Chinese hack U.S. Weather systems, satellite network

Re:Chinese hack U.S. Weather systems, satellite network by Someone1234 on Wednesday November 12, 2014 @02:29PM (#8597596)

I always appreciate how the US are able to pin every network compromise directly back to China. And not just China but the Chinese government in particular.

Almost like VPNs, proxies, TOR, compromised machines, botnets, or similar do not exist in this arena and that a reverse DNS lookup will tell them 1337.mss.gov.cn.

When the US talk about cybersecurity/"cyber wars" in general they're talking about something more akin to a Hollywood movie than anything you see on the ground on either side of the "fight."

I'm extremely sceptical every time they claim Chinese responsibility. I am sceptical not because China wouldn't have the skills or motivation to do so (they do/would) but because they jump to these conclusions unrealistically quickly and if their adversary covered their tracks even modestly pointing fingers like that would be quite hard (e.g. send it through Russia).

[ Parent | on HN ]

Re:Chinese hack U.S. Weather systems, satellite network by amckenna on Wednesday November 12, 2014 @04:02PM (#8598141)

There are many details left out that could reasonably pin the attacks on the Chinese. While communication back to the source may be obfuscated and hard to pin on any particular actors the exploits, shellcode, and malware they use can possibly be tied to other breaches. Like regular programmers, hackers tend to reuse modules, code blocks, techniques, etc. from attack to attack. So whereas the NOAA breach may not conclusively point to China something found during the incident response and forensics phases may connect it to the USPS breach, Lockheed Martin breach, or others. A good example of this technique would be how researchers were able to tie Stuxnet, Flame, DuQu, and Guass to the same actors (probably the US and Israel).

[ Parent | on HN ]

Re:Chinese hack U.S. Weather systems, satellite network by SCHiM on Wednesday November 12, 2014 @03:32PM (#8597946)

Perhaps they too readily blame the Chinese _government_, however I'm not sure that the chinas place in the spotlight is _totally_ unwarranted:

tail -n 50 /var/log/auth.log

Nov 12 15:33:28 VPS-3167 sshd[11950]: Connection closed by 122.225.97.110 [preauth] [SNIP]

Nov 12 20:12:51 VPS-3167 sshd[12016]: Connection closed by 61.174.50.164 [preauth] [SNIP]

Nov 12 20:40:44 VPS-3167 sshd[12031]: Connection closed by 122.225.97.72 [preauth]

The list goes on and on, and the ip's in the last fifty lines were all Chinese or Russian, still they could also have been hacked themselves.

[ Parent | on HN ]

Re:Chinese hack U.S. Weather systems, satellite network by 13 on Wednesday November 12, 2014 @03:44PM (#8598031)

That doesn't mean that it's actually Chinese users doing anything though. China has a lot of software piracy in their culture, where piracy is, malware and botnets are rife.

[ Parent | on HN ]

Re:Chinese hack U.S. Weather systems, satellite network by SCHiM on Wednesday November 12, 2014 @03:54PM (#8598078)

I find that debatable, they are still guilty to some extent because of their inaction to do anything (effective) against these botnets. whether 'action' would refer to users installing a decent anti-virus, or an ips blocking and isolating obviously infected hosts.

Of course, this is a whole different level of culpability than if they were actually condoning large scale attacks on other countries infrastructure.

The fact remains that if I were to plot the amount of ip's that come knocking at my non-production server you'd see over 50% coming from china.

[ Parent | on HN ]

Re:Chinese hack U.S. Weather systems, satellite network by acqq on Wednesday November 12, 2014 @05:51PM (#8598807)

http://en.wikipedia.org/wiki/Usage_share_of_operating_system...

17.18% of all desktop OS-es connected to the internet are Windows XP, the version for which Microsoft doesn't publish updates. Most of these computers are in China. Also "in 2009, approximately 80% of software sold in China was pirated."

The average weekly income of a Chinese worker is around 100 USD. He is not going to buy new software even if it costs the same as in the US. It typically costs even more.

Don't be surprised bots have easier targets there.

[ Parent | on HN ]

Re:Chinese hack U.S. Weather systems, satellite network by ivanca on Wednesday November 12, 2014 @07:36PM (#8599289)

Windows 7 is just as easy to pirate so the logic is not solid there.

[ Parent | on HN ]

Re:Chinese hack U.S. Weather systems, satellite network by netheril96 on Wednesday November 12, 2014 @08:31PM (#8599469)

I find it very hard to believe myself, because when you can obtain for free, why not go for the latest, shiniest version? But the reality is, most of Chinese computers are still stuck with XP, whatever the reason is.

[ Parent | on HN ]

Re:Chinese hack U.S. Weather systems, satellite network by acqq on Thursday November 13, 2014 @03:55AM (#8600562)

XP was made for much weaker machines, older hardware. When you earn 100 USD per week you don't upgrade hardware as long as you can. Just as an example from another part of the world, I live in Europe and I've used a Sony notebook from 2002 until the last year, when the hardware started to fail. I guarantee you that Windows 7 can't be installed on it. Even the newer Ubuntu versions weren't installable from one point on.

[ Parent | on HN ]

Re:Chinese hack U.S. Weather systems, satellite network by ddebernardy on Thursday November 13, 2014 @05:36AM (#8600821)

One reason is chinese banks. Quite a few reportedly still run an IE6-only site that won't run properly in a modern browser.

[ Parent | on HN ]

Re:Chinese hack U.S. Weather systems, satellite network by est on Wednesday November 12, 2014 @07:55PM (#8599360)

Ever heard of PPStream or PPTV? Well, good news is that both software open some sort of transparent http proxy listening on 0.0.0.0, obviously it's for helping the p2p.

Hint: port 9415

[ Parent | on HN ]

Re:Chinese hack U.S. Weather systems, satellite network by SixSigma on Wednesday November 12, 2014 @05:45PM (#8598775)

My advice is that you shouldn't let that traffic get anywhere near port 22

1) use a different port 2) use ip ban 3) use a firewall with range blocking -

Or do you have a good reason for allowing access from every ip on the internet?

EDIT: removed snark

[ Parent | on HN ]

Re:Chinese hack U.S. Weather systems, satellite network by kokey on Wednesday November 12, 2014 @02:55PM (#8597748)

I share that skeptical feeling. It's always been a common technique to bounce an attack on US servers through servers in a foreign country that doesn't speak English much and doesn't have the best relationship with the US. China is the ideal one for this, and generally has the best supply of vulnerable servers to do this through.

[ Parent | on HN ]

Re:Chinese hack U.S. Weather systems, satellite network by rrggrr on Wednesday November 12, 2014 @02:37PM (#8597651)

Having hacked Google, Juniper, Symantic, Morgan Stanley and countless USGOV sites - why not hack NOAA? Its not as if there will be any USGOV response. No sanctions. No demarche of which I'm aware. No counter-attack that has been publicized by China. Turning the other check is not a valid strategy in a prolonged conflict.

[ Parent | on HN ]

Re:Chinese hack U.S. Weather systems, satellite network by lazaroclapp on Wednesday November 12, 2014 @05:48PM (#8598793)

Turning the other cheek is an OK strategy when the damages are not terribly high and the political and economic costs of any reaction would be worse than that of the attacks. In fact, improving defensive security and not responding to cyber-warfare except in cases that imminently endanger human lives or defense capabilities would probably be the sounder policy. That said, that's far from what the U.S. government is doing, the U.S. government engages in espionage and arguable cyber-warfare against nations it's not in conflict with (including China) with alarming regularity. The Snowden leaks give us an idea of how a fraction of those operations looked more than 6 years ago...

If it were me, I'd just issue a formal letter thanking the Chinese government and their people for spending their own taxpayer's money pen-testing U.S. infrastructure and ensuring security best practices are followed ;p (yes, I am being tongue-in-cheek, speaking of cheeks...)

[ Parent | on HN ]

Re:Chinese hack U.S. Weather systems, satellite network by rasz_pl on Wednesday November 12, 2014 @04:10PM (#8598197)

Exchange China with NSA and read your post again.

[ Parent | on HN ]

Re:Chinese hack U.S. Weather systems, satellite network by rrggrr on Wednesday November 12, 2014 @05:18PM (#8598641)

Done. Tepid feeling of unease was experienced that could be also be attributable to the grocery store sushi I had for lunch. To help put your mind at rest, USGOV bureaucrats oscillate across an ass-covering wave of incident driven threat detection peaks, and valleys of privacy right restrictions on their abilities. China, singling out just one state actor, operates unmodulated. There is a difference of level, accountability and transparency that makes your comparison invalid.

[ Parent | on HN ]

Re:Chinese hack U.S. Weather systems, satellite network by lawnchair_larry on Wednesday November 12, 2014 @11:59PM (#8600007)

Rest assured, they have better methods of attribution than a reverse DNS lookup. It's difficult to attribute a specific attack, but relatively easy to attribute large campaigns.

[ Parent | on HN ]

Re:Chinese hack U.S. Weather systems, satellite network by state on Wednesday November 12, 2014 @04:37PM (#8598370)

These articles always make me wish I could see the Chinese equivalent. Are the newspapers in Beijing just full of stories about US "cyber attacks" on Chinese infrastructure?

[ Parent | on HN ]

Re:Chinese hack U.S. Weather systems, satellite network by netheril96 on Wednesday November 12, 2014 @08:34PM (#8599477)

No. There are plenty of articles in China about how an evil empire the US is, but mostly on how it misuses its military, financial and cultural power, how it instigates unrest in other countries, how its democracy is a fake one, etc. Seldom if any mentions US hacking.

[ Parent | on HN ]

Re:Chinese hack U.S. Weather systems, satellite network by lawnchair_larry on Thursday November 13, 2014 @12:03AM (#8600015)

I would love to read this. How do you know? Are you Chinese?

I find it weird how in a world this connected, we still only get one POV.

[ Parent | on HN ]

Re:Chinese hack U.S. Weather systems, satellite network by gohrt on Thursday November 13, 2014 @01:48AM (#8600263)

http://rt.com (Russian goverment POV)

[ Parent | on HN ]

Re:Chinese hack U.S. Weather systems, satellite network by netheril96 on Friday November 14, 2014 @10:49PM (#8610773)

Yes I am a Chinese.

The "one POV" thing is not about how interconnected the world is; it's about language barrier. An English site will always be dominated by people whose native language is English.

[ Parent | on HN ]

Re:Chinese hack U.S. Weather systems, satellite network by damon_c on Wednesday November 12, 2014 @05:04PM (#8598559)

Someone I know who grew up in mainland China told me he was raised and taught in school to believe the Tianenmen square massacre was just U.S. fabricated propaganda.

So yes, probably.

[ Parent | on HN ]

Re:Chinese hack U.S. Weather systems, satellite network by internet_arguer on Wednesday November 12, 2014 @04:52PM (#8598474)

I also appreciate how the public unquestioningly believes that the Mars rover was in fact really on Mars. Especially, if one is to ask "qui bono", the answer that you'll get is that the administration is trying to direct attention from its police surveillance of Someone1234. I'm not saying that the Mars rover landing was faked, I'm just asking questions.

[ Parent | on HN ]