Follow Slashdot stories on Twitter

 


Forgot your password?
Close
typodupeerror
×
Privacy Government The Courts United States Politics News

Chinese Websites Used As Launchpads For Cracking 256

Posted by Zonk from the not-friendly-global-neighbors dept.
An anonymous reader writes "A Washington Post article reports that Chinese networks are being used to breach hundreds of unclassified U.S. government systems. The article goes on to say that some analysts believe the activity to be tied to the Chinese government, although there is also some dissent." From the article: "Whether the attacks constitute a coordinated Chinese government campaign to penetrate U.S. networks and spy on government databanks has divided U.S. analysts. Some in the Pentagon are said to be convinced of official Chinese involvement; others see the electronic probing as the work of other hackers simply using Chinese networks to disguise the origins of the attacks."
This discussion has been archived. No new comments can be posted.

Chinese Websites Used As Launchpads For Cracking More

Chinese Websites Used As Launchpads For Cracking

Comments Filter:

  • Idealism (Score:4, Insightful)

    by mfh ( 56 ) on Thursday August 25, 2005 @09:20AM (#13397151) Homepage Journal
    FTA: "It's not just the Defense Department but a wide variety of networks that have been hit," including the departments of State, Energy and Homeland Security as well as defense contractors, the official said. "This is an ongoing, organized attempt to siphon off information from our unclassified systems."

    This seems like the work of terrorists to me. They gather unclassified intel from multiple sources and then they can prove/disprove rumours (leaks?) of a secret nature. This puts a strain on the agencies to ensure that solid intel can not be assembled from less potent information, and yet many citizens complain about the slow pace in which free information flows out of the government. Look at what they are up against, today. (I know I'm going to get hammered on that statement) I think we're seeing that delicate balance between freedom of information and security will be tipping in the near future as a direct result of these attacks. It's never been very balanced anyway. I might be a touch left-wing, an idealist -- but to me there needs also to be a careful approach to protecting the homeland, whether it's in Canada, the US or abroad. I have a sneaky feeling that someone we know had something to do with this, and it's likely not the Chinese government -- I think it was the FSM [boingboing.net], or possibly a smaller cell -- the Army of the 12 Monkeys!

    • Re:Idealism (Score:2, Insightful)

      by SimilarityEngine ( 892055 )

      This puts a strain on the agencies to ensure that solid intel can not be assembled from less potent information

      It doesn't even need to be solid, if you're a blackmailer or social engineer - just enough to be damning/interesting/scary or enough to let you "talk the talk" when posing as a government official working on some project or other.

    • "others see the electronic probing as the work of other hackers simply using Chinese networks to disguise the origins of the attacks"
      Because we all know the Chinese Government is a tolerant and benevolent, progressive-thinking lot who simply want to be left alone. Buy U.S. Government votes, maybe, but NEVER spy on them!

      • Re:Idealism (Score:3, Interesting)

        by FidelCatsro ( 861135 )
        I think about it this way . If these Chinese hackers have the skill to crack Government systems then they would have the skill to disguise their locations. Why would they make it appear as if the origins are in China...

          Unless they wanted to make us think that the signals are not originating in china by making us think they are and then us believing that they wouldn't be and that it is someone else diverting through China

        • Re:Idealism (Score:2, Insightful)

          by isepic ( 117674 )
          You know, I used to think the same way, but beileve it or not, some folks DON'T CARE if you know who they are.

        • Re:Idealism (Score:5, Funny)

          by servicemaster ( 903088 ) on Thursday August 25, 2005 @10:27AM (#13397646)
          Sounds like...

          "Now, a clever man would put the poison into his own goblet, because he would know that only a great fool would reach for what he was given. I am not a great fool, so I can clearly not choose the wine in front of you. But you must have known I was not a great fool, you would have counted on it, so I can clearly not choose the wine in front of me!" ...

          "You only think I guessed wrong - that's what's so funny! I switched glasses when your back was turned! Ha-ha, you fool! You fell victim to one of the classic blunders, the most famous of which is "Never get involved in a land war in Asia", but only slightly less famous is this: "Never go in against a Sicilian, when *death* is on the line!". Hahahahahah!"
          [Vizzini falls over dead]

          Vizzini, Princess Bride

    • Re:Idealism (Score:3, Interesting)

      by cdrguru ( 88047 )
      Yeah, but this flies in the face of people thinking we need "open and transparent" government.

      There is a difference between the citizens of a country knowing every detail of the government's actions and a country that is actively against many of those actions knowing. The problem is that most of the people I hear from seem to think that if everyone just would calm down, smoke some weed together and such that we would all be friends. No more adversaries... Right.

      The US government has always been operating

      • Re:Idealism (Score:5, Insightful)

        by arkanes ( 521690 ) <arkanes.gmail@com> on Thursday August 25, 2005 @10:43AM (#13397839) Homepage
        It's not a tough idea at all. Closed, authoritarian governments have been around as long as there have people. The problem is that this is in direct contradiction to the democratic ideal. The entire point of a democractic government is that its power derives from the citizens, and it is supposed to reflect those citizens interests. It is *not* supposed to be a totalitarian figure, benevolent or not.

        Now, it may very well be that (real) democracy isn't stable in the long run - certainly the US government has moved more and more toward the totalitarian mode over the last couple centuries - but the people who're upset over that aren't confused or misled about a need for secrecy. They're concerned with the fact that a government that nominally represents thier them is actively seeking to hide information and activities from them (again, not a poke at the Bush administration - this has been happing, and gradually increasing, for the entire history of the US).

        Historical fact bears this out, too - there's been more than one case of government agencies refusing FOIA requests, or censoring them, not because they contained information critical to national security, but because they were embarressing, or contradicted "official" reports.

        In terms of security at all, the *best* kind is the kind that works even when everyone knows what you're doing. Thats not always possible, of course, but your example of vacation time is a great one for exactly that reason. Suppose that some city had some large fraction of it's officers on vacation on the same week of every year. Thats hurtful to security whether it's published or not. Publishing it, in fact, is probably the best way to correct such a short sighted flaw in operating procedures. "Open and transparent" means that the public (remember, the people who're supposedly the important ones) can confirm that people who claim to be acting in thier interest are actually doing so.

        And the what matters as well, especially when we're a supposedly moral nation. For example, many people are uncomfortable with the idea of torturing prisoners, or assassinating foreign politicians. Now, those actions may be neccesary to protect the US. Or they may not. But, supposedly, it's the *people* of the US who should determine what the line they will not cross is. Thats why we have laws and such about treatment of prisoners, and regulating our international operations. And history has shown that we need public oversight if our government is to be trusted to abide by those laws. Here I will poke specifically at the Bush administration, because, whether you support torturing prisoners for information or not, the Bush adminstration official policy is to do it via legal loopholing and word games, not via straightforward public policy.

        Of course, this is all predicated on the idea that a democratic society is stable or even a good idea. Theres a lot of people who would disagree, even Americans (from the sound of it, even yourself). Humans are social animals and being led is very comforting to many people.

    • This puts a strain on the agencies to ensure that solid intel can not be assembled from less potent information, and yet many citizens complain about the slow pace in which free information flows out of the government. Look at what they are up against, today. (I know I'm going to get hammered on that statement) I think we're seeing that delicate balance between freedom of information and security will be tipping in the near future as a direct result of these attacks.

      "These attacks" are the perfect excuse

      • The solution for "less attacks" is simply to make sure that no one hates your guts enough to want to blow them up, a lesson most average-brained people learn quite early in kidergarten...

        I don't know... sometimes there are kids in kindergarten that just walk right up to a kid they don't even know and smack them in the head. Those same irrational kids generally grow up and live their lives in a slight fog of irrationality that no amount of "making sure they don't hate us" will alter. I suggest that certai
    • I would not be surprised if this turns out to be a project of some Chinese intelligence agency. Worldwide espionage seems a "normal" activity for any large government. The USA do this at an even larger scale with a worldwide net of listening stations, the so-called Echelon net:
      http://fly.hiwaay.net/~pspoole/echelon.html [hiwaay.net]

  • Oh, it's espionage is it... (Score:3, Funny)

    by gowen ( 141411 ) <gwowen@gmail.com> on Thursday August 25, 2005 @09:20AM (#13397156) Homepage Journal
    By the same logic the Chinese Government is trying to overthrow western democracy using methods indistinguishable from incoherent spam emails about cheap viagra.

    • At least we know it's not the Russians! (Score:5, Interesting)

      by conJunk ( 779958 ) on Thursday August 25, 2005 @09:28AM (#13397216)
      I used to work in physical security (a clerical job I had in high school), and it was always fun to talk to the old-timers and hear their stories.

      My favorite was about how the KGB operatives in DC in the late 50s stayed in good graces wtih their Moscow overloads with a minumum of effort:

      They were supposed to keep tabs on the ongoings of the US political system by establishing inside contacts, and reporting back. So, they just summarized the political news from each day's New York Times, and kept their jobs for years.

      The Americans pulled an good one on them: To spy at the Russian consolate in New York, the CIA recruited Xerox to install a minature camera in the consolate's copy equipment. When he came to do "regular maitenance" each month, he'd also replace the full tapes with new ones.

      Sorry for no linkies, my source for these is an 80 year old CPP [asisonline.org].
    • By the same logic the Chinese Government is trying to overthrow western democracy using methods indistinguishable from incoherent spam emails about cheap viagra.
      By being one billion strong, the chinese obviously have no need for Viagra!

  • Microsoft / China "shared source" initiative? (Score:5, Funny)

    by dyfet ( 154716 ) on Thursday August 25, 2005 @09:23AM (#13397172) Homepage
    Was it not all that long ago that Microsoft agreed to "share" it's source with the Chinese government? I had wondered what became of that...

    • I'm not afraid of the possible Windows or Office source code out there floating around - I'm worried about that "Great Firewall" thing I hear people going on so much about.

      Doesn't that mean that I can't get back at the bastards?

      Seems like someone isn't playing fair...
    • Comment removed based on user account deletion
    • Having the source code to your commercial/geopolitical/military opponents' computer OSes would certainly be useful for determining otherwise obscure vulnerabilities, notwithstanding the often successful efforts of the worldwide hacker community.

      One might wonder if upon accessment of Microsoft's Shared Source, the PRC government decided to "roll their own" Dragon Linux for internal use. We already know what the PRC government thinks of WiFi security, since they decided to create their own security stack.

      Any
  • How can you use a "web site" to attack someone? Wouldn't it be just a box sitting somewhere attached to a Chinese network?

    Other than the fact that the attacks are coming from machines attached to a Chinese network and the reports that the PLA has been concentrating a little more on network warfare, what evidence are they basing their claims on that the attacks are coming from the Chinese government?
    • How can you use a "web site" to attack someone?

      Pick an IE vulnerability and create a trojan that uses this to dial home and send a copy of the user's documents (or even just give a remote user a shell on the machine).

      • Re:Web sites (Score:2, Insightful)

        by th3ex9 ( 850648 )
        I'd have to agree with the orignal poster. Web sites don't do anything until an end-user requests files from the site. A better title might be "Government computer users download hacks from web sites." This would also put a healthier spin on the problem which might yield a solution. For example, I think government classified network users shouldn't/can't cruise hostile websites in China. "Web sites attack" is a poor phrase hoisted on a technically shallow public. IMHO.

  • Must...resist....urge.... (Score:3, Funny)

    by hawkeye_82 ( 845771 ) on Thursday August 25, 2005 @09:25AM (#13397187) Journal
    In soviet China, website hacks you. /flinches for rotten fruit attack

  • Hmm, let me see, shall I attack the US govt. by using machines from a virtual black hole or not ?

  • why don't they... (Score:5, Funny)

    by justforaday ( 560408 ) on Thursday August 25, 2005 @09:28AM (#13397215)
    I don't see why the government doesn't just create it's own private network for data communication. And maybe if they were feeling really generous they could let some of the more prestigious universities out there onto it also...

  • How much is spoofed? (Score:5, Insightful)

    by m50d ( 797211 ) on Thursday August 25, 2005 @09:28AM (#13397218) Homepage Journal
    I wonder how many of these attacks are really coming from America. Standard practice is to spoof somewhere that seems to be not worth their time to look into if anyone catches you - eastern europe used to be a favourite, with its famously corrupt and incompetent police forces and the sheer physical distance acting to dissuade US companies or government agencies from bothering to try and bring anyone apparently from there to justice. With the additional hostile political environment and famed elite hackers, China would make a very attractive place to spoof an attack as being from.
    • IP spoofing does not allow for anonymous access. This is a common misconception. Any sort of spoofing beyond simple floods require the attacker to be on the same subnet as the attackee (nonblind spoofing). As far as blind spoofing all modern OSs implement random sequence numbers, making blind spoofing very unlikely.

      • Re:How much is spoofed? (Score:3, Interesting)

        by Shisha ( 145964 )
        I dare say that a lot of hackers (which here I will use in the popular media sense, i.e. someone wishing to gain unauthorized access to a computer system), use more complicated scenario.

        1, Sit at a computer in the US.
        2, Hack into a computer in China, Eastern Europe or wherever. Hope that the owner / admin won't notice a thing.
        3, Hack into the system of an US government agency, company or wherever you need.
        4, Hope that no-one notices. If they do never mind, you have a 99.9% chance that they'll assume the att
    • Wow! Too bad our Government doesn't have, I dunno, basic security technology that could...you know...figure it out anyway.
    • Spoofed or not, the success rate of these hackers puts the Department of Defense to shame:

      The number of attempted intrusions from all sources identified by the Pentagon last year totaled about 79,000, defense officials said, up from about 54,000 in 2003. Of those, hackers succeeded in gaining access to a Defense Department computer in about 1,300 cases. The vast majority of these instances involved what VanPutte called "low risk" computers.

      I don't care if it's Low Risk; a 1.6% success rate is unaccepta

  • Some are said to be? (Score:5, Insightful)

    by Anonymous Coward on Thursday August 25, 2005 @09:29AM (#13397220)
    Talk about weak:

    "Some in the Pentagon are said to be convinced of official Chinese involvement..."

    So, other people have said that some people in the Pentagon are convinced. We don't even know who is doing the "saying."

    Sounds like weak speculation to me.
    • Sounds like weak speculation to me.

      "This is an ongoing, organized attempt to siphon off information from our unclassified systems."

      Great propaganda though.

    • Given the amount of disinformation and just plain false assumptions coming out of the Pentagon lately - and especially out of the OSP, which was basically created to legitimize such disinformation - this is not only weak speculation; it has no credibility at all. There are people at the Pentagon convinced of many things that there is no evidence whatsoever for, such as that Saddam was behind 9/11.

  • If you've done nothing wrong... (Score:5, Funny)

    by yotto ( 590067 ) on Thursday August 25, 2005 @09:31AM (#13397234) Homepage
    Then you have nothing to fear from the Chinese knowing all the information the US government has collected on you.

  • Real story (Score:5, Insightful)

    by GrAfFiT ( 802657 ) on Thursday August 25, 2005 @09:34AM (#13397266) Homepage
    OK, further investigations revealed that the whole issue was seriously inflated. It was just about chinese user's (pirated) Windows XP computers being infected by worms and turned into zombies sending gazillions of blaster/sasser/zotob/whatever to .mil computers. OK nothing to worry about.
    Next story : old korean grand-mothers hacking Pentagon's SMTP servers.
    • Nah, the real story is "we want to keep our populations under control and the best way to do that under a democracy is to breed enemies for the people to rally against". Like China. You'd think with all the "freedom" and "democracy" that wouldn't be possible, but propaganda is a strange beastie.

      Hence the reason why the general population hates China, Russia, France, N. Korea and Iran. So long as they aren't hating the clear local government corruption, it's all good, right? We need them to protect us from

  • websites? (Score:5, Insightful)

    by delirium of disorder ( 701392 ) on Thursday August 25, 2005 @09:36AM (#13397281) Homepage Journal
    Although there certainly are penetration methods that use web sites, I would guess that many other application layer IP services are being used for these attacks. The media's use of the term web site to mean any IP device is deceiving.
  • I can no longer sit back and allow Chinese infiltration, Chinese indoctrination, Chinese subversion, and the international Chinese conspiracy to sap and impurify all of our precious computers.

  • Maybe a little of both. (Score:3, Insightful)

    by AltGrendel ( 175092 ) <`su.0tixe' `ta' `todhsals-ga'> on Thursday August 25, 2005 @09:43AM (#13397324) Homepage
    I would suspect that the Chinese Govt. is doing what just about any government would do. Monitoring what's happening, but keeping out of it just enough for plausable deniability.

  • The Currency of Fear. (Score:4, Insightful)

    by delire ( 809063 ) on Thursday August 25, 2005 @09:47AM (#13397359)

    Secondly, the notoriously paranoid government in Beijing has also long feared that Microsoft Windows has a "back door" that could allow for U.S. government snooping -- a fear no doubt enhanced by the January discovery of bugging devices in President Jiang Zemin's new personal Boeing 767. Microsoft, of course, denies that it would ever be involved in such matters, but many Chinese still feel safer using the open code of Linux. In China, after all, any company as big as Microsoft would be in cahoots with the government.
    From here. [newamerica.net]

  • Chinese Government (Score:2, Insightful)

    by Krast0r ( 843081 )
    If the Chinese Government wanted to break into the websites of foreign powers, they probably would have broken into them all by now. Think about it, China has a population of roughly 1,306,313,812 (July 2005) and a purchasing power of $7.262 trillion. Chances are that someone in China will be able to break into a Government website, and with that kind of purchasing power they could probably get a PC or 2. However, if China really wanted to do some damage they could always get everyone in the population to r

  • Nature of "Attacks" (Score:4, Insightful)

    by MrCopilot ( 871878 ) on Thursday August 25, 2005 @09:53AM (#13397410) Homepage Journal
    Hmm, So they recieve hits on UNClassified Computers (Servers?). Is it possible someone in china just wants to know about corn production and distribution to soldiers?

    Nowhere does TFA describe the attacks themselves. I guess we are to assume they are malicious Attacks to gain control of DOD computers. I try to never assume anything based on vague DOD statements. So I'm going with hits on the serveer Logs. Seems like a cute way to get approval for Classifying these UNClassified Systems. This administration has been overly secretive in a whole slew of areas, add one more to the list.

    I give it a week, then quietly changes will be made and this info will dissappear off the web, innaccessible to all but the DOD.

    Wouldn't it be interesting to know how many "Attacks" the chinese government receives from the US.

    The number of attempted intrusions from all sources identified by the Pentagon last year totaled about 79,000, defense officials said, up from about 54,000 in 2003. Of those, hackers succeeded in gaining access to a Defense Department computer in about 1,300 cases. The vast majority of these instances involved what VanPutte called "low risk" computers.

    Gained access, Shit man, Raise Terror Threat Level to chartruse.

    This is an ongoing, organized attempt to siphon off information from our unclassified systems."

    No kidding, People are using computers to gather publicly available information. Oh.. My.. God.. Raise to level Periwinkle.....Get Dick to an undisclosed location. Get Condi on the horn.

    Either you are with us or your with the Chinese Websites.

    • People are using computers to gather publicly available information.

      TFA doesn't say this is "publicly available information," just that these networks are are unclassified. Just because this stuff isn't Top Secret doesn't mean we should ship off all the Pentagon's backup tapes to China with a red bow on top.

      On the other hand, the vagueness of the article makes me wonder if these are just spammers looking for compromisable computers they can use to send spam.

  • Of course they're spying (Score:2, Insightful)

    by Anonymous Coward
    That's what governments do; even friendly ones. We're just arguing about whether we have caught them in the act.

    I expect they're being more sophisticated. How about sniffing everything that goes over the internet. I bet they're doing that.

    I remember describing something as having more antennas than a Russian fishing trawler. Those trawlers were of course not fishing for fish.

  • When we learn? (Score:4, Funny)

    by MrCopilot ( 871878 ) on Thursday August 25, 2005 @09:58AM (#13397447) Homepage Journal
    Did Matthew Broderick teach us nothing?
  • We are doing the same to them. Make no mistake about it. Our government is busy trying to crack every Chinese gov. computers that it can, or is simply using the built-in backdoors on the windows systems.

  • Damn - More Outsourcing (Score:4, Funny)

    by ppp ( 218671 ) on Thursday August 25, 2005 @10:03AM (#13397474) Homepage
    Those hacking jobs rightfully belong to Americans!

  • Unlikely (Score:2)

    by rlp ( 11898 )
    With all the American telecom and networking firms outsourcing development to China, there's no need for the Chinese government to probe US government and commercial sites from outside the enterprise firewall.
  • This is today's version of the Top Gun film. There is a silent war happening between two superpowers and the heroes of that war are neither remembered or mourned. I'd say the American team of computer experts fighting virtual dogfights with Chinese hackers are just as brave and committed as those fine pilots like Maverick, Iceman or Joker. And let us hope there is no Goose - that these brave experts do not pay for the work they do on our behalf with their lives.

    I wonder if the American computer experts d
  • It's fascinating that The Great Firewall of China seems able to keep out most government disapproved sites, but seems unable to keep in spam and hacking.

    Translation: Of course the Chinese government is behind all this.

  • My firewall for my home PC gets hammered quite a few times a day with portscans/exploit attempts from Chinese-ish IPs.

    I set up a passworded share to see what would happen, and damn if there weren't systems trying to bruteforce the password on it.

  • Had to ban Chinese subnets (Score:3, Informative)

    by AIX-Hood ( 682681 ) on Thursday August 25, 2005 @11:47AM (#13398585)
    Although I wouldn't put this in the same category as government network hacking, I've had similar problems. I run a message board that focuses on military matters with a bias towards the US side of things. As the popularity has grown, so have the hacking attempts. Luckily they've all been unsuccessful because I'm on top of software updates, but the amount of times that I've had to block these idiots where they try to download my entire site with leech clients, flood the forum search engine with countless requests per second, initiate thousands of connections to the web server but timeout causing the number of apache processes to skyrocket, and do other things to try and bring it down is getting too many to count. The one thing that unites all of this? 98% of these shenanigans are coming from Chinese subnets. Only a few have been from elsewhere, namely France and Germany. What's crazy about it, is that the ip's that they're using from China are all over the continent. We're talking well over 100 subnets. Late last year I finally started blocking all of the Chinese subnets and voila! All problems with the site have gone away. It's rather unfortunate as I had a lot of Chinese visitors that I had to shut out.
  • When I worked for state government 90% of the thwarted attacks came from Chinese ISP's.

    The ChiCom party either knows about this and condones it or is actively sponsoring it.

    Therefore it is in our best interests to cut China from the net. But this plays right into the hands of the ChiCom party.

    After all, a disconnected China is pretty much free of pesky dissent sites.
  • It's time to "liberate" the chinese citizen it seems...

Slashdot Top Deals

This restaurant was advertising breakfast any time. So I ordered french toast in the renaissance. - Steven Wright, comedian

Close