Live data from Hacker News

Chinese Hackers Infiltrate New York Times Computers

nytimes.com

151–160 of 183 posts

Re: Chinese Hackers Infiltrate New York Times Computers

#151
post #115

Earlier quoted context omitted.

> As for the phrase "conspiracy theory", the implication of that phrase is that conspiracies don't exist. Exactly this. Or that all theories are not worth our time, since they are just that, "just a theory" (implying there is no proof?), like creationists (of which, America is filled with) like to say.

> Or that all theories are not worth our time, since they are just that, "just a theory" (implying there is no proof?), like creationists (of which, America is filled with) like to say. congratulations on the beautiful ad hominem

I don't see it. I was adding to the argument that you are using the word "theory" with a negative connotation, which makes absolutely no sense. And that mistake is very common in America, since you have religious folks spreading misinformation all over the country, including schools. On the other hand, I can see an ad hominem here:

> the idea of Americans/Zionists/Illuminati/Nibiru pulling the strings behind every major event is no doubt very exciting for conspiracy theorists

Someone is a "conspiracy theorist", so whatever he finds exciting must be wrong.

Re: Chinese Hackers Infiltrate New York Times Computers

#154
post #143

Earlier quoted context omitted.

Well, you implied in your comment below that you weren't interested in a simple "discussion of how evil a regime is". Very understandable and I agree with you. Yet the thing is that without this context Americans just don't understand why the Chinese military would get involved on a negative story about a leader. It seems like a gross overreaction. Indeed, without understanding the context it just seems "evil". Until…

Again, all you've done is repeat the same explanation for the Great Firewall and censorship of news as soon as it starts to appear to be capable of "fomenting dissent". It's worth noting that many in China do not share your view, and we have the weibo messages to prove it. While there is certainly a good bit of animosity aimed at the US (both well-sourced and born of invented stories), it's ridiculous to claim that e…

  the complete lack of agency you seem to believe the people 
  that actually live in Egypt, Tunisia, Libya, Syria, etc had 
  in deciding to revolt in the first place. 
http://www.guardian.co.uk/world/2012/oct/21/barack-obama-ara...

  Egypt's revolution provided the first hurdle. Obama was 
  criticised for backing stability as the drama of Tahrir 
  Square unfolded. But on 1 February came his call for 
  Mubarak to step down "now". As the New York Times wrote: 
  "Obama upended three decades of American relations with its 
  most stalwart ally in the Arab world, putting the weight of 
  the United States squarely on the side of the Arab street."
As for this:

  look back through history. Nation building by rebel proxy 
  does not work 
Nation building doesn't work. Revolution by rebel proxy sure does. Governments don't overthrow themselves. As for history, the American Revolution succeeded because the French were pumping in money. The Vietnamese beat off the Americans because they had the Chinese and Soviets in their corner. The Afghans repelled the USSR with the help of the US and the Stinger missile. You will be hard pressed to find a revolution that won or even began without the intervention of foreign powers; where are the armaments coming from in the first place? The record shows that the Arab Spring was caused by US training, funding, armaments, and media support.

http://www.nytimes.com/2011/04/15/world/15aid.html?pagewante...

  “We learned how to organize and build coalitions,” said 
  Bashem Fathy, a founder of the youth movement that 
  ultimately drove the Egyptian uprisings. Mr. Fathy, who 
  attended training with Freedom House, said, “This certainly 
  helped during the revolution.”

  At one time the United States financed political reform 
  groups by channeling money through the Egyptian government. 
  But in 2005, under a Bush administration initiative, local 
  groups were given direct grants, much to the chagrin of 
  Egyptian officials.

  The Egyptian government even appealed to groups like 
  Freedom House to stop working with local political 
  activists and human rights groups.

  “They were constantly saying: ‘Why are you working with 
  those groups, they are nothing. All they have are slogans,’ 
  ” said Sherif Mansour, an Egyptian activist and a senior 
  program officer for the Middle East and North Africa at 
  Freedom House.

  When their appeals to the United States government failed, 
  the Egyptian authorities reacted by restricting the 
  activities of the American nonprofit organizations.

  In the face of government opposition, some groups moved 
  their training sessions to friendlier countries like Jordan 
  or Morocco. They also sent activists to the United States 
  for training.
Further documentation on this topic is not hard to find. But feel free to minimize the explicit, acknowledged support of the most powerful country in the world for violent democratic revolution in favor of local "agency". As for whether this article on the #2 leader in China was printed at random, The New York Times has a track record of coordinating with the US government:

http://www.nytimes.com/2011/02/22/world/asia/22pakistan.html...

  The New York Times had agreed to temporarily withhold 
  information about Mr. Davis's ties to the agency at the 
  request of the Obama administration, which argued that 
  disclosure of his specific job would put his life at risk. 
  Several foreign news organizations have disclosed some 
  aspects of Mr. Davis's work with the C.I.A. On Monday,  
  American officials lifted their request to withhold 
  publication, though George Little, a C.I.A. spokesman, 
  declined any further comment.
http://www.salon.com/2011/02/21/nyt_16/

  It's one thing for a newspaper to withhold information 
  because they believe its disclosure would endanger lives. 
  But here, the U.S. Government has spent weeks making public 
  statements that were misleading in the extreme -- Obama's 
  calling Davis "our diplomat in Pakistan" -- while the NYT 
  deliberately concealed facts undermining those government 
  claims because government officials told them to do so. 
  That's called being an active enabler of government 
  propaganda. ...

  Following the dictates of the U.S. Government for what they 
  can and cannot publish is, of course, anything but new for 
  the New York Times. In his lengthy recent article on 
  WikiLeaks and Julian Assange, NYT Executive Editor Bill 
  Keller tried to show how independent his newspaper is by 
  boasting that they published their story of the Bush NSA 
  program even though he has "vivid memories of sitting in 
  the Oval Office as President George W. Bush tried to 
  persuade [him] and the paper's publisher to withhold the 
  eavesdropping story"; Keller neglected to mention that the 
  paper learned about the illegal program in mid-2004, but 
  followed Bush's orders to conceal it from the public for 
  over a year -- until after Bush was safely re-elected.
In other words, whether under Bush or Obama, the NYT has an acknowledged track record of coordinating with the US government on stories that could result in international incidents. A hit piece on one of the top people in the Chinese government might not have been done at the State Department's request, but it certainly would not have been published over the State Department's objection. The fact that its effect was to sow discontent with China's leadership is not unnoticed by anyone skeptical of US-exported democratic revolution.

Re: Chinese Hackers Infiltrate New York Times Computers

#155
post #124

Earlier quoted context omitted.

I'm first generation Chinese-American, IMO not going to happen. Chinese people are concerned about money first and foremost followed by their family. Also I'd like to challenge the implied perspective that somehow American democracy is somehow superior. In fact the very notion of fighting for a political cause is a Western idea, Chinese people are less naive than Americans in a sense because everyone in China knows t…

I think you're overstating your case. I would say the "228 incident" [1] would counter your assertion that rallying cries (political causes) are anathema or that people don't care about authoritarianism as they might seek over ways to overcome the difficulties presented by such (following your waves in the ocean). I think the healthy political involvement (even antagonistic approach) to politics in, practically Chine…

The political ecology of Taiwan when 228 incident occurred is largely different than the current (smoggy and turbid) one in Mainland China. And in the late 1980s, KMT regime lost its vitality(, but still holds some kinda moral integrity, )as the older generation who fled from the Mainland to Taiwan around late 1940s died out or retired, allowing a transformation of the political session there. However, in Mainland China, the power of the ruling party still tightly grasp the controls and the grassroots are more suppressed and less clearly divided than those in Taiwan at the time.

I'm not trying to generalize that a revolution would not happen here in China but changes in near future is highly unlikely, except that the economy of China would collapse or the ruling party itself would be split by inner struggles.

Re: Chinese Hackers Infiltrate New York Times Computers

#156
post #74

Earlier quoted context omitted.

How likely do you think a Chinese spring would be? It's unfortunate that we don't get more foreign perspective on HN and Reddit - I hope you comment more.

What? Why? I happily wish for the day that the Great Firewall gets shut off, but in my book, the Chinese Government has been fantastically successful. The sheer number of people brought out of poverty in the last few decades is mind-boggling. In 1981, 85%[1] of China's population (that's 850 million people[3]) lived on I'm confident that we'll eventually see reform in China. It'll take a few decades. People are still…

In one of my visions, the Internet freedom would deteriorate after some 'Spring', as the security deteriorated in Egypt in the past years. And the next one taking the power would only control the firewall more tightly.

Re: Chinese Hackers Infiltrate New York Times Computers

#157

All this focus on the sophistication of the Chinese hackers irritates me slightly. Reading between the lines, it seems the NYT would likely have weathered this "sophisticated" attack a lot better if they had observed a few simple security best practices: - Salt your password hashes (rendering rainbow tables inert) - Train your staff NOT to open attachments from unknown sources (especially if you've just written an in…

The point about hashes is irrelevant as the corporate passwords were stolen from Microsoft Windows domain controller. Users of Windows domains aren't free to swap in their own implementation of how password storage works.

Re: Chinese Hackers Infiltrate New York Times Computers

#158

If you want to give credit to a report detailing how much money your political leaders have piled up for themselves, hacking the media outfit that published it is a great way to confirm the story.

If you want to give credit to a report detailing how much money your political leaders have piled up for themselves, hacking the media outfit that published it is a great way to confirm the story. Do you think it matters now for the Chinese gov? By doing this and more they will make it very expensive for NYT and impossible for smaller outfits to mess with them. Maybe they'll uncover some dirt and release it to embarr…

I don't think the New York Times would need much motivation to investigate corruption in China in the first place, but I strongly doubt being hacked by a foreign government would make them less motivated to do so.

Re: Chinese Hackers Infiltrate New York Times Computers

#159

All this focus on the sophistication of the Chinese hackers irritates me slightly. Reading between the lines, it seems the NYT would likely have weathered this "sophisticated" attack a lot better if they had observed a few simple security best practices: - Salt your password hashes (rendering rainbow tables inert) - Train your staff NOT to open attachments from unknown sources (especially if you've just written an in…

> Salt your password hashes

As brown9-2 mentions in his reply, it was a Windows Domain Controller

> Train your staff NOT to open attachments from unknown sources

Spear phishing attacks are more sophisticated than that. They aren't sending .EXE files. The two most common attachments are RTF[0] and PDF[1], or a link in the email body to a website that will attempt a drive-by download.

These emails are composed in a way to make them look innocent (for eg. 'Twitter Password Reset Request', 'New Amazon.com Order', or an email from a new source, etc.).

It is also likely that at this level of sophistication that there are 0day exploits involved.

Attackers can send hundreds of spear emails over weeks and months, they just need a single click from one user to get their foot in the door.

> quarantine any attachment (inbound or outbound) that isn't of a type defined in a very strict white list

As mentioned above, the attachment types are RTF, PDF and XLS - and much more common is a link in an HTML email.

> make use of the software firewall on the PC's

The command and control servers send commands to ordinary looking websites using HTTPS. If you read the analysis of Flame or Stuxnet you will see the lengths that the designers went to to obfuscate this traffic.

This analysis[2] describes what the C&C servers looked like for Flame. The admin panels make no mention of bots or worms, it looks like any other intranet site.

It is really difficult to defend against these types of attacks. An attacker only needs 2 or 3 decent exploit writers to come up with a unique attack vector and a custom trojan tailored for the target. Also, time is on their side and they only need a single hit while you need to find and shut down all of the attempts.

[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3333

[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4363

[2] http://www.securelist.com/en/blog/750/Full_Analysis_of_Flame...

Re: Chinese Hackers Infiltrate New York Times Computers

#160
post #73

Earlier quoted context omitted.

Very good points! >> it does not see a line between NGOs, the NYT/WSJ, and the US government. Aren't we all doing the same mistake when we refer to them? All we know is that the attacks came from China, so we safely assume it came from the Government? Why is it that each time something comes from China (a country with approximately 5 time more people than the US - source Wikipedia) we blame their government and treat…

I've been there. I spent 6 months last year. What you might not understand is that the Chinese government has its hands in every corporation, organization, competitor, etc. You might have false assumptions coming from the US system, where corporations and government are separate entities. They even sue one another at times. In China, large corporations are overseen by the government. The government funds them, decide…

>> What you might not understand is that the Chinese government has its hands in every corporation, organization, competitor, etc.

Yes, this is the point. Being a 30-year-old Chinese, I've already known under a dictatorship almost everything is controlled by gov. Want to give birth to a child? need a permit (or your kid won't have ID nor social security); want to start up your own NGO? need a extremely complex license which is designed to scare you away; want to publish a book? need a license and it will be censored or even be banned; want to form a street demonstration? almost impossible.

I think for a dictator, he needs a system to restrain the free flow of people and information (a good example, North Korea), to do this the gov uses its power/money/people to reach out as far as possible into every corner of social and personal lives. It wants to know everything and wants to control everything (whether it can do is another story).

I cannot say I have any evidences to prove a sophisticated operation like this can only be done by gov, but I believe only gov or gov sponsored organizations can do this.

Post reply on HN