Apache Log4j bug: China’s industry ministry pulls support from Alibaba Cloud

https://www.scmp.com/tech/big-tech/article/3160670/apache-log4j-bug-chinas-industry-ministry-pulls-support-alibaba-cloud

by chaostheory • 5 years ago

316 140 5 years ago

scmp.com

shell0x• 5 years ago

Glad to live in a free country where we don't praise dictatorships and authoritarianism. The world should just boycott fucking China.

savant_penguin• 5 years ago

We did skip a COVID variant Greek letter to appease the dictator though

addicted6• 5 years ago

That’s not even close to true.

There’s tens of millions of people with that name. The WHO did not want to stigmatize all of them which is why they skipped the letter. It had little to do with Xi Jinping alone.

The WHO moved to Greek lettering to avoid stigmatization faced by people who were being associated with different variants. It wouldn’t make much sense to do the same when you can avoid it by just skipping a letter.

johnebgd• 5 years ago

Agreed.

Watching ADV China really helped me understand how bad the government is over there: https://youtube.com/c/ADVChina

droopyEyelids• 5 years ago

Don't take this to mean I support china or think everything is roses over there, but that channel is simply propaganda. Genorously 40% of it is valid criticism, but if someone in china stubs a toe they will make a 30 minute video about the unsafe furniture epidemic.

beckman466• 5 years ago

Glad to live in a free country

what country is that?

dang• 5 years ago

Nationalistic flamewar will get you banned here. No more of this, please.

No, that's not because we're secretly in cahoots with communists—it's because we don't want a site that consists of lame flamewars and then turns itself into scorched earth and then heat death. We want thoughtful, curious conversation. If you wouldn't mind reviewing https://news.ycombinator.com/newsguidelines.html and taking the intended spirit of the site more to heart, we'd be grateful.

Edit: your previous two comments were egregiously breaking the rules here as well—even worse actually. That's seriously not ok. Please review https://news.ycombinator.com/newsguidelines.html and stop posting like that, regardless of how strongly you feel about $country, and regardless of how legitimate your reasons are (which I'm sure they are). I don't want to ban you but we can't have accounts carrying on like that here.

gred3• 5 years ago

Silver lining: The more audacious the CCP gets, the faster their rule will collapse.

chitowneats• 5 years ago

Wishful thinking. Nothing guarantees that.

gred3• 5 years ago

Optimistic, sure. But historical examples abound.

bostonsre• 5 years ago

I wish but I think they are well enough entrenched so that only a major economic collapse could threaten their rule.

BurningFrog• 5 years ago

Then again, the CCP under Mao was a lot worse, without any hint of collapse.

addicted6• 5 years ago

People’s expectations were also lower. And there wasn’t any incentive for other countries to be involved.

Both those factors have changed. The Chinese people are not gonna tolerate an extended reduction in their quality of life. Anything short of rapid quality of life growth may be catastrophic for the people in power.

And on the other side, other countries have a lot of incentive to further make things difficult for China and it’s leadership.

schuke• 5 years ago

Fast for history, but not for people. Just look at North Korea. They've still got plenty of runway for more audacity. For CCP it's like infinity ahead.

eloisius2• 5 years ago

Unlike North Korea, China doesn't have a China to prop them up as a buffer state.

suifbwish2• 5 years ago

Without the CCP it seems rather unlikely North Korea would continue to exist in its current way for long. The only remaining factor standing in the way of their fall then would be western nations not wishing to accept the sudden flood of North Korean refugees that would immediately emigrate from the country when they are no longer held there.

tjpnz• 5 years ago

China's already sitting on a ticking time bomb thanks to the one child policy. I'm willing to bet that that's equally likely to set about a collapse.

Dolores12• 5 years ago

That's not the case anymore. From [0]

As recently as 31 May 2021, China's government has relaxed restrictions even more allowing women up to three children.

[0] https://en.wikipedia.org/wiki/One-child_policy#Abolition

dathinab3• 5 years ago

Maybe, but what will they do when the collapse comes?

Like there are many cases where governments tried to avoid an internal collapse by applying external pressure in form of starting a war.

anaganisk• 5 years ago

A bit of a reality check : For majority of general Chinese population, Xi Jinping is a great leader. I don’t think thats gonna happen anytime soon.

xupybd• 5 years ago

Why?

Did they want to protect themselves before alerting anyone?

Did they want to use this to infiltrate others?

clouddrover4• 5 years ago

Did they want to protect themselves before alerting anyone?

Probably yes.

Did they want to use this to infiltrate others?

Also probably yes.

The NSA does the same thing. They stockpile security vulnerabilities and selectively tell the software vendors about some of them. They like to keep the "high value" vulnerabilities to themselves for use in exploits.

The WannaCry ransomware (see https://en.wikipedia.org/wiki/WannaCry_ransomware_attack and https://en.wikipedia.org/wiki/EternalBlue) did worldwide economic damage and was built on an NSA developed exploit. The NSA knew about this vulnerability in Windows for years and never told Microsoft.

Unfortunately all intelligence agencies everywhere will continue to take this cowboy approach. Until we can get these bad actors under control, their constant undermining of internet infrastructure will continue to hinder efforts to improve internet security.

ButtSpark69• 5 years ago

It's not the same thing to develop and keep an exploit for yourself, as it is to require the public companies in your country to report the important bugs they find while effectively also under a temporary gag order. They are super different things.

iszomer2• 5 years ago

This gave me a good chuckle.

* Google Project Zero researcher: "we found a bug!"

* NSA (internally): "Damnit, scratch that one off the list boys.."

addicted6• 5 years ago

Probably both? It may not even be so much about this particular vulnerability, but rather just setting the law that any future vulnerabilities must first be reported to the party which can then decide to either defend from it or weaponize it.

my50cents• 5 years ago

There is a rule that requires cloud providers like Alibaba Cloud to report vulnerabilities within 2 days. Alibaba violated this rule.

Note that the article is misleading as the rule doesn't require the disclosure must be made to the government first.

boston_clone3• 5 years ago

Would you mind citing the rule? A similar-sounding policy linked elsewhere doesn't seem to apply to this situation.

yrlihuan• 5 years ago

Your info is accurrate. But I doubt anyone cares about it.

nemothekid• 5 years ago

If this is actually true, this article seems like borderline propoganda.

1una• 5 years ago

They do use this to infiltrate others: https://www.wsj.com/articles/cyber-daily-hackers-backed-by-c...

yesbut• 5 years ago

well, if the US does, why wouldn't other governments?

I guess everyone has forgotten wikileaks and Snowden already.

odiroot• 5 years ago

I would be surprised, even disappointed a bit, if NSA didn't use it for infiltration for a good few months already.

chaostheory• 5 years ago

"China’s internet security regulator has disciplined Alibaba Group Holding’s cloud computing services unit for failing to first report to the government a critical vulnerability in Apache’s Log4j software that has alarmed the cybersecurity community, Chinese media reported on Wednesday.

The Ministry of Industry and Information Technology (MIIT) is suspending work with Alibaba Cloud as a cybersecurity threat intelligence partner for six months because the company did not immediately report a severe bug in the widely used logging software to the government agency, the 21st Century Business Herald reported. The ministry also said it would reassess whether to resume the partnership at that time, based on measures Alibaba has taken to correct the problem.

Losing the support of the agency could affect business prospects for the cloud computing unit of Alibaba, the owner of the South China Morning Post. However, specific losses for the country’s largest cloud business are hard to determine.

The MIIT launched a cybersecurity threat intelligence sharing platform in December 2019 to serve as a state-led alliance in dealing with security threats. Membership in the platform is government recognition of the member’s capabilities in spotting and managing threats.

The MIIT did not publish a public statement about its decision, and Alibaba did not respond to a request for comment.

The Log4j vulnerability has been described as a “nightmare” and “catastrophic”, with some experts saying it is the most severe cybersecurity threat ever by number of devices affected. The simple piece of Java-based software can be found in countless internet-connected devices, from Internet-of-Things products like televisions and cameras to the servers running cloud operations for tech giants like Amazon, Google and Microsoft.

The flaw first received widespread attention when it was publicly disclosed on December 9, after Alibaba Cloud Security Team engineer Chen Zhoujun discovered the flaw. Chen notified the Apache Software Foundation, the non-profit corporation that develops the open-source Log4j tool, by email on November 24.

According to a regulation passed this year, Chinese companies are obliged to report vulnerabilities in their own software to the MIIT through its National Vulnerability Database website. However, the Internet Product Security Loophole Management Regulation, which went into effect in September, only “encourages” companies to report bugs found in others’ software.

The MIIT cybersecurity management bureau released a statement on December 9 saying it was notified about the vulnerability by “relevant” cybersecurity institutions. The ministry summoned Alibaba Cloud and other cybersecurity firms to discuss the situation, it said. It also urged companies and the public to monitor for updates to patch their systems.

Cybersecurity industry norms encourage notifying vendors of security flaws first, giving them ample time to address the problem, before disclosing the issue to the public. Apache released a patch for the Log4j bug on December 6, three days before public disclosure.

Still, the effect of the bug’s discovery is expected to be wide-ranging because of Log4j’s ubiquity. Many people may not even be aware that their systems are compromised.

The exploit, known as Log4Shell, allows hackers to remotely execute code by getting it logged by the software. This became a problem in the Java edition of Microsoft’s game Minecraft, for example, allowing players’ to compromise others’ systems by sending malicious code through chat messages.

Cybersecurity experts on Twitter have commended the Alibaba Cloud engineer for responsibly disclosing the vulnerability directly to the tool’s developers.

Since the bug’s public disclosure, cybersecurity experts have warned of an increase in activity scanning for Log4j on vulnerable systems. Microsoft said on December 11 that it found that state actors connected with China, Iran, North Korea and Turkey have been both experimenting and exploiting the vulnerability."

addicted6• 5 years ago

This is why for all the fear of China, the country cannot succeed on its current trajectory.

Things look great until the leaders are doing well, but all it takes is for 1 bad set of leadership for all to fall apart.

And Xi Jinping has guaranteed failure by removing term limits. Term limits meant that other ambitious political leaders were willing to wait and try their luck next turn. But with no term limits multiple generations of leaders are locked out of even the possibility of becoming the party leader, which means they have become a threat to Jinping.

And since so many people are now a threat to him, his selection criteria for people to lead different parts of the party and government has to be based entirely on loyalty rather than competence.

Which almost guarantees a lot of counter productive incompetence.

baybal22• 5 years ago

This is not how China works. Previous leaders only exited power because they were pretty much ousted, and their power was never really institutionally checked.

Mainland China never been ever close to constitutional rule. It's unbelievably naive to think that term limits would've ever been something other than a decoration, and a propaganda point with communists.

silisili• 5 years ago

That's worked remarkably well for Russia.

addicted6• 5 years ago

From Wikipedia

The Communist Party of China proposed amending the Constitution, for the first time after 2004,[3] including writing Scientific Outlook on Development and Xi Jinping Thought into the Preamble,[4] and removing the provision that the President and Vice President "shall serve no more than two consecutive terms" from the Constitution.[5]

https://en.m.wikipedia.org/wiki/2018_National_People%27s_Con...

suifbwish2• 5 years ago

There were emperors in China and many other countries all through the past several thousand years and it is the expectation of the world that they suddenly give up that entire way of life and thinking in one century?

lambdasquirrel• 5 years ago

That's just plainly not true. Deng Xiaopeng set the country up for orderly succession, and it did work up through Xi Jinping. Hu Jintao and Jiang Zemin both cycled through office without any of the things we associate with authoritarian rulers. There was no execution of your political opponents, after you beat them to office, or afterwards.

The argument has been that China needed a reset badly. Free-for-all capitalism hasn't been so great for most folks in the U.S. either, has it? That has been the justification for the heavy hand of the government during Xi's rule. There's also the argument that Western-style term limits prevent long-term strategic planning.

All of those are really tempting and solid arguments, especially given how corrupt China had become with capitalism-ruling-all, but one really does wonder.

As far as Alibaba goes, it's to my understanding that there are no real alternatives to Alibaba Cloud in China (unless you want to go for a foreign solution like AWS or Azure). It would seem that the current government thinks they can get away with making an example of the company as they see fit. There may be some geopolitical logic to that, because Xi's government seeks to make China more independent after Trump's trade wars, and if you have a big, wealthy internet company drawing in the country's top talent, then that's fewer that's e.g. going towards the semiconductor companies they now seek to bolster.

Now there may have been a "correct" policy solution to this, a la antitrust, but it seems Xi's government prefers to be heavy-handed. For me, that's setting some scary precedents, because as other commenters have said, it isn't clear how succession will be handled going forward, and it may well be brutal.

supertrope2• 5 years ago

The most powerful man in China is the Chairman of the Central Military Commission. “Political power grows out of the barrel of a gun” - Mao. The title President is less important so term limits on that position don’t matter. Recent ”anti-corruption” actions have weighed heavily on Jiang Zemin’s allies

addicted6• 5 years ago

Yes, but that same leader is conventionally also the President.

By eliminating term limits in 2018 Xi Jinping was clearly signaling that he did not intend on relinquishing power.

skhr0680• 5 years ago

The most powerful man in China is the Chairman of the Central Military Commission.

It's interesting to me that they allowed that to happen, both the US, with its civilian control of the military, and the Soviets, with their convoluted division of manpower, equipment, and commands, took measures to stop that situation from occurring.

manigandham3• 5 years ago

The ease with which the term limits were removed indicates that they were never a real limitation in the first place. What prior leader was actually bounded by them?

xbeta• 5 years ago

Jiang and Hu both stepped down after 2 terms. So yes they agreed to it.

kelnos• 5 years ago

This is why for all the fear of China, the country cannot succeed on its current trajectory.

I really really really want this to be true, but I don't think it's wise to discount China as a threat to worldwide autonomy just because they're behaving like typical authoritarians, and have the weaknesses that you'd expect from that kind of government.

Personally I think China's demographic issues should be more of a worry for them. The aftermath of the one-child policy, as well as all the selective abortion (under one-child, parents preferred to give birth to a boy) creating a imbalance between the number of men and women, means their population will start shrinking soon. And there will be a lot of only children supporting both of their parents when they start getting older, not to mention a glut of older folks leaving the workforce without equal replacement from the younger generations.

dmix3• 5 years ago

Russia has been skirting along in mediocrity with its one leader pseudo parliament system for longer than China. Xi is copying Putins playbook here.

The major difference is their positions in economic transitions.

I think the biggest risk for China would be entering mediocrity and flatlining like Russia. Not growing seems to be their biggest fear.

gscott2• 5 years ago

Even in the worst case scenaro China ends up having twice the population of the USA. The nee 3 child policy for ccp members might help.

xwolfi• 5 years ago

You think of China in american terms. For all they care, the world stops at their borders and having to trade outside is a temporary inconvenience. They re not going to be able to expand, you can already see their cultural gradients on its periphery having a lot of issue.

If China was to deal with French, Japanese or Senegalese people, it would immediately crumble. All they can do is firefight for internal stability, or change enormously to inspire positively, but it's not yet looking that way.

sudosysgen7• 5 years ago

According to machine translation (both Google Translate and DeepL) of the law itself, it seems that this is not actually the case, and that the article is simply wrong. Indeed, it seems that they have a legal responsibility to notify the MIIT within two days, but a legal responsibility to notify upstream immediately (according to another commenter, they do not even have any responsibility to disclose to the government, only to Apache).

Perhaps this translation is incorrect, but Chinese speaking commenters below think that it is accurate, so it's probably just the article being wrong (as usual), leading to incorrect conclusions that China is not a threat and will not succeed because they will shoot themselves in the foot etc, while reality is a lot more reasonable.

uranusjr• 5 years ago

The article is correct on all factual grounds; Alibaba has been suspended of its participation as a 网络安全威胁信息共享平台合作单位 (whatever that means), and the agency sources that law as the reason. Now you can argue the law does not actually say Alibaba is obligated to report the incident to the China government, but the government is acting as it should, and Alibaba has no recourse but to accept (you have no chance to get a course ruling to overturn the decision in China anyway so what other choice do they have).

spoonjim• 5 years ago

the country cannot succeed on its current trajectory

What, exactly, is it doing right now? This sounds a lot like "Tom Brady cannot succeed with his current height." Um, he already has, and continues to do so.

jeswin• 5 years ago

Which almost guarantees a lot of counter productive incompetence.

What do dictators do when their policies start failing and popularity declines?

They go to war. Nothing distracts the population as much. This is the biggest risk with China's expanding military power.

62951413• 5 years ago

This is why for all the fear of America, the country cannot succeed on its current trajectory. Things look great until the leaders are doing well, but all it takes is 1 Brandon for all to fall apart.

And since so many Americans are now a threat to the Democrats, their selection criteria for people to lead different parts of the party and government has to be based entirely on race and gender rather than competence.

Which almost guarantees a lot of counter productive incompetence.

kybernetikos• 5 years ago

That's the point of the comment you're responding to - the USA has term limits, which means that the damage a single bad leader can do is limited.

Jansen312• 5 years ago

You just look back at China's 5000 years Imperial history. It is no surprise of current development. Chinese history has never had Greek style democracy system. The closest in terms of political development will be Song dynasty which it has a chance to further survive, will likely turn into something like USA. Alas, ask any Chinese scholars, Song dynasty is considered the worst in China as it is "weak". Surprisingly, if you ask the same person, people living during Song dynasty were way better off than Tang or Han dynasty, both golden periods of China before Song. Even if you ask about science and literarure developments, it too was ahead of previous dynasty. Still, it is consider a failure when in terms of dynasty ranking.

I know about Dr. Sun's republic, Taiwan and "voting politburo" . But these are considered modern development which hasn't really sunk into physche of Chinese race worldwide.

dathinab3• 5 years ago

My deepest thanks for whoever did that decision in Alibaba.

I hope the price Alibaba has to pay for it won't be too high.

Through I expect Alibaba to now fall-in-line wrt. Future decisions of this kind, it's not that they have much choice.

duxup• 5 years ago

I worry more about the price of the he individuals who made that call.

dmix3• 5 years ago

Curious what “saving face” will look like in practice here.

mrjin2• 5 years ago

Let's cut the BS. The fact was that Ali Cloud failed to report the issue to MIIT (required by law, it has to be report cyber security incidents to MIIT immediately) weeks after notifying Apache(a foreign entity).

I'm not sure if such behaviors would be desirable in any country.

ggm2• 5 years ago

Classic HN. you're getting downvoted by fools. I made your point independently, before finding this comment.

sudosysgen7• 5 years ago

It really is worrying how little pause a factually correct comment gave the people reading the thread. We really live in a post-truth world.

mrjin2• 5 years ago

Well, it's a pity that doesn't matter how hard we try, it's just impossible to make some ppl understand the fact.

zhte415• 5 years ago

I'm surprised HN is full of knee jerk assumption without first checking what the government required disclosure policy is.

Here it is: Verify. Report to 'vendor'. Immediately. Report to government including an analysis within 2 days.

Link to policy: http://www.gov.cn/gongbao/content/2021/content_5641351.htm

Link to past HN comment on this on another story on this topic: https://news.ycombinator.com/item?id=29653352

boston_clone3• 5 years ago

I don't think there are any knee jerk assumptions happening; TFA details the differences, including the policy you're referencing.

(archived version of the article: https://archive.md/Yvsca)

From your linked policy (translated by Apple):

Article 7 Network product providers shall fulfill the following security vulnerability management obligations
(2) Relevant vulnerability information shall be submitted [...] within 2 days

In this case, an Alibaba researcher found a bug in an Apache product, so this policy wouldn't seem to apply as Alibaba is not the vendor of the product.

sudosysgen7• 5 years ago

Plainly the linked policy does not ask Alibaba to do what the article says it should do, ie, notify the government first, as per machine translation.

It seems to say that they should notify the vendor (ie, Apache) as soon as possible, and notify the government within 2 days (according to rfoo they are not at all required to disclose it to the government since it's not their product, but they are encouraged to do so), not that they should notify the government first and then wait for approval to notify Apache.

According to google translate:

(1) After discovering or learning about the security vulnerabilities in the provided network products, they should immediately take measures and organize verification of the security vulnerabilities to assess the degree of harm and the scope of the security vulnerabilities; for the security vulnerabilities in their upstream products or components, they should Notify the relevant product provider immediately.

(2) The relevant vulnerability information should be reported to the Ministry of Industry and Information Technology's cyber security threat and vulnerability information sharing platform within 2 days. The content of the submission shall include the product name, model, version, and the technical characteristics, harm, and scope of the vulnerability that have security loopholes in network products.

So according to machine translation, the article is incorrect, and they do not have to notify the CCP first, instead they should have notified Apache first, and then the government within 2 days.

smokey_circles• 5 years ago

Why does the Chinese Government need to be told _at all_? You're saying that doesn't seem strange to you? The government busy silently exterminating a people and who employ mass surveillance and other obvious human rights violations, that they ask for cyber vulnerabilities to be specifically delivered to them doesn't register a reaction with you at all?

beambot• 5 years ago

To be fair... CERT has affiliations with the US government.

https://en.wikipedia.org/wiki/CERT_Coordination_Center

The CERT Coordination Center (CERT/CC) is the coordination center of the computer emergency response team (CERT) for the Software Engineering Institute (SEI), a non-profit United States federally funded research and development center.

dopa42365• 5 years ago

randomly hating 20% of the worlds population for being born in the WRONG country? seems reasonable!

garbagetime• 5 years ago

What's this comment made in reference to?

rblatz• 5 years ago

You can dislike the actions of a government without hating the people governed by that government.

arvigeus• 5 years ago

TIL Chinese government consists of 20% of world’s population. I thought my country’s administration was overblown and inefficient

MangoCoffee2• 5 years ago

what are you referring to?

gscott2• 5 years ago

Well...

https://amp.scmp.com/tech/article/2138114/china-discourages-...

authed• 5 years ago

de-amped link, I think: https://www.scmp.com/tech/article/2138114/china-discourages-...

refurb• 5 years ago

Sure, Alibaba broke the law. But there is no rule of law in China. If laws were truly enforced the entire system would collapse.

This was using the law as a weapon to keep companies in check. If this had been another company firmly in the pocket of the CCP, this would have been overlooked and never made public.

curiousgal• 5 years ago

But there is no rule of law in China.

Shit HN says. Can we avoid making such blanket statements, please and thank you.

ggm2• 5 years ago

Do people really think AWS did not report to the federal agencies about potential risks?

If AWS didn't then their contract for service is deficient. If they had risks which affected their stock price they had obligations to other agencies too. The department of commerce, the federal communications agency, the US Cert, you name it.

Please, no accusations of whataboutery: I am trying to point out that if you are big enough to have economically relevant importance, OR if you supply goods and services to the state, any state, you have obligations in that state relationship.

if I was in government in China and ali baba cloud didn't check in, I might be witholding business too.

akyoan• 5 years ago

Absolutely shameless. I’m glad that they’re doing this in the complete open instead of painting themselves as the good guys (unlike, ahem, other western countries)

neonate• 5 years ago

https://archive.md/Yvsca

Borrible• 5 years ago

Would love to know whether their Specialized military network warfare forces and PLA - authorized forces knew about the flaw beforehand.

pagutierrezn• 5 years ago

And since so many people are now a threat to him, his selection criteria for people to lead different parts of the party and government has to be based entirely on loyalty rather than competence.
Which almost guarantees a lot of counter productive incompetence.

This applies to every goverment and public institution regardless of its democratic roots

Apache Log4j bug: China’s industry ministry pulls support from Alibaba Cloud

Related Stories