China fingered in cyberattack on mystery high tech co. The Chinese government is stepping up efforts to steal valuable information from high-technology companies in other countries, according to a congressional advisory panel, which detailed one operation that siphoned "extremely large volumes" of sensitive data. The 2007 attack against the unnamed high-technology company was just …
If the Chinese had as much sense as India all they need do is quote a good price for labour intensive work such as electronic document processing and our dummy Chiefs in Industry will gladly sent the sensitive information abroad. All they need do is promise they wont peek!
So is that yet another warning that we really need to be changing our passwords at least monthly?
Also, isn't there a way to lock down who can run the helper-sessions? A set of MAC addresses allowed to initiate connections with the RFB or RDP protocols perhaps? Additionally maybe get the logged on user for that machine and get them to click a link confirming they want to start the connection? It does seem that these are a constant security hole- even in the Gary McKinnon case he was using that sort of software (on military machines, no less!).
A degree of geographical security could also be added by somehow using a very short timeout (the cause of the 500-mile email- http://www.ibiblio.org/harris/500milemail.html) to limit the area that someone could attack from, even if they used a local proxy and knew a valid helper MAC address.
I'll take that award for "most kickass and freaking awesome security guy known to mankind" now, thanks...
@Lost in maze...
If Chad, Mali and Burkina Faso have an internet connection it's entirely possible that they could have played a part in it. In fact the attacks could have been from around the world with the China server as a common proxy. If teenagers can beat the IP Geolocation systems for, say, Hulu or iPlayer, what're the chances that any sensible hacker can now be tracked down- even to the level of "they're on this continent"- from the attacking IP?
Fair guess being we could rule out MS,Intel,Google or basically anyone in that industry, the info isn't really that important or even unavailable to China freely.
I'm betting it's someone like Lockheed who do loads of military work, and anything like the info available to them would be of extreme value to China, or a company in that field, that's related to military work.
Why unnamed high tech company, probably, because the security was provided by the same people who provided the security that a Mr Mckinnon hacked using simple passwords to access an entire network. I wonder if the Yankee's will pursue this with the same vigour?
Can you tell me of a western government that isn´t?
NSA, CIA, Waco, "Terrorist" laws being used against anyone who isn´t doing EXACTLY what the government want...
I read the article and thought: so, what exactly is the problem? It´s OK for them to do it to others, but when China does it to them, it doesn´t taste so good?
My previous employer found the same thing happening to them, except that the data was stolen from a UK company and then eventually used by a US defense company. It was stolen from an encrypted trans-atlantic link (the encryption was supplied by US gov.). When it was discovered, specific bogus information was sent to see where the same information popped up...
At a European NGO where I used to be responsible for the firewall policy, I found that blocking networks in China, Korea and a couple of countries in South America covered a significant chunk of all the scans.
Of course, it may be possible that some of the companies may have reported the intrusions and may have been encouraged to leave doctored information in the accounts concerned...
Everyone assumes that a military institution got hacked. It may not necessarily be so. China, and its governmental/military run companies have no respect for IP rights. They'll copy anything, make it and sell it back to you in the blink of an eye. No-one does anything because... its China.
Actions like these can destroy perfectly healthy businesses.
Winkypo: "Fortunately there are still *some* places on the planet where vicious incompetents don't hang onto power by force."
Where? ... and when you reply, check your answer before you reply, because I can assure you political power in every country works the same way, its just our own government PR department chooses which countries matches its own agenda, and then labels these governments as good while other different governments are labeled as bad (like they are the source of all evil) ... then you hear later that our government has been making friendly deals and having friendly get together meetings with some of these so called bad countries.
The two faced behavior is all part of the political game of swaying their own peoples opinions and its easy to influence opinions when governments will happily use lies and misinformation to manipulate its own people. Yes everyone can be influenced because governments don't limit themselves to just speaking the truth. They will happily lie if it gets them what they want.
Plus if you don't believe they are capable of being vicious, then you really don't know the kind of person they are. Also don't say the law will stop them. They choose the laws that the rest of us have to follow and they can also easily bend their own laws when it suits them. ... e.g. police action resulted in the death off ... military action resulted in the death off ... etc... its easy for them to justify, after all they just have to label the victims as the bad guys and bad guys are criminals.
Also if you don't believe they all hang onto power with force, then try marching on Parliament to throw NuLabour out of power, for not calling an election when most of us are calling for an election. Do it on your own and the police will easily stop you. Find 1 million people to back you up and all of you march on Parliament and then the government will call in the military to defend Parliament. Force against the people in power doesn't work because the people in power have way more power than any group who wishes to displace them. It wouldn't even matter if the million were armed with guns because then the military would just up the stakes even more by bring in tanks and aircraft as we have seen in other countries. Politics is all about power and they are very good at knowing how to use their power to manipulate everyone. This principle applies to all countries.
Welcome to the world of politics. Don't take anything they say at face value. They are relentless manipulators and the pursuit of ever more power is central to their thinking.
Which is why this cyber attacking fear story is so two faced, because so many governments are spying on everyone just as much, if not more and its getting ever worse. Knowledge is power and the people in power want power and fear the loss of power so spying provides them with a way to hold onto power and gain ever more power. Spying is a political game that has been played for more than a thousand years. Its just now they have ever better technology to continually increase and automate so much of their spying on us all. All ultimately because of a minority of greedy arrogant control freaks in every country and their incessant need for power over others and to then personal gain from having such power over others.
Big Brother Icon, because its all about the relentless need for power.
In all liklihood NASA will abandon Ares and go for a simpler, cheaper solution based on the Delta booster. In the medium-term though, with the last Space Shuttle Mission (for Enterprise) penciled-in for next year, it seems unlikely that the US will continue with manned spaceflight. They've been toying with giving-up for a few decades now and after next year they will lose the capability of getting US astronauts into orbit without buying a seat from Russia. As most of the Apollo generation have died/retired, the skills in NASA are just slipping away, and when the Shuttle replacement finally gets to fly with a crew (probably 2020 or beyond) all of the lunar astronauts will have died and it'll be easier to throw the towel in altogether.
So there is value for China and India to try and snaffle as much aerospace data as possible, whilst the US still has an aerospace industry in existence that makes it worthwhile keeping the storage live. At present China is probably equivalent to the early Gemini days in space technology, and the Indians equivalent to pre-Mercury - they both need to accelerate their pace of development, with the Chinese practising orbital rendezvous and docking with Agena-style targets, and the Indians capable of actually getting someone up (set for 2015.)
One area that the Chinese can pursue and leapfrog anything the US has done is with maglev or "Magnetic Levitation" launch technology. In essence a payload and booster could be launched from a magnetic rail at 1000 kph, before the first stage of the booster ignites - getting over the "standing start" waste of propellant that plagues all launch solutions to date. Starting your journey into orbit at over 600mph is far more economical than starting at 0 mph; your vehicle is still 1/28th of the way to orbital velocity, but with the first stage ignited you will likely go Mach 1 inside the first 500 feet.
I suspect that the "high-tech co" will be aerospace-related; someone like Lockheed, Northrop-Grumman, Thiokol, MD, General Atomic, Boeing...
>They used a host with an address in China? Yeah, cause they'd do that, wouldn't they?
Read the article. The files were being dropped into University and other servers in the U.S. first before the transfer to China.
High Tech companies won't blacklist Universities they have researchers / business relationships with. University academics won't blacklist nations.
There's all sorts of non-Defense specific industries the Chinese (and Russians, Poles, Israelies, Iranians, French, British, etc...) would love to get into. I've worked at an R&D center in the past that (before my time there in the 90s) had a foreign national as the top person...until he was taken away by the FBI for industrial espionage. Americans, in general, have a far lower appreciation about the scale of industrial espionage globally then others.
Such espionage could be for simple economic competetive advantage. Think of the counterfeit Cisco switches and routers that came out of China.
It could also have dual-use to enable further attacks. Think of the value of having the source code for Cisco IOS so you can make your own hooks into said counterfeit routers and see who buys and installs them.
My employer has electronic files which for commercial, and other reasons - we are headquartered in an authoritarian country - and to prevent external access we have two separate networks running on separate cabling in our office premises.
To enforce this separation users physically have to rotate a switch that disconnects the general network - with InterNet access - to the isolated network.
Users also have to change logins which severely limits what applications can be run.
Sounds like a kluge? Maybe, but we know the nosey bastards next door in China can't stop by, nor can the government of this country.
This post has been deleted by its author
The company will normally hire a person for short term SAP advising and hops around company to company. They will call the helpdesk they need read and write access to do their job which elevates their account.
So always give these types thin client access to a firewalled server with no outside access!
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
