Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google uncovers major account-hijacking campaign targeting senior US officials

googleblog.blogspot.com

Post reply on HN
Print view View original

51–60 of 89 posts

Re: Google uncovers major account-hijacking campaign targeting senior US officials

#51

Post by Volpe »

misterbwong wrote: post #49
davepage wrote: post #45

Earlier quoted context omitted.

50 cent army much?

Looks like it. 1 comment (the grandparent), account created 69 days ago, shilling for the Chinese government. For those who don't get the reference, here's an article that explains it: http://www.guardian.co.uk/media/2008/sep/22/chinathemedia.ma...

I see, so rather than actually discuss the points I make, just attack me as some chinese govt astro-turfer... wtf!?

Just because I haven't commented before doesn't make my comment less valid... does it?

Re: Google uncovers major account-hijacking campaign targeting senior US officials

#52

Post by denimboy »

MatthewB wrote: post #20

Does it bother anyone that China continues to hack us? It is very possible that this was a government-backed attack, which wouldn't be the first against Google by the Chinese government. The biggest problem is that these don't seem to be sophisticated attacks. They didn't find a backdoor or install some malicious piece of code...they simply "hacked people" with phishing scams. I think a great place for the US govt (a…

What bothers me at least is that although Google finds these things (thank you), how many non-gmail accounts have been hacked but nobody has noticed yet.

Re: Google uncovers major account-hijacking campaign targeting senior US officials

#53

Post by slug »

Volpe wrote: post #51
misterbwong wrote: post #49

Earlier quoted context omitted.

Looks like it. 1 comment (the grandparent), account created 69 days ago, shilling for the Chinese government. For those who don't get the reference, here's an article that explains it: http://www.guardian.co.uk/media/2008/sep/22/chinathemedia.ma...

I see, so rather than actually discuss the points I make, just attack me as some chinese govt astro-turfer... wtf!? Just because I haven't commented before doesn't make my comment less valid... does it?

Unfortunately, after seeing the firewall logs of several Internet facing machines in distinct hosting providers in different parts of the world, it's quite interesting to notice that 90% if not more of the port scans, http vulnerability scans, among others, come from network blocks from that part of the planet.

Even more illuminating that if their great firewall is so advanced, being able to block anything on a need basis, is not concerned on blocking these.

Re: Google uncovers major account-hijacking campaign targeting senior US officials

#54

Post by mixmax »

MatthewB wrote: post #20

Does it bother anyone that China continues to hack us? It is very possible that this was a government-backed attack, which wouldn't be the first against Google by the Chinese government. The biggest problem is that these don't seem to be sophisticated attacks. They didn't find a backdoor or install some malicious piece of code...they simply "hacked people" with phishing scams. I think a great place for the US govt (a…

The reason we only see the unsophisticated attacks might well be that the ones that are carried out professionally are never caught.

If I was China and intent on this kind of cybercrime I wouldn't put all my eggs in one basket, but would try different avenues to get to my target. Resources don't seem to be a problem since it's apparently government backed.

I would see this as the top of the iceberg, and expect there to be more sophisticated attacks hiding out there that we might never know about.

Re: Google uncovers major account-hijacking campaign targeting senior US officials

#55

Post by dantheman »

ansy wrote: post #50
MatthewB wrote: post #36

Earlier quoted context omitted.

I saw this a few days ago. I believe that if another country hacked the US and took top secret data, it could potentially cause as much damage as a conventional weapon. So, using conventional weapons in retaliation for cyber-attacks doesn't seem that far fetched. We are definitely in an interesting time with regards to technology and policy. Both exciting and scary.

I would not be surprised if the United States got a specialized "Cyber Force" branch of the military sooner rather than later to go along with Army, Navy, and Air. There are apparently already papers about it like this one from 2008: PDF: http://www.albanylawjournal.org/articles/solce_0609.pdf Abstract: https://litigation-essentials.lexisnexis.com/webcd/app?actio... Granted, that niche is somewhat filled by the NSA,…

I don't think you'll see a new branch, but there already is a Cyber Command - http://en.wikipedia.org/wiki/United_States_Cyber_Command

Re: Google uncovers major account-hijacking campaign targeting senior US officials

#56

Post by andrewcooke »

andrewcooke wrote: post #34
yanw wrote: post #13

Earlier quoted context omitted.

There are no 'backdoor' shenanigans, they comply with subpoenas like everyone else (they uniquely provide a transparency report) the Schneier claim was speculative and he dismissed it later. In this case it's phishing, read the post.

do you know where he dismissed it? the article at http://www.schneier.com/essay-306.html is still up, with no disclaimer or obvious link to a correction.

why do people downvote questions like this? it makes no sense to me at all. am i doing something wrong? i thought i was polite and on-topic.

Re: Google uncovers major account-hijacking campaign targeting senior US officials

#57

Post by haberman »

Volpe wrote: post #41
MatthewB wrote: post #20

Does it bother anyone that China continues to hack us? It is very possible that this was a government-backed attack, which wouldn't be the first against Google by the Chinese government. The biggest problem is that these don't seem to be sophisticated attacks. They didn't find a backdoor or install some malicious piece of code...they simply "hacked people" with phishing scams. I think a great place for the US govt (a…

Easy to read western propaganda and jump to conclusions without viewing the whole picture. Of course the US hack the Chinese govt. Just because china don't publish accounts of attacks does not mean attacks are not occurring. We already know Google are quite jaded towards China given their failure to succeed in the china market. Thus I take anything they comment about China with a grain of salt, given they clearly hav…

> An attack originating in Jinan does not necessarily mean chinese govt either.

In that case, we should expect to see a vigorous Chinese investigation into this illegal activity that originated from China, right?

Just like there was a comprehensive Chinese response to the well-documented cyber attacks on several American tech companies that originated from China in Dec 2009?

Re: Google uncovers major account-hijacking campaign targeting senior US officials

#58

Post by Volpe »

slug wrote: post #53
Volpe wrote: post #51

Earlier quoted context omitted.

I see, so rather than actually discuss the points I make, just attack me as some chinese govt astro-turfer... wtf!? Just because I haven't commented before doesn't make my comment less valid... does it?

Unfortunately, after seeing the firewall logs of several Internet facing machines in distinct hosting providers in different parts of the world, it's quite interesting to notice that 90% if not more of the port scans, http vulnerability scans, among others, come from network blocks from that part of the planet. Even more illuminating that if their great firewall is so advanced, being able to block anything on a need…

My understanding was the great firewall isn't so advanced. It is essentially a filter system, run in quite a manual fashion (i.e eyeballs on screens assessing if things should be blocked).

I'm not refuting attacks originating from china, there is piles of evidence that support this.

Things to keep in mind - there are more internet users in china, than anywhere else, so there is going to be more of 'everything' from china. One needs to convert the stats into per-capita ratios before making meaningful conclusions about % of attacks etc.

My main issue (in my original post) is the jump from "Attack from Chinese IP addresses on gmail accounts" to "China attacked us [The US]" - without any qualification.

It promotes a nationalistic 'Us against Them' mentality that is primarily based on hysteria rather than fact.

Re: Google uncovers major account-hijacking campaign targeting senior US officials

#59

Post by enneff »

kristofferR wrote: post #39
enneff wrote: post #28

Earlier quoted context omitted.

How about 2-factor authentication, as discussed in the article?

SMS is not global and is quite expensive to get started with. Only the major players like Google can roll out worldwide SMS authentication. Email is out of the question because it often takes several minutes to receive an email (due to POP-fetching intervals etc)

The 2-factor auth process doesn't use SMS, it uses a one-time-password generator app that you can run on modern smartphones.

Re: Google uncovers major account-hijacking campaign targeting senior US officials

#60

Post by hugh3 »

marklabedz wrote: post #31
MatthewB wrote: post #20

Does it bother anyone that China continues to hack us? It is very possible that this was a government-backed attack, which wouldn't be the first against Google by the Chinese government. The biggest problem is that these don't seem to be sophisticated attacks. They didn't find a backdoor or install some malicious piece of code...they simply "hacked people" with phishing scams. I think a great place for the US govt (a…

I'm sure its no accident that the Pentagon stated they may treat cyber attacks as "acts of war" - http://www.bbc.co.uk/news/world-us-canada-13614125

Except that unless they actually do treat it as an act of war, it's an empty and pointless threat.

And they're clearly not treating it as an act of war, which is why the US (thankfully) isn't at war with China right now.

Politically, going to war with China just because they hacked the SecDef's email would be an impossible sell to the American people, who frankly aren't that keen on starting World War 3 unless it's absolutely necessary. If the Pentagon is getting hacked by China then the correct response is better security, not making threats, whether idle or serious.

Post reply on HN