Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cyber Sleuths Track Hacker to China’s Military

wsj.com

Post reply on HN
Print view View original

51–57 of 57 posts

Re: Cyber Sleuths Track Hacker to China’s Military

#51

Post by stephengillie »

throwaway_97 wrote: post #19
dogma1138 wrote: post #7

Earlier quoted context omitted.

try opening it in a private tab, Google tracking cookies seem to break it for some reason.

Thanks, don't know why but opening it in incognito mode broke the signup-wall

Sorry to tangent the tangent, but will we ever see adblockers hunted down the way torrenters were? The net effect is the same, but the scope (news articles) is much smaller.

Re: Cyber Sleuths Track Hacker to China’s Military

#52

Post by meowface »

bobmagoo wrote: post #40
at-fates-hands wrote: post #4

If you get the paywall, I'd advise downloading the actual report from ThreatConnect it's far more detailed: http://www.threatconnect.com/camerashy/

Ugh, not these guys. Hopefully the WSJ article had a better source. ThreatConnect will take any random connection and a big brand name / country and crap out a report.

I've found ThreatConnect's reports to be alright compared to many other security companies. Could you link a report with sloppy research?

Re: Cyber Sleuths Track Hacker to China’s Military

#55

Post by ionised »

stephengillie wrote: post #51
throwaway_97 wrote: post #19

Earlier quoted context omitted.

Thanks, don't know why but opening it in incognito mode broke the signup-wall

Sorry to tangent the tangent, but will we ever see adblockers hunted down the way torrenters were? The net effect is the same, but the scope (news articles) is much smaller.

Possibly.

If we do we will also see it to be equally as futile as trying to stop torrenters.

Re: Cyber Sleuths Track Hacker to China’s Military

#56

Post by ghshephard »

jgome wrote: post #44
ghshephard wrote: post #18

Earlier quoted context omitted.

Well, not meaningless. You can monitor the original values of the hashes, and verify they haven't been changed. The PDFs will be copied around and around. Also - There is no known method to (within the lifetime of this universe) create a different document with the same MD5 and SHA1 and SHA256. Adding the MD5 doesn't weaken things, and might improve them.

Are you saying that some random ISP(s), some third party or even their hosting provider can't modify the PDFs and the sums on the fly to inject malware? Do you really think most people checks the sums?

Here is the way this works.

The person who posts PDFs on websites with MD5/SHA1/SHA256 hashes adds a watchdog to verify that those hashes aren't changing - Once you get the framework together, adding a new page with hashes to the watchdog takes just a few seconds. That way, if the random ISP(s) or third parties are modifying those sums on the fly, will trigger the watchdog.

As to whether most people check the sum - I have no idea, but at least anybody who wants to take 90 seconds to authenticate the document can just go:

x=Project_CAMERASHY_ThreatConnect_Copyright_2015.pdf ; md5 $x; shasum -a 1 $x; shasum -a 256 $x;

Keep in mind - I totally agree with you that this isn't a great mechanism, but I would argue it's better than nothing at all. (as long as someone has a watchdog to confirm the hashes aren't being modified in flight - they could probably help their case a little by at least serving those pages with HTTPS).

A much better mechanism would be to use OpenBSDs signify (http://www.openbsd.org/papers/bsdcan-signify.html) which solves this whole problem of trying to sign documents with something simple that doesn't involve byzantine chains of trust in a very elegant way.

They could just create a key pair:

   signify -G -p threatpub -s sec
And make their public key, which is short, and easy to copy/distribute everywhere - looks like this:

   untrusted comment: signify public key
   RWQw2u3UPjm6spK9OYJxylK2jSKz2agskG2EKPsxwFN4IjHVw66dYPhT
And then, with each document they create, they just sign the PDF:

   signify -S -s sec -m Project_CAMERASHY_ThreatConnect_Copyright_2015.pdf
Which provides a signature file, signed with their private key:

   untrusted comment: signature from signify secret key
   RWQw2u3UPjm6svkWhs4fgy1Qi0P72hp+uDuTxX8bDSvd/qr/7vc55v+PndgDdWOWj0JiLco/CCfOzw6Alau9RTi5gBiHSzuRHAs=
Now, those two documents, the PDF and the Signature file - can be distributed everywhere - and are not subject to a malware attack because everyone has ThreatConnect's public key, which they can use to verify any threatconnect file and signature, with the simple command:

   signify -V -p threatpub -m Project_CAMERASHY_ThreatConnect_Copyright_2015.pdf
I'm presuming that's the better mechanism you have in mind for this sort of thing? I think I'll forward our thread over to the threatconnect team, see if they are willing to upgrade their procedures.

Re: Cyber Sleuths Track Hacker to China’s Military

#57

Post by astaroth360 »

jgome wrote: post #42
astaroth360 wrote: post #41

I mean isn't it already widely accepted that China has one of the world's largest and most active cyber warfare forces? When is the US going to get its shit together and start worrying about cyberdefenses?

>I mean isn't it already widely accepted that China has one of the world's largest and most active cyber warfare forces? Do they? I thought the largest "cyber warfare force" (gotta love these buzzwords) was the NSA, and the US govt itself. The US practically controls the internet...

Well yes, I imagine the US force dwarfs most others, however that doesn't change my being worried about China's activities.

The whole world needs to start making protection of user data (private sphere) and citizen data (public sphere) a priority. Until that happens, there will continue to be massive hacks of sensitive data that end up hurting very large numbers of people.

It's well past time that the world as a whole started taking the issue of cyber security seriously.

Post reply on HN