Chinese Hackers / Bots / Spammers/ Cyber threats thread

[Holmes]

---

---

Richard Clarke: China has hacked every major US company

By Emil Protalinski | March 27, 2012, 1:04pm PDT

Summary: Cybersecurity advisor Richard Clarke is warning the U.S. that its major companies are being regularly infiltrated by Chinese hackers employed by the Chinese government to steal R&D.

Richard Clarke, a former cybersecurity and cyberterrorism advisor for the White House, was a U.S. government employee for 30 years: between 1973 and 2003. He worked during the times of Ronald Reagan, George H.W. Bush, Bill Clinton, and even George W. Bush. He may not be working under current U.S. president Barack Obama, but that doesn’t mean he doesn’t have something to warning about. He says state-sanctioned Chinese hackers are stealing R&D from U.S. companies, threatening the long-term competitiveness of America. We’ve heard this before, but the way Clarke puts it makes the situation look even more dire.

“I’m about to say something that people think is an exaggeration, but I think the evidence is pretty strong,” Clarke said during an interview with the Smithsonian. “Every major company in the United States has already been penetrated by China. My greatest fear is that, rather than having a cyber-Pearl Harbor event, we will instead have this death of a thousand cuts. Where we lose our competitiveness by having all of our research and development stolen by the Chinese. And we never really see the single event that makes us do something about it. That it’s always just below our pain threshold. That company after company in the United States spends millions, hundreds of millions, in some cases billions of dollars on R&D and that information goes free to China….After a while you can’t compete.”

Clarke notes that while the U.S. government is involved in espionage against other governments, it doesn’t hack Chinese companies and then hand over intelligence to their American counterparts. He argues that the same cannot be said for the Chinese government.

Clarke’s most famous warning came 10 weeks in advance of the events of 9/11: on July 5, 2001. The FAA, the Coast Guard, the FBI, the Secret Service, and the INS had gathered at the White House, where Clarke stated that “something really spectacular is going to happen here, and it’s going to happen soon.” For the sake of the U.S. economy, let’s hope his warning about China doesn’t eclipse the one from over 10 years ago.
Richard Clarke: China has hacked every major US company | ZDNet

[Holmes]

Twitter bots target Tibetan protests

Brian Krebs
March 22, 2012

A young Free Tibet supporter protests outside the White House, Sunday, February 12, 2012, in Washington.

A Free Tibet supporter protests outside the White House in Washington last month. Photo: Carolyn Kaster/AP

Twitter bots — zombie accounts that auto-follow and send junk tweets hawking questionable wares and services - can be an annoyance to anyone who has even a modest number of followers. But increasingly, Twitter bots are being used as a tool to suppress political dissent, as evidenced by an ongoing flood of meaningless tweets directed at hashtags popular for tracking Tibetan protesters who are taking a stand against Chinese rule.

It's not clear how long ago the bogus tweet campaigns began, but Tibetan sympathisers say they recently noticed that several Twitter hashtags related to the conflict - including #tibet and #freetibet — are now so constantly inundated with junk tweets from apparently automated Twitter accounts that they have ceased to become a useful way to track the conflict. Hashtags embedded in Twitter posts make it easier for people to search particular subjects.

The discovery comes amid growing international concern over the practice of self-immolation as a means of protest in Tibet. According to the Associated Press, about 30 Tibetans have set themselves on fire since last year to protest suppression of their Buddhist culture and to call for the return of the Dalai Lama - their spiritual leader who fled during a failed 1959 uprising against Chinese rule.
Advertisement: Story continues below

I first heard about this trend from reader Erika Rand, who is co-producing a feature-length documentary about Tibet called State of Control. Rand said she noticed the tweet flood and Googled the phenomenon, only to find a story I wrote about a similar technique deployed in Russia to dilute Twitter hashtags being used by citizens protesting last year's disputed parliamentary elections there.

"We first discovered these tweets looking at Twitter via the web, then looked at TweetDeck to see how quickly they were coming," Rand said in an email to KrebsOnSecurity.com late last week. "They no longer appear when searching for Tibet on Twitter via the web, but are still flooding in fast via TweetDeck. This looks like an attempt to suppress news about recent activism surrounding Tibet. We're not sure how long it's been going on for. We noticed it last night, and it's still happening now."

Denis Sinegubko, the Russian security blogger I corresponded with during the Twitter bot campaign against anti-Kremlin activists last year, said the Twitter accounts being used to flood Tibetan hashtags have all the hallmarks of Twitter bots.

"A brief analysis of the 'accounts' that use these hashtags suggests that they are spam bots: too many messages with the same hashtags in a very short time – unlikely to be humans," Sinegubko said.

Twitter was very responsive to the botted accounts being used to drown out hashtags following the disputed Russian elections, but these anti-Tibetan Twitter bots appear to have flown under the radar so far.

When I checked the situation Monday evening, the bunk tweets aimed at popular Tibetan hashtags were still going strong. It's not immediately clear how many apparently botted accounts are being used to blast these tweets; most of them have zero - if any - followers, and are following very few other accounts. Twitter has been notified about a couple of dozen accounts that appear to be the source of most of these junk messages.

Update: Several security firms are reporting that a backdoor Trojan targeting Mac users via a Java vulnerability has been observed in email attacks against non-governmental organisations related to Tibet. More information from SecureMac and AlienVault.
Twitter bots target Tibetan protests

Twitter bots target Tibetan protests

[Holmes]

China Launches Most DDoS Attacks, Report Says

By Anuradha Shukla, MIS-Asia Apr 15, 2012 12:46 am

China remains the top source country for Distributed Denial of Service (DDoS) attacks, according to Prolexic Technologies Quarterly Global DDoS Attack Report.

The newly released report indicates that the first quarter of 2012 (Q1 2012) was characterised by extremely high volumes of malicious traffic directed at Prolexic's financial services clients.

Compared to Q1 2011, the first quarter of 2012 experienced a 25 percent increase in total number of DDoS attacks; 25 percent increase in Layer 7 (application layer) attacks; and shorter attack duration: 28.5 hours versus 65 hours.

The Prolexic Security Engineering & Response Team (PLXsert) team also mitigated more attack traffic this quarter than it did in all of 2011.

"We expect other verticals beyond financial services, gaming and gambling to be on the receiving end of these massive attack volumes as the year progresses," said Neal Quinn, Prolexic's vice president of operations.

Drop in attack duration

Quarterly Global DDoS Attack Report also shows that average attack durations continued to edge down in Q1 2012, dropping from 34 hours in Q4 to 28.5 hours this quarter.

While more than 168 trillion bits of data and 14 billion packets of malicious traffic were identified as targeting financial services clients during Q4 2011, 5.7 quadrillion bits of data and 1.1 trillion malicious packets were identified and successfully mitigated during Q1 2012.

"The expertise of Prolexic's Security Operations Center staff and the unrivalled capacity of our cloud-based mitigation platform minimised the impact of these large attacks against their targets," said Quinn.

Compared to Q4 2011, the total number of attacks was virtually unchanged during the first quarter of 2012.

This quarter also experienced a six percent rise in Layer 7 attacks and saw the U.S. and Russia both move up in the rankings as the top source countries for DDoS attacks.

China Launches Most DDoS Attacks, Report Says | PCWorld
vote 4 sticky

[eowyn]

activating chinese bots in pdf in 5.4.3.2.....

[Holmes]

Hong Kong firms also at risk from Chinese hackers
Posted in Security, 1st June 2012 04:13 GMT

Security experts have warned multinationals with bases in Hong Kong that they are not immune to cyber attack from China despite the shared sovereignty between the Special Administrative Region (SAR)and its mainland parent.

The Chinese authorities have long been blamed for either officially sanctioning cyber espionage attacks on foreign public and private organisations or turning a blind eye to financially motivated or patriotic attacks on western companies and states launched from within the People’s Republic.

Some believe there is an unwritten agreement between the hacking community and the authorities that these activities can continue as long as no government organisations or firms operating in China are touched.

However, experts in the SAR have said multinationals appear to be fair game for Chinese hackers.

Roy Ko, centre manager of the Hong Kong Computer Emergency Response Team (HKCERT) told The Reg that his team works closely with its Chinese counterpart to source the location of attacks on local firms.

“Hong Kong’s immunity depends on our capabilities to defend, not because we’re part of China,” he argued. “We have a good communications channel in place with the China CERT, so when the attacks have come from China we can seek their help and advice.”

Ian Christofis, an acting manager for Verizon in North Asia, recently told The Reg that multinationals on the mainland were worried about IP theft via malicious insiders and said Hong Kong firms were equally in the crosshairs.

“Hong Kong is just as much a target as anywhere else. Hong Kong firms should not be complacent,” he added.

Guido Crucq, GM of security solutions Asia Pacific for integrator Dimension Data, agreed.

"Cybercriminals are into hacking for the money, so we advised our clients that we can't let our guard down simply because we are doing business in a location which we consider as friendly territory," he said.

However, lawmaker Samson Tam, who is a legislative councillor for IT in the SAR, preferred to play up the threat to locally-based firms from outside of China.

“Most attacks come from smaller countries or areas with looser controls, so international police force co-operation is very important,” he told The Reg.

“Mainly they are financially-motivated attacks because we don’t have many political, cultural or religious tensions here.”

In any case, as has been proven in the past, it can be frustratingly difficult for experts to accurately trace back a cyber attack to source.

Given its large online population, China will naturally have a sizeable number of compromised machines which either home-grown or foreign hackers can use to launch attacks, said HK

Hong Kong firms also at risk from Chinese hackers ? The Register

[Holmes]

Google warns users of state-sponsored hacking

June 06, 2012|By Richard Allen Greene, CNN

Google users whose accounts are compromised get a message at the top of their browser.

Google has started warning users when it thinks they may be targets of government-sponsored hackers, the Internet giant announced.

Users whose accounts are compromised get a message at the top of their browser saying: "Warning: We believe state-sponsored attackers may be attempting to compromise your account or computer."

Users in China have already begun getting the message, said one former journalist who used to work in Beijing.

"I got this warning three times," said Mei, who asked to be identified only by her first name for security reasons.
Advertisement

Concerned that the warning itself was an attempt to hack her account, she posted a question in a closed Google group, asking if anyone else got the message.

"So far about 10 of us have received the same message, some in Chinese, some in English," she said. The group has about 200 members, she said.

"Some people are not even that surprised because they have suspicious followers on Twitter or Google," she said.

But Mei said she was startled to find out she was apparently a target because she is not a journalist anymore.

"I left this industry about three years ago, in 2009, and left Beijing. I was really surprised that I was still a target," she said.

Google did not accuse China of being behind the hacking, but the company has been at odds with Beijing in the past over Chinese attempts to control Internet use.

Google declined to say how it could tell that governments were behind the hacking attempts.

"We can't go into the details without giving away information that would be helpful to these bad actors," Eric Grosse, Google security engineering vice president, said Tuesday in a post on the company's website.

"But our detailed analysis -- as well as victim reports -- strongly suggest the involvement of states or groups that are state-sponsored," he said.

Getting the warning does not mean a user's account has been hacked, the company said, but that Google believes the account has been a target of phishing, malware or other hacking tools.

Google advises users who get the message to strengthen passwords and update software. It also encourages users to be careful about where they enter their passwords.

Google warns users of state-sponsored hacking - CNN

Germany prepares special unit to tackle cyber attack

PTI Jun 6, 2012, 01.40PM IST
Tags:

BERLIN: Germany has prepared a special cyber warfare unit of its military to conduct offencive operations against computer hackers, who attack key installations or engage in espionage activities, defence ministry has said.

After more than six years of preparations, the special unit of IT specialists in uniform is now in a position to ward off hacker attacks and to mount counter attacks, media reports here said quoting ministry officials.

The cyber troops of the Computer Network Operations (CNO) have reached the initial capability for a cyber warfare on the computers of an adversary, the reports said.

The military began to deal with the threat from internet 20 years ago and a rapid reaction centre was set up at the Federal Office of Information Management and Information Centre of the army for speedy defence against cyber attacks.

The CNO, which operates independently from a location near Bonn, has not been deployed so far, the reports said.

The threat from the internet for its national security has been a main concern for the German government, especially in the wake of intelligence reports that hackers from China broke into the computers of ministries and other government departments to gain access to secret political, military and economic information.

The German interior ministry last year set up a cyber defence centre to step up the fight against the hackers by coordinating the activities of various organisations, including the intelligence services, in combating such crimes.

Germany's domestic intelligence service has been noticing a growing interest among Chinese hackers to infiltrate the government's computer network since 2005 and in most cases Chinese government departments were behind the attacks.

The German government is concerned that besides the espionage activities, hackers might also launch cyber attacks to cripple the computer systems of power plants, power supply systems, pipelines or other public utilities.

The latest high-profile cyber attack was the discovery of malware known as "Flame", which sought data from Iran.

The "Stuxnet" attack against Iran's nuclear installations in June, 2010 marked the first professional deployment of such a computer virus. It was the first computer programme capable of taking control of large industrial plants.

On-line security experts say there are many similarities between the two infections.

Last year, hundreds of hackers paralysed the web sites of MasterCard, Visa and other companies in retaliation to their refusal to deal with the whistle-blower website WikiLeaks.

Germany's initiative to build up its cyber warfare capabilities is also intended to reduce its gap with its main NATO partners such as the US, France and Britain, which are far ahead in digital warfare, the reports said.

Germany prepares special unit to tackle cyber attack - Economic Times
You could be fooled by chinese hackers or some other fundamentalist frauds nearby hiding somewhere.

[dunhill]

The greatest Han's[g] always like that due to the nature land of the Thief.

[Haseebullah]

If you can't protect yourself then my friend you are at the mercy of the aggressor.

[ChinaToday]

america's lap dog cheering for her master as usual

[ChinaToday]

nothing but hackers, spam, bots, trolls, cheap junk items, pollution, comes from China and the list can go on

Alot better than invading others countries killing millions of innocent women and children

[Ulysses]

Alot better than invading others countries killing millions of innocent women and children

you forgot to mention the reasons why we invaded.. and no... we did't kill millions of innocent women and children fool

[darkhero]

India, 9.3%
USA, 8.3%
South Korea, 5.7%
Indonesia, 5.0%
Russia, 5.0%
Italy, 4.9%
Brazil, 4.3%
Poland, 3.9%
Pakistan, 3.3%
Vietnam, 3.2%
Taiwan, 2.9%
Peru, 2.5%

shinning India is the No. 1.

China is not even in top 10, what a shame.

[KRAIT]

India, 9.3%
USA, 8.3%
South Korea, 5.7%
Indonesia, 5.0%
Russia, 5.0%
Italy, 4.9%
Brazil, 4.3%
Poland, 3.9%
Pakistan, 3.3%
Vietnam, 3.2%
Taiwan, 2.9%
Peru, 2.5%

shinning India is the No. 1.

China is not even in top 10, what a shame.

Didn't know we are that good.....

[ChinaToday]

you forgot to mention the reasons why we invaded.. and no... we did't kill millions of innocent women and children fool

Oh really? take a look at this stupid

Civilian Deaths

R.J. Rummel's mid-level estimated that 65,000 North Vietnamese Civilians died from 1960-1975 from bombing.[29]

The Vietnamese government in 1995 estimated that 4,000,000 Vietnamese civilians on both sides died in the war.[4] Overall figures for North Vietnamese civilian dead range from 50,000[1] to 2,000,000.[27]

Vietnam War casualties - Wikipedia, the free encyclopedia

Just that war alone is well over million death Need i post more data from japan, irag , africa Korea ect ect.....

[Holmes]

---

---

China Firms Under Fire
Lawmakers Press Huawei, ZTE Amid Probe About Possible Threats to Security

WASHINGTON—Lawmakers investigating spying threats from China are pressing two Chinese telecommunications firms active in U.S. markets for details about their relationship with the Chinese government and with U.S. companies.

In letters sent Tuesday to Huawei Technologies Co. and ZTE Corp., the top lawmakers on the House intelligence committee outlined concerns about the companies' ties with the Chinese government, including the role of a "party committee" at Huawei.

The lawmakers also asked about Huawei's relationships with five U.S. consulting firms and requested an expansive collection of documents, including the contracts between the firms and Huawei as well as the results of the firms' consulting work for Huawei. Those firms include International Business Machines Corp., Accenture PLC and PricewaterhouseCoopers LLP.
Rep. Mike Rogers is one of the lawmakers asking Huawei and ZTE for details about their business dealings.

Additional questions address work the two companies have done in Iran and their funding arrangements with the Chinese government.

The requests, from Reps. Mike Rogers (R., Mich.) and C.A. Dutch Ruppersberger (D., Md.), provide an initial review of topics under investigation by the committee, which launched a probe late last year into possible threats posed to U.S. national security by Chinese telecommunications firms seeking to do business in the U.S.

"We're very concerned about the Chinese government hacking our national networks," Mr. Ruppersberger said.

The probe, which is ongoing, reflects growing U.S. fears that the Chinese government could access Huawei or ZTE telecommunications equipment and track phone calls or emails, or disrupt or destroy a communications system.

Huawei is a rapidly growing, closely held firm that has sold telecom equipment—including landline, wireless and radio networks—to more than a dozen small U.S. carriers in rural areas as well as metro areas like Chicago. It also makes tablets and smartphones.

ZTE, a maker of telecommunications equipment that derives about half its sales from overseas, has indicated an interest in growing its U.S. presence. Like Huawei, its U.S. headquarters is in Texas and it has hired lobbyists in Washington, D.C.

The companies have stated that their interaction with the Chinese government is typical of a regulated company in China.

At Huawei, spokesman Bill Plummer said the company is just beginning to review the lawmakers' questions and welcomes the opportunity to provide the committee with facts.

Following the investigation, Mr. Plummer said, "we look forward to refocused attention to addressing the true threats to critical infrastructure."

ZTE spokesman Mitchell Peterson said, "as recognized by the committee, ZTE is committed to 'remaining transparent, candid, and cooperative' throughout this inquiry." A Chinese embassy spokesman declined to comment.

A PricewaterhouseCoopers spokesman said the company cannot comment on its clients. A spokesman for IBM declined to comment, while Accenture didn't immediately respond to requests for comment.

The lawmakers don't directly address the potential use of Huawei or ZTE telecommunications products to provide a backdoor for Chinese spying, but the committee continues to examine such concerns, a committee aide said.

Mr. Rogers said he is concerned that these Chinese firms provide opportunities for foreign and economic espionage. He said while he appreciates the companies' cooperation, "their answers to our questions have yet to be persuasive."

He said he remains "deeply concerned about the risk posed to our critical telecommunications infrastructure were these companies to have further access to the U.S. market."

The letters follow up on a series of recent meetings in China between lawmakers and committee staff and representatives from each company. Huawei representatives met with committee staff for 11 hours, and ZTE met with committee aides for about five hours, a committee aide said. Lawmakers followed up with additional meetings in Hong Kong last month with top executives from both companies.

The questions highlight lawmakers' concerns about a Chinese law that allows the government to task Chinese companies with providing information or acting on behalf of the government. The questions also delve into the complicated details of preferential financing the companies may have received from the Chinese government.

In its extensive request for Huawei, the committee asks for details of any connection to a range of government ministries and for further explanation of the role of the company's "party committee," including its powers and who is on it.

The committee also requested details of ZTE's U.S. operations, noting that it got mixed signals from different company officials. Some said the company didn't present a security threat to the U.S. because it had such a small footprint, while others said the company is willing to lose money to gain a larger foothold in U.S. markets.

U.S. Lawmakers Press China's Huawei, ZTE - WSJ.com