Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The FBI investigating hacking of Covid research by “PRC-affiliated cyber actors”

fbi.gov

Post reply on HN
Print view View original

171–180 of 262 posts

Re: The FBI investigating hacking of Covid research by “PRC-affiliated cyber actors”

#171

Post by wbl »

smkellat wrote: post #39

If you’re doing research of any significance in today’s world and don’t have an active security program looking for harmful actions by foreign intelligence your organization opens itself up for all sorts of nasty liabilities. You don’t even have to have an electronic intrusion. The PRC’s government also pays people off as the case of this former Cleveland Clinic researcher shows: https://www.cleveland.com/crime/2020/…

The harmful action being getting info that will be published in Cell or Nature six months early?

Re: The FBI investigating hacking of Covid research by “PRC-affiliated cyber actors”

#172

Post by cscurmudgeon »

zxcmx wrote: post #165
cscurmudgeon wrote: post #160

Earlier quoted context omitted.

> Given today's anti-free-thinker HN climate You should champion China to be more transparent about the origins of the virus. Even if it did not originate in a lab, shining more light on its origins will help prevent future outbreaks. China also actively prevented Taiwan from joining the WHO. This would have resulted in more free flow of information. Curiously, I was a labelled a racist for making this statement. > P…

You didn't address what parent said at all. Parent said all COVID-19 research should be freely available to all as a matter of principle. What China does or doesn't do has no bearing on this.

Doesn't the origin and initial spread of the virus fall under COVID-19 research?

Is it fair and ethical to ask country A to make free all research while being okay with country B hiding its own research on the same subject?

Let us not whitewash unethical behavior with broad strokes of "freely available to all as a matter of principle."

Re: The FBI investigating hacking of Covid research by “PRC-affiliated cyber actors”

#173

Post by cscurmudgeon »

wbl wrote: post #171
smkellat wrote: post #39

If you’re doing research of any significance in today’s world and don’t have an active security program looking for harmful actions by foreign intelligence your organization opens itself up for all sorts of nasty liabilities. You don’t even have to have an electronic intrusion. The PRC’s government also pays people off as the case of this former Cleveland Clinic researcher shows: https://www.cleveland.com/crime/2020/…

The harmful action being getting info that will be published in Cell or Nature six months early?

So two questions (not to you, but the general audience):

1. Are you ok if some entity steals your research and publishes it under their name in a venue under their name before you publish it?

2. Are you okay if the entity stealing the research is not similarly liberal with their own research on the same subject?

Re: The FBI investigating hacking of Covid research by “PRC-affiliated cyber actors”

#174

Post by eloisius »

SaintGhurka wrote: post #170
eloisius wrote: post #143

Earlier quoted context omitted.

Yeah and we also dropped potato beetles via parachutes over crops across Warsaw Pact countries https://en.wikipedia.org/wiki/War_against_the_potato_beetle

Your link doesn't provide any evidence of this. "Communist propaganda of the time claimed that the insect was being dropped from parachutes and balloons"

Poe's law strikes again

Re: The FBI investigating hacking of Covid research by “PRC-affiliated cyber actors”

#175

Post by boomboomsubban »

Larrikin wrote: post #167
boomboomsubban wrote: post #26

Earlier quoted context omitted.

Why would the FBI be hesitant about faking/sensationalizing this? It's nearly impossible to prove, China's unlikely to make an issue out of it, and even if the lie got exposed what punishment would they face?

Are you an infosec expert? You have said that it is impossible to trace origins of hacks multiple times but only offer two shallow points that you would learn about in your first week of a network security class. There are papers out there that have multiple ways of using language to identify specific authors, determine multiple authors, and even decode unknown language. That's my first shallow example and would be a…

>You have said that it is impossible to trace origins of hacks

I have not said this. The evidence they have provided makes it equally likely that they've tracked these hacks (correctly or incorrectly) or that they've made the whole thing up. You can't rule out either action.

>There are papers out there that have multiple uses of using language to identify specific authors, determine multiple authors, and even decode known language. That's my first shallow example and would be a pretty reliable indicator if you could get your hands on their code

There have been multiple papers on these subjects, with a budget of millions of dollars I'm sure identifiers could be faked. Particularly with password spraying, the only method mentioned.

Re: The FBI investigating hacking of Covid research by “PRC-affiliated cyber actors”

#176

Post by mensetmanusman »

Have family that work in encryption, you can think of barriers to entry as orders of magnitude in cost.

AWS can decipher decade old encryption standards for about $100k brute computational cost.

Nation states have access to 5-8 zeros of effort if it is valuable enough. Private entities have no chance against nation-state backed hacking efforts.

It’s one-sided or ‘asymmetric’, because western intelligence refuses to share commercial intelligence with western businesses (probably because there isn’t much of value to share... yet).

Only solution is political change.

Re: The FBI investigating hacking of Covid research by “PRC-affiliated cyber actors”

#177

Post by scarmig »

cscurmudgeon wrote: post #172
zxcmx wrote: post #165

Earlier quoted context omitted.

You didn't address what parent said at all. Parent said all COVID-19 research should be freely available to all as a matter of principle. What China does or doesn't do has no bearing on this.

Doesn't the origin and initial spread of the virus fall under COVID-19 research? Is it fair and ethical to ask country A to make free all research while being okay with country B hiding its own research on the same subject? Let us not whitewash unethical behavior with broad strokes of "freely available to all as a matter of principle."

> Is it fair and ethical to ask country A to make free all research while being okay with country B hiding its own research on the same subject?

An American journalist toured the Soviet Union in the 1930s. Everyone he spoke to proudly bragged about the USSR and its accomplishments. But some things seemed off. He asked about the mass starvation, and his handler explained it was because the kulaks destroyed their food to spite the people. He questioned why newspapers would one day say one thing, and the next denounce the same as counterrevolutionary. His handler responded, there was no difference, he's just misunderstanding the context. Finally he asked about political opponents mysteriously disappearing when they stood against Stalin.

Exasperated, the handler shrieked, "And you are lynching negroes!"

Re: The FBI investigating hacking of Covid research by “PRC-affiliated cyber actors”

#178

Post by teknopaul »

cscurmudgeon wrote: post #172
zxcmx wrote: post #165

Earlier quoted context omitted.

You didn't address what parent said at all. Parent said all COVID-19 research should be freely available to all as a matter of principle. What China does or doesn't do has no bearing on this.

Doesn't the origin and initial spread of the virus fall under COVID-19 research? Is it fair and ethical to ask country A to make free all research while being okay with country B hiding its own research on the same subject? Let us not whitewash unethical behavior with broad strokes of "freely available to all as a matter of principle."

How could you know that "country A is hiding research"? If its hiding it, you dont know about it, unless you are spying/hacking yourself.

FBI stance is we can hide stuff from you, and hack you, because we are the "good guys".

Re: The FBI investigating hacking of Covid research by “PRC-affiliated cyber actors”

#179

Post by dheera »

dunkelheit wrote: post #150
dheera wrote: post #133

Earlier quoted context omitted.

> Oxford running out of people to test their vaccine on: https://news.cgtn.com/news/2020-05-25/COVID-19-disappearing-... . I'm not a medical expert, but can someone in the know comment on this? Can I volunteer to get the Oxford vaccine in the US? Can I volunteer to fly to UK and get the vaccine immediately upon arrival?

The problem is not the absence of volunteers, the problem is that as the first wave of the epidemic recedes, most volunteers won’t catch the disease by themselves and thus will add no information as to whether the vaccine works. And challenge trials (deliberately infecting people) are apparently a big ethical no-no.

While that's true, it is still possible to get data by giving the vaccine to as many people as possible and seeing if the virus recedes faster than previous models predicted. If the slope of the trend suddenly buckles when people start taking the shots, there's a good chance it did something.

Although I'm also strongly against deliberately infecting people, if there is a high chance there is no danger to take the vaccine, and a strong possible upside (i.e. possibly save lives in the next 2 weeks), I don't see why we it isn't okay to volunteer to take it today, even if it isn't a fully conclusive data point. Hell, if there are 5 candidate vaccines, and they are all non-dangerous, I'd love to take all of them just to protect my own life, even if that makes me not as useful of a useful data point. There's a nonzero chance the virus will kill me in 2 weeks, 4 weeks, 6 weeks, and I think it is only ethical to reduce that chance even if that means 5 shots (pun intended) in the dark.

Of course, I see people downvoting me and it seems HN doesn't welcome this type of discussion anymore.

Re: The FBI investigating hacking of Covid research by “PRC-affiliated cyber actors”

#180

Post by AnthonyMouse »

thephyber wrote: post #111
smkellat wrote: post #39

If you’re doing research of any significance in today’s world and don’t have an active security program looking for harmful actions by foreign intelligence your organization opens itself up for all sorts of nasty liabilities. You don’t even have to have an electronic intrusion. The PRC’s government also pays people off as the case of this former Cleveland Clinic researcher shows: https://www.cleveland.com/crime/2020/…

I'm not sure I agree that it's the responsibility of the people doing research to protect against foreign nation state attacks (whether cyber or legacy intelligence). 1st: most people outside of government don't know how much they are expected/"required" to do to protect their work against foreign nation states. Except for heavily regulated sectors (government, military, heavy industry, banking, core telecom, and mor…

> many people expect that the {NSA, Cyber Command, et al} are actively defending all US organizations. I don't see evidence of this (although if there was evidence, I probably wouldn't see it anyway).

If you keep your confidential research results on an unpatched server with weak passwords and exposed to the internet, what is the NSA supposed to do about that?

About the best thing they could do is to scan for and find the vulnerability before the attackers and notify you about it, which in general they don't. And it still wouldn't solve most of the problem because there would be objections if they did more than a cursory scan, which means they won't find most problems, but the attackers are under no such limitations.

> there are limits to the liabilities which would otherwise be enforceable in court

I don't think this is the kind of liability they're talking about. If your confidential research falls into the hands of economic spies, the problem isn't so much that someone is going to sue you as that your research and any relevant patents have now lost their economic value because a knockoff product will beat you to market.

> cyberinsurance

This is liable to be more of a grant hog than liability would. Not only do you have to pay the premiums -- which would be high unless researchers adopt good security practices, which having the insurance would give them the incentive to do the opposite of -- but you also then have the insurance company imposing some kind of bureaucratic best practices procedures that gives you even more compliance costs than you would get from having liability, because the insurance company has misaligned incentives with respect to the level of compliance burden to impose, since they don't pay any of it but get all the benefits.

The reality is, the researchers are the ones operating the systems their research is on. They're the ones who have to secure them. And they already largely have the right incentives to want to do that, but they also have a poor understanding of the necessity of it and the process for doing it.

What would help here are the things that would help in general. Fund vulnerability research in free software so that the software people are using (because it's what they can afford) is secure by default, and easy enough to use that people don't commonly make mistakes, and well-documented. Things like that. Make it easier to do the right thing so more people do.

Post reply on HN