Feeds

China: Online predator or hapless host?

Reg man asks if all the China-bashing is justified

Reducing security risks from open source software

Analysis The People’s Republic of China has been singled out in increasingly unequivocal language by the US and its allies as one of, if not the greatest, source of online attacks, be they perpetrated by criminals or the Chinese state itself. But amid all the anti-Beijing bluster, has China been given an unfairly bad rep?

At first sight there is obviously a growing amount of evidence pinning the source of state-sponsored espionage activity on the Middle Kingdom. Verizon’s Data Breach Investigations Report – sourcing its data from law enforcement and security agencies across the globe – claimed 96 per cent of state-affiliated attacks came from China. Then there was FireEye’s Advanced Cyber Attack Landscape report, which revealed that 89 per cent of APT callback activities are associated with APT tools either made in the country or associated with Chinese hacking groups. Consultancy Mandiant went further in a high profile February report, alleging a concrete link between notorious hacking group Comment Crew (aka APT1) and the People’s Liberation Army. Most recently, a Pentagon report issued last week claimed: “numerous computer systems around the world, including those owned by the US government, continued to be targeted for intrusions, some of which appear to be attributable directly to the Chinese government and military.”

Broadening the net beyond state-sponsored attacks, the information security industry seems pretty much in agreement that China is a major attack “source”. Symantec’s latest global Internet Security Threat Report for 2013 claimed the country was the number one source of network attacks, accounting for 29.2 per cent of the global number, and second behind the US when it came to “malicious activity” in 2012. Spam blacklist service Composite Blocking List (CBL), meanwhile, placed Chinese IP addresses the world’s worst offenders, accounting for 22.5 per cent of the global list.

The latest stats from China’s Computer Emergency Reponse Team (CNCERT) reported 1.4m infected computers in the country – 0.4m controlled by Trojans or Botnets and 1 million by Conficker. Panda Security earlier this year branded China the most malware-ridden nation, claiming 55 per cent of its computers were infected.

All of which paints China as a very, very, naughty nation indeed.

The nature of the internet, however, means a large number of IP addresses fingered as attack sources or compromised computers is no indication that attacks are actually being launched by actors from within that country. It is more accurately an indication that within that country exist a large number of vulnerable machines and perhaps inadequate law enforcement or industry regulation. In fact, China always claims it is a victim, not a perpetrator, of cyber attacks – many of which it says come from the US.

Attribute this!

The biggest difficulty security researchers face is explaining the true origin of an attack, says Fortinet’s global security strategist, Derek Manky. Attacks can be routed through several compromised machines used as proxies all over the world – finding a command and control (C&C) server is definitely not an indication of attack source, he told The Reg.

“In some cases it’s easy enough to trace back one hop but this is never enough because in some cases there are four or five hops and often they encrypt the traffic with VPNs,” Manky explained. “It means that you have to go to every related ISP in each different country, all of which may be subject to different legislation and law enforcement regimes.”

Manky argued that criminals focus their efforts on China because of the large numbers of potentially vulnerable PCs there and regulatory loopholes which allow unscrupulous domain registrars to continue operating. Both of these factors, to an extent, are also true of the United States.

“There are a lot of IP addresses in China and there are a lot of infected systems. Many are XP machines not even running Service Pack 2 so they’re easy pickings,” Manky said. “They’re infected and then brought under the control of operators outside of China – in the US, Latin America, Eastern Europe etc – and used as real estate which can be leased out by the operator.”

Mobile application security vulnerability report

Next page: Home-grown problems

More from The Register

next story
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Microsoft: You NEED bad passwords and should re-use them a lot
Dirty QWERTY a perfect P@ssword1 for garbage websites
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
NUDE SNAPS AGENCY: NSA bods love 'showing off your saucy selfies'
Swapping other people's sexts is a fringe benefit, says Snowden
L33t haxxors compete to p0wn popular home routers
EFF-endorsed SOHOpelessly Broken challenge will air routers' dirty zero day laundry
Own a Cisco modem or wireless gateway? It might be owned by someone else, too
Remote code exec in HTTP server hands kit to bad guys
British data cops: We need greater powers and more money
You want data butt kicking, we need bigger boots - ICO
Crooks fling banking Trojan at Japanese smut site fans
Wait - they're doing online banking with an unpatched Windows PC?
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Mobile application security vulnerability report
The alarming realities regarding the sheer number of applications vulnerable to attack, and the most common and easily addressable vulnerability errors.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.