoy• 8 years ago

Why not both?

tremon• 8 years ago

The decision to make the hack public is always political.

royalconcierge• 8 years ago

http://m.spiegel.de/international/europe/gchq-monitors-hotel...

did everyone forget the Snowden docs? NSA program ROYALCONCIERGE already hacked into Starwood hotels and stole their entire database of booking and guest dox. worst of all, the hack is persistent and tips off NSA in real time the moment Abu Bakr Baghdadi checks in. or what if this hack was oh say The Shadowbrokers using NSA'S backdoor to shame NSA and close the peep hole spying on every guest of every Starwood hotel in the world? how do we really know this hack wasn't NSA itself? who can you trust? trust no one. only believe what you have seen with your own 5eyes and certainly never let spooks who lie for a living trick you into going along with another Iraq war based on forged evidence with all the Intelligence chiefs and crooked FBI directors swearing to you on national TV that you just need to trust them, because the evidence is classified, so they can't prove it to you, but you need to get on board with believing in the new false flag Gulf of Tonkin and cheering for the new war. if you don't support the war, then you disrespect the troops and you should get the fuck out of America.

by the way,the Mirai hotel in Hong Kong where Snowden escaped to is a Starwood hotel. isn't it funny that ROYALCONCEIRGE didn't tip off NSA as to exactly where Snowden was the whole time? or maybe it did work and they were watching him all along.

diebeforei485• 8 years ago

This make me curious about whether "national security letters" have been sent to Airbnb.

lern_too_spel• 8 years ago

NSA program ROYALCONCIERGE already hacked into Starwood hotels and stole their entire database of booking and guest dox.

Your linked article makes no such claim. The specified program mentions neither the NSA nor Starwood Hotels nor hacked databases. It's a GCHQ program that appears to work on email messages collected elsewhere.

dsplittgerber• 8 years ago

Sorry to be nit-picky, but that sounds conspiracy theory-ish. The link you provided does not back-up your claim of the NSA having hacked the Starwood database. The linked article makes it sound like as a by-product of massively vacuuming up internet traffic, GCHQ has been able to track hotel booking confirmations sent to gov.whatever addresses. Which is noteworthy but (legally and morally) not as sinister as active measures.

setquk• 8 years ago

I thought this was Marriott's fault? Perhaps US should crack down on Marriott...

sgt• 8 years ago

That was my thought as well. If this is due to gross negligence from Marriott's side, it's more their fault than the hackers. At least that's my personal opinion.

craftyguy• 8 years ago

Exactly. This is actually excellent news for Marriott since it firmly shifts the blame and attention away from them.

AzzieElbab• 8 years ago

An internet facing rdp with user name and pw creation guidelines should be "traced" back to Marriott 's IT.

Marriott Data Breach Traced to Chinese Hackers, US Readies Crackdown on Beijing

Related Stories