Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The FBI investigating hacking of Covid research by “PRC-affiliated cyber actors”

fbi.gov

Post reply on HN
Print view View original

111–120 of 262 posts

Re: The FBI investigating hacking of Covid research by “PRC-affiliated cyber actors”

#111

Post by thephyber »

smkellat wrote: post #39

If you’re doing research of any significance in today’s world and don’t have an active security program looking for harmful actions by foreign intelligence your organization opens itself up for all sorts of nasty liabilities. You don’t even have to have an electronic intrusion. The PRC’s government also pays people off as the case of this former Cleveland Clinic researcher shows: https://www.cleveland.com/crime/2020/…

I'm not sure I agree that it's the responsibility of the people doing research to protect against foreign nation state attacks (whether cyber or legacy intelligence).

1st: most people outside of government don't know how much they are expected/"required" to do to protect their work against foreign nation states. Except for heavily regulated sectors (government, military, heavy industry, banking, core telecom, and more recently elections) very few companies will actually get help from 3-letter-agencies to actively protect against foreign nation state attacks.

2nd: many people expect that the {NSA, Cyber Command, et al} are actively defending all US organizations. I don't see evidence of this (although if there was evidence, I probably wouldn't see it anyway).

3rd: In a national emergency (which the COVID response was declared), there are limits to the liabilities which would otherwise be enforceable in court. There are frequently/always legal escape clauses like force majeure and act of god which would likely alleviate liabilities due to fallout from acts of war or a severe pandemic, so it's not clear that those "nasty liabilities" could be enforced. There are currently 2 important cyberinsurance cases[1] which are winding their way through courts right now which may effectively decide if cyberinsurance is a viable product (depending on whether). Violations of HIPAA are possible, but similarly may not amount to much in terms of prosecution because of the pandemic.

In reality, it's damn near impossible to protect against a motivated+targeted nation state attack (especially with the resources of PRC). If the liabilities incentives require all projects (large and small) be able to withstand nation-state attacks, then all of the project resources go to cybersecurity and none into research -- your productivity is now zero.

It's important to remember that it's the FBI's job to do counter-intel. If a medical research group is defrauded by PRC spies and you blame the researchers for not being able to spot a non-trivial espionage attempt, you are just victim blaming. I work as a product developer in cybersecurity and I doubt I could identify most spy craft if it were to happen right in front of me.

[1] https://www.cpomagazine.com/cyber-security/aig-case-highligh...

Re: The FBI investigating hacking of Covid research by “PRC-affiliated cyber actors”

#112

Post by thephyber »

tree3 wrote: post #54
elliekelly wrote: post #3

I appreciate that there’s probably a lot I don’t know or understand about the national security aspects of this but it seems wrong to not share as much information as possible with as many researchers as possible in order to help as many as people as possible. Protecting security interests is one thing but this press release specifically mentions protecting intellectual property and that seems kind of tone deaf. I al…

Anytime the CCP does something bad, there's always someone like you to downplay it in the comments...

I would like to point out that cyberattack attribution is notoriously difficult.

Re: The FBI investigating hacking of Covid research by “PRC-affiliated cyber actors”

#113

Post by rixed »

tree3 wrote: post #54
elliekelly wrote: post #3

I appreciate that there’s probably a lot I don’t know or understand about the national security aspects of this but it seems wrong to not share as much information as possible with as many researchers as possible in order to help as many as people as possible. Protecting security interests is one thing but this press release specifically mentions protecting intellectual property and that seems kind of tone deaf. I al…

Anytime the CCP does something bad, there's always someone like you to downplay it in the comments...

Which leaves some hope that everybody is not yet brainwashed.

Remember, China sequenced the virus and shared the genome with the whole world to help build tests faster. And now they would try to impede research?

Also, 9 times or of 10 it takes a long time to get an idea of where an attack is coming from. And independently of what they know, 9 times out of 10 politics won't tell you what they know but what they want you to believe. So what are the chances that you have any idea of what actually happened and why? Close to zero.

What to do then? Well, at least let us refrain from howling with the wolves.

Re: The FBI investigating hacking of Covid research by “PRC-affiliated cyber actors”

#114

Post by thephyber »

toshk wrote: post #16
toshk wrote: post #9

Earlier quoted context omitted.

Same here. I remember once I was watching the news and they claimed a hack was done by Russians because they found Russian comments in the code. That didn't sound very convincing :). The ledger evidence sounds better. At the same time in this case I would be more surprised if the PRC , since their need for control, and since the stakes are extremely high, wasn't doing such things.

Was googling to see if I could find a news article to back up my memory. Instead I found an article on Wikileaks claiming CIA executed false flag hacking operations: https://theintercept.com/2017/03/08/wikileaks-files-show-the...

Which is another reason why attribution of cyber incidents is notoriously difficult.

The CIA is hardly the only organization to put misleading evidence in their attack path. Also, countries like China and Russia have healthy malware ecosystems so a Chinese-written malware can end up in the payload of a {North Korean, Russian, Iranian} cyber attack.

Personally, I'm starting to believe that the only way to have extremely high confidence in attributing an attack is to have surveillance of the person on the source keyboard when it happens or to have telecom evidence of people admitting what they did. Most of the actual attack is probably robotic at this point.

Re: The FBI investigating hacking of Covid research by “PRC-affiliated cyber actors”

#115

Post by La1n »

akiselev wrote: post #95
vsareto wrote: post #53

Earlier quoted context omitted.

What kind of liabilities? That looks like a case against an individual. Are you talking human counter-intelligence as well as IT security?

Imagine a state actor hitting the contract research organization in charge of the last phase of a clinical trial for a blood pressure medication and changing data. Due to the nature of double blind trials, catching these modifications can become really hard to catch and could lead to a lot of human suffering.

If they target a CRO the sponsor still has the original data from the trial sites. I can say that at least for the company (one of the 10 largest pharmaceutical companies) I work for this would almost be impossible to not be caught.

Re: The FBI investigating hacking of Covid research by “PRC-affiliated cyber actors”

#116

Post by thephyber »

kube-system wrote: post #46
bt1a wrote: post #2

I've always wondered how you can be so sure it's PRC in the age of easily being able to mask your true IP address. Perhaps the identified attacks have been previously linked with the PRC, or another option is that the actors were not as covert as they thought. Like remember the indictment of 12 russians ( https://www.justice.gov/file/1080281/download ) The FBI linked a pool of bitcoins used to purchase a VPN service…

An IP address is merely one of thousands of ways that you could identify the source of network traffic.

And I'm guessing most of the time the "thousands of ways" don't all point in the same direction.

Re: The FBI investigating hacking of Covid research by “PRC-affiliated cyber actors”

#117

Post by blackrock »

jorblumesea wrote: post #66
free_rms wrote: post #60

Earlier quoted context omitted.

And there's always 100 with extremely selective outrage. We're hacking them, they're hacking us, yawn. We hacked Angela Merkel's phone, even. This is normal low level stuff.

I think the difference is that the West is engaging in surveillance and not sabotage. If the CCP was found to contaminate or corrupt data, that is a far step above Western norms. Also, the West mostly focuses on international relations and national security concerns, whereas the CCP also participates in economic sabotage and IP transfer. For example, it would be big news for the US to have been caught hacking Huawei,…

You seem to have rose colored glasses on, in thinking the west does not do things to sabotage others.

1. Stuxnet was active sabotage.

2. Some Chinese antivirus company, Qihoo360, found signatures of computer viruses in China, that matched CIA field programs. Then, the company got placed on the Entity List. Go figure.

3. All the recent propaganda against Huawei seems to be very sabotage oriented. There was evidence that the United States had already stolen Huawei source code, and actively developed tools to hack it. But, whenever someone brings this up, the justification, is that it’s perfectly legal for the United States to do it to others, because it’s enshrined in our laws, but somehow, it’s not ok for others to do it to the United States. Go figure.

Re: The FBI investigating hacking of Covid research by “PRC-affiliated cyber actors”

#118

Post by rixed »

jorblumesea wrote: post #78
free_rms wrote: post #68

Earlier quoted context omitted.

First off, the west's covert activities are not limited to benign surveillance. Second off.. aside from the total lack of evidence, why would the Chinese be interested in sabotage here? American discovery of a vaccine means they can rip it off, they're definitely not gonna be paying anyone for it. If we're selling it at exorbitant prices while they give it away practically for free to African countries, that's a huge…

> the west's covert activities are not limited to benign surveillance. Compared to the CCP, it's fairly benign. The example you gave, Merkel's phone, is a textbook example. Spy all you want, but we're not stealing IP or sabotaging power grids (to my knowledge). We're not interfering with other countries' covid response or possibly corrupting medical records. > why would the Chinese be interested in sabotage here? Pre…

The power grid I don't know, but gaz pipeline apparently they did.

See for instance https://en.m.wikipedia.org/wiki/At_the_Abyss

Re: The FBI investigating hacking of Covid research by “PRC-affiliated cyber actors”

#119

Post by salawat »

acqq wrote: post #92
goodcjw2 wrote: post #83

Earlier quoted context omitted.

Facts: 1 - HPC centers in Europes are down. 2 - Those are useful resources to battle battle against COVID-19. 3 - HPC centers are down due to malware infections. 4 - FBI warned and Department of Homeland Security warns of possible cyberattacks targeting COVID-19 research.

And in the linked article the probable cause is much more prosaic: "The attacks may have been perpetrated in order to mine cryptocurrency; investigations are ongoing."

I feel like cryptocurrency miner install is going to end up being the new cover story anytime someone doesn't want to tip their hand on capabilities.

Re: The FBI investigating hacking of Covid research by “PRC-affiliated cyber actors”

#120

Post by rixed »

jorblumesea wrote: post #87
free_rms wrote: post #84

Earlier quoted context omitted.

> Compared to the CCP, it's fairly benign It would take a book-length treatment to evaluate that sentence, but I don't think it's justified. We've been VERY active, around the whole world, since WWII. China's only started to look past their immediate neighbors recently. I guess 'benign' can do a lot of work for you if you think we're the protagonists of history.

I don't think anyone would ever argue that the West isn't active or that they've never done anything wrong. Obviously there are huge wikipedia articles and hundreds of books on the subject. But from what it seems of what little we know of that world, the US seems to have some kind of value system, and the CCP has almost none. Freedom of speech is a good example. If the US were to spy on a citizen, they wouldn't end u…

Different countries may have different values. Citizens of those countries are educated to value those different (quite abstract) ideals, such as "freedom of speach" in the US, or "economic development" in China. Like a religion, those systems of values are flexible and abstract enough that you can make them mean whatever you want. Then automatically we tend to think of our system of values as better than any other; indeed, that's what we use values for.

So what have we learn so far? Nothing, apparently.

Post reply on HN