"What made the attacks particularly serious, Mr. Blasco said, was that as long as the victims were logged into China’s 15 top web services — including major portals like Baidu, Taobao, QQ, Sina, Sohu, Ctrip and RenRen — the attackers could identify them and siphon off their personal digital information, even if their victims were logged into Tor or a VPN.

They did this with the aid of a particularly serious vulnerability that 15 web services in China apparently never patched."

Asteriks for emphasis. No shit, sherlock.