Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chinese hack U.S. Weather systems, satellite network

washingtonpost.com

Post reply on HN
Print view View original

21–30 of 71 posts

Re: Chinese hack U.S. Weather systems, satellite network

#21

Post by 13 »

SCHiM wrote: post #19
Someone1234 wrote: post #13

I always appreciate how the US are able to pin every network compromise directly back to China. And not just China but the Chinese government in particular. Almost like VPNs, proxies, TOR, compromised machines, botnets, or similar do not exist in this arena and that a reverse DNS lookup will tell them 1337.mss.gov.cn. When the US talk about cybersecurity/"cyber wars" in general they're talking about something more ak…

Perhaps they too readily blame the Chinese _government_, however I'm not sure that the chinas place in the spotlight is _totally_ unwarranted: tail -n 50 /var/log/auth.log Nov 12 15:33:28 VPS-3167 sshd[11950]: Connection closed by 122.225.97.110 [preauth] [SNIP] Nov 12 20:12:51 VPS-3167 sshd[12016]: Connection closed by 61.174.50.164 [preauth] [SNIP] Nov 12 20:40:44 VPS-3167 sshd[12031]: Connection closed by 122.225.…

That doesn't mean that it's actually Chinese users doing anything though. China has a lot of software piracy in their culture, where piracy is, malware and botnets are rife.

Re: Chinese hack U.S. Weather systems, satellite network

#22

Post by SCHiM »

13 wrote: post #21
SCHiM wrote: post #19

Earlier quoted context omitted.

Perhaps they too readily blame the Chinese _government_, however I'm not sure that the chinas place in the spotlight is _totally_ unwarranted: tail -n 50 /var/log/auth.log Nov 12 15:33:28 VPS-3167 sshd[11950]: Connection closed by 122.225.97.110 [preauth] [SNIP] Nov 12 20:12:51 VPS-3167 sshd[12016]: Connection closed by 61.174.50.164 [preauth] [SNIP] Nov 12 20:40:44 VPS-3167 sshd[12031]: Connection closed by 122.225.…

That doesn't mean that it's actually Chinese users doing anything though. China has a lot of software piracy in their culture, where piracy is, malware and botnets are rife.

I find that debatable, they are still guilty to some extent because of their inaction to do anything (effective) against these botnets. whether 'action' would refer to users installing a decent anti-virus, or an ips blocking and isolating obviously infected hosts.

Of course, this is a whole different level of culpability than if they were actually condoning large scale attacks on other countries infrastructure.

The fact remains that if I were to plot the amount of ip's that come knocking at my non-production server you'd see over 50% coming from china.

Re: Chinese hack U.S. Weather systems, satellite network

#23

Post by freehunter »

diminoten wrote: post #8
coldcode wrote: post #5

Yet another org too embarrassed to tell people they've been hacked, or more likely that they failed to do security at all.

Public companies risk being sued by their shareholders if they publicly disclose a breach, and as a consequence, the stock falls. If only there were laws in place that protected companies from things like this...

Public companies risk running afoul of US data breach laws if they don't disclose a breach and customer data was potentially stolen. So it's a matter or piss off your stockholders or break the law. The only winning move is to have proper security before you get hacked.

Re: Chinese hack U.S. Weather systems, satellite network

#24

Post by mpyne »

chiph wrote: post #7
cryptoz wrote: post #3

The article does not discuss much the motivation they might have had for this hack, aside from the fact they're probably looking for gaps in general US systems. But I'm very curious about the economics of hacking another nation's weather service; China could give itself significant (and creepy) economic advantages my MITMing the data from the satellites. I wonder if they're considering things like this? Edit: Also, i…

From a military standpoint, weather is super important. The D-Day landings at Normandy were delayed several times because of bad weather. http://www.history.com/news/the-weather-forecast-that-saved-...

It gets even more incredible. The landings would have been canceled for the day they actually happened, except that the meteorology officer in Eisenhower's staff predicted that there would be a short break in the bad weather sufficient for the landings to occur.

Eisenhower rolled the dice and the weather did indeed hold up long enough for the invasion to occur. His opponent, Gen. Rommel, felt the weather was going to be so bad there was no way the invasion could commence so he was actually away from Normandy on D-Day to see his family.

Re: Chinese hack U.S. Weather systems, satellite network

#25

Post by amckenna »

Someone1234 wrote: post #13

I always appreciate how the US are able to pin every network compromise directly back to China. And not just China but the Chinese government in particular. Almost like VPNs, proxies, TOR, compromised machines, botnets, or similar do not exist in this arena and that a reverse DNS lookup will tell them 1337.mss.gov.cn. When the US talk about cybersecurity/"cyber wars" in general they're talking about something more ak…

There are many details left out that could reasonably pin the attacks on the Chinese. While communication back to the source may be obfuscated and hard to pin on any particular actors the exploits, shellcode, and malware they use can possibly be tied to other breaches. Like regular programmers, hackers tend to reuse modules, code blocks, techniques, etc. from attack to attack. So whereas the NOAA breach may not conclusively point to China something found during the incident response and forensics phases may connect it to the USPS breach, Lockheed Martin breach, or others. A good example of this technique would be how researchers were able to tie Stuxnet, Flame, DuQu, and Guass to the same actors (probably the US and Israel).

Re: Chinese hack U.S. Weather systems, satellite network

#26

Post by diminoten »

freehunter wrote: post #23
diminoten wrote: post #8

Earlier quoted context omitted.

Public companies risk being sued by their shareholders if they publicly disclose a breach, and as a consequence, the stock falls. If only there were laws in place that protected companies from things like this...

Public companies risk running afoul of US data breach laws if they don't disclose a breach and customer data was potentially stolen. So it's a matter or piss off your stockholders or break the law. The only winning move is to have proper security before you get hacked.

> Public companies risk running afoul of US data breach laws if they don't disclose a breach and customer data was potentially stolen.

There are no US data breach laws, only state data breach laws, and they vary significantly from state to state, also in what constitutes "data", "breach", and "disclosure".

So it's not just a matter of breaking the law or not. There are lots of situations where specific companies can not disclose publicly that they've been breached and not run afoul of the law.

A good read - http://www.ncsl.org/research/telecommunications-and-informat...

Re: Chinese hack U.S. Weather systems, satellite network

#27

Post by rasz_pl »

rrggrr wrote: post #14
Someone1234 wrote: post #13

I always appreciate how the US are able to pin every network compromise directly back to China. And not just China but the Chinese government in particular. Almost like VPNs, proxies, TOR, compromised machines, botnets, or similar do not exist in this arena and that a reverse DNS lookup will tell them 1337.mss.gov.cn. When the US talk about cybersecurity/"cyber wars" in general they're talking about something more ak…

Having hacked Google, Juniper, Symantic, Morgan Stanley and countless USGOV sites - why not hack NOAA? Its not as if there will be any USGOV response. No sanctions. No demarche of which I'm aware. No counter-attack that has been publicized by China. Turning the other check is not a valid strategy in a prolonged conflict.

Exchange China with NSA and read your post again.

Re: Chinese hack U.S. Weather systems, satellite network

#29

Post by bengali3 »

ChuckMcM wrote: post #10
minimax wrote: post #6

The United States maintains two civil and one military program to provide meteorological imagery and data from spacecraft in polar and geostationary orbits around the Earth. The civil programs are managed by the National Oceanic and Atmospheric Administration (NOAA) and the military program is managed by the Department of Defense. The National Environmental Satellite, Data, and Information Service (NESDIS) is a unit…

Of course if you were an evil genius bent on destroying the US by sending a massive hurricane into the eastern seaboard, your first step would be to disable the ability to see it coming ... :-)

Nature. What better secret ally to start a war with?

Re: Chinese hack U.S. Weather systems, satellite network

#30

Post by roylez »

As a Chinese I would prefer to believe our government is behind this. Do you know Beijing (or even the whole country) has a serious smog issue which was first uncovered by American embassy in Beijing? The incident makes the government lose their trust in public, and for quite some time people only want to trust forecast from NOAA in stead of Beijing. If Chinese government hacked NOAA, it would be out of their intention to contain domestic reactions. Actually, our government has greater problems at home than abroad.
Post reply on HN