Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chinese Hackers Infiltrate New York Times Computers

nytimes.com

Post reply on HN
Print view View original

41–50 of 183 posts

Re: Chinese Hackers Infiltrate New York Times Computers

#41

Post by knowtheory »

jebblue wrote: post #28
temphn wrote: post #19

I think it's important to understand the Chinese perspective on this issue, if only to see why they do these things. Start with this: http://www.nytimes.com/2011/04/15/world/15aid.html?pagewante... U.S. Groups Helped Nurture Arab Uprisings Even as the United States poured billions of dollars into foreign military programs and anti-terrorism campaigns, a small core of American government-financed organizations were pr…

>> Whether or not you believe the Arab Spring actually resulted in good outcomes, the salient fact is that US funded groups started the revolutions and prominent neocons (like Fukuyama in that WSJ article) were/are calling for similar actions in China. This is why the Chinese government feels that it is under attack by the United States The Chinese don't give a rat's hoot about the Arabs. They attack American compute…

You are also categorically incorrect.

The Chinese central government most certainly cares about Arabs, as they share a disputed border with several majority Muslim countries, including Pakistan and Afghanistan.

Moreover they have repressed domestic minority populations who are predominantly Muslim. The extent to which there are Islamic unification or nationalist movements (which are often tied in with movements in the middle east), the Chinese government very much does care about unrest amongst Chinese muslim populations.

Re: Chinese Hackers Infiltrate New York Times Computers

#42

Post by sillysaurus »

sc00ter wrote: post #22

"It then replaced every compromised computer and set up new defenses in hopes of keeping hackers out." I hope that's just poor reporting, or does the Times' IT department really have that poor an understanding of how computers work? No wonder they got pwned. And I'm not buying the "we gave them free reign for four months on purpose" line. It makes no sense.

"It then replaced every compromised computer and set up new defenses in hopes of keeping hackers out." I hope that's just poor reporting, or does the Times' IT department really have that poor an understanding of how computers work?

The audience of NYT understands "We replaced the compromised computers."

Whereas the audience won't understand "We rebuilt each compromised computer, taking care to ensure they weren't exposed to the internet (and, additionally, were isolated from our internal network) until we were certain we'd patched every security flaw the attackers had previously exploited. We've also made policy changes to minimize the attack surface of our new infrastructure."

Therefore, those are wasted words. In fact, those words are an unnecessary risk. It's a risk because it's a strategic mistake for a newspaper to publish confusing articles.

Re: Chinese Hackers Infiltrate New York Times Computers

#43

Post by beagle3 »

onedognight wrote: post #34
damian2000 wrote: post #26

Earlier quoted context omitted.

Maybe they actually meant every compromised computer OS (i.e. hard disk)?

Maybe they mean OS and BIOS?

And network card firmware. And graphics card firmware. And in some cases, also ILO firmware, DVD drive firmware, and maybe a few other pieces.

If you trust your IT supplier, and the equipment is a two years old, it's probably more economical to replace everything than try to fix it.

But why would you trust your IT supplier - who sources all their stuff from China in the first place?

Re: Chinese Hackers Infiltrate New York Times Computers

#44

Post by pifflesnort »

jenandre wrote: post #38
pifflesnort wrote: post #25

Earlier quoted context omitted.

China appears to be engaging in highly sophisticated attacks of the like that major companies need to be aware. The RubyGems fiasco is the result of remarkably incompetent decisions by everyone in the chain of control. The lessons are completely different. In the first, it's that you have to expect that you will be compromised if a determined and capable attacker targets you. In the second, it's that you will be comp…

I don't think the RubyGems people were incompetent. The software serves its core purpose quite well (as a library delivery mechanism) and is quite reliable. But clearly they weren't thinking about security in decision, and what would happen if the repos were compromised. Let's be honest here - no software is 100% secure. As developers and consumers, the idea that we all review all of the tools in our toolchain for se…

> I don't think the RubyGems people were incompetent.

They sat on a publicly disclosed vulnerability in the YAML parser for a week. The YAML parser itself was ridiculously designed to (essentially) eval() YAML.

Those were the two active decisions of incompetence.

On top of this, they built a massively central system that is widely trusted with no means of code verification whatsoever. There is no telling what people could have injected into that repository at any point in its history.

Re: Chinese Hackers Infiltrate New York Times Computers

#46

Post by OGinparadise »

brown9-2 wrote: post #15

If you want to give credit to a report detailing how much money your political leaders have piled up for themselves, hacking the media outfit that published it is a great way to confirm the story.

If you want to give credit to a report detailing how much money your political leaders have piled up for themselves, hacking the media outfit that published it is a great way to confirm the story.

Do you think it matters now for the Chinese gov? By doing this and more they will make it very expensive for NYT and impossible for smaller outfits to mess with them. Maybe they'll uncover some dirt and release it to embarrass or discredit its reporters, who knows.

Google thought they'd forced them to back down and we know what happened.

Re: Chinese Hackers Infiltrate New York Times Computers

#47

Post by wes-exp »

fatjokes wrote: post #2

"Security experts found evidence that the hackers stole the corporate passwords for every Times employee and used those to gain access to the personal computers of 53 employees" Does this mean the NYTimes is storing passwords in plaintext?

No, it means they use Windows :)

Re: Chinese Hackers Infiltrate New York Times Computers

#48

Post by babarock »

temphn wrote: post #19

I think it's important to understand the Chinese perspective on this issue, if only to see why they do these things. Start with this: http://www.nytimes.com/2011/04/15/world/15aid.html?pagewante... U.S. Groups Helped Nurture Arab Uprisings Even as the United States poured billions of dollars into foreign military programs and anti-terrorism campaigns, a small core of American government-financed organizations were pr…

Very good points!

>> it does not see a line between NGOs, the NYT/WSJ, and the US government.

Aren't we all doing the same mistake when we refer to them? All we know is that the attacks came from China, so we safely assume it came from the Government? Why is it that each time something comes from China (a country with approximately 5 time more people than the US - source Wikipedia) we blame their government and treat it as a declaration of war (or, with less exaggeration, a political move)? Is it possible that this enormous gigantic human honeycomb has, say, organizations, corporations, competitors, God-knows-what-which-isn't-their-government?

The western media have created this weird image of China and ... something doesn't add up. I've never been there and I hope I'll get the chance some day, but I can't help but feel that "someone" (feel free to replace this word with the antagonists of your favorite conspiracy theory) is trying to shove down our throat that China is a menace.

That being said, I agree with your analysis. The Chinese government has seen what happened in the Arab world and it knows that the US constantly needs an enemy. It probably does feel threatened.

Re: Chinese Hackers Infiltrate New York Times Computers

#49

Post by tedunangst »

m0nastic wrote: post #29
tedunangst wrote: post #18

Earlier quoted context omitted.

Surely the Times could waive whatever privacy rights they have? Your example would be more on target if Oracle told Tumblr that they couldn't comment. What I'm getting at is, "We don't want to comment on our product ." is a lot closer to the truth, they're just trying to weasel out of saying that.

Edit: It took me so long to write that that you edited your comment before I finished. ;) I think we're in agreement. It's not really about privacy (which was why when I saw the quote in the article, I giggled, and thought "That reporter's being funny"), it's about the fact that Symantec isn't even in a position to have a comment about it. If they were super on the ball and forthcoming, they might comment "We make so…

Sorry, I added the second part a little later.

Re: Chinese Hackers Infiltrate New York Times Computers

#50

Post by OGinparadise »

Volpe wrote: post #16

Strange that they would hack NYT when NYT's source for the WenJiaobao article seemed to be public financial records and info from wikileaks (state department cables). What is the strategic gain from hacking NYT? Identify potential other sources (within china) perhaps?

What is the strategic gain from hacking NYT? Identify potential other sources (within china) perhaps?

---email---

Hey [NYT reporter,] you may wanna check this ....lists wealth and place where this can be verified...

James ---------

--------- email 2

Hey NYT Exec got a tip from a State Dept source regarding Chinese leaders wealth.... --------

Maybe they'll get a "I can't believe he/she gave me herpes" email or at worst they mess with, and raise the cost of doing business for NYT. The cost to the Chinese is as close to zero as possible, they have the money and manpower, so why not do it.

Post reply on HN