Feeds

China: Online predator or hapless host?

Reg man asks if all the China-bashing is justified

Choosing a cloud hosting partner with confidence

Analysis The People’s Republic of China has been singled out in increasingly unequivocal language by the US and its allies as one of, if not the greatest, source of online attacks, be they perpetrated by criminals or the Chinese state itself. But amid all the anti-Beijing bluster, has China been given an unfairly bad rep?

At first sight there is obviously a growing amount of evidence pinning the source of state-sponsored espionage activity on the Middle Kingdom. Verizon’s Data Breach Investigations Report – sourcing its data from law enforcement and security agencies across the globe – claimed 96 per cent of state-affiliated attacks came from China. Then there was FireEye’s Advanced Cyber Attack Landscape report, which revealed that 89 per cent of APT callback activities are associated with APT tools either made in the country or associated with Chinese hacking groups. Consultancy Mandiant went further in a high profile February report, alleging a concrete link between notorious hacking group Comment Crew (aka APT1) and the People’s Liberation Army. Most recently, a Pentagon report issued last week claimed: “numerous computer systems around the world, including those owned by the US government, continued to be targeted for intrusions, some of which appear to be attributable directly to the Chinese government and military.”

Broadening the net beyond state-sponsored attacks, the information security industry seems pretty much in agreement that China is a major attack “source”. Symantec’s latest global Internet Security Threat Report for 2013 claimed the country was the number one source of network attacks, accounting for 29.2 per cent of the global number, and second behind the US when it came to “malicious activity” in 2012. Spam blacklist service Composite Blocking List (CBL), meanwhile, placed Chinese IP addresses the world’s worst offenders, accounting for 22.5 per cent of the global list.

The latest stats from China’s Computer Emergency Reponse Team (CNCERT) reported 1.4m infected computers in the country – 0.4m controlled by Trojans or Botnets and 1 million by Conficker. Panda Security earlier this year branded China the most malware-ridden nation, claiming 55 per cent of its computers were infected.

All of which paints China as a very, very, naughty nation indeed.

The nature of the internet, however, means a large number of IP addresses fingered as attack sources or compromised computers is no indication that attacks are actually being launched by actors from within that country. It is more accurately an indication that within that country exist a large number of vulnerable machines and perhaps inadequate law enforcement or industry regulation. In fact, China always claims it is a victim, not a perpetrator, of cyber attacks – many of which it says come from the US.

Attribute this!

The biggest difficulty security researchers face is explaining the true origin of an attack, says Fortinet’s global security strategist, Derek Manky. Attacks can be routed through several compromised machines used as proxies all over the world – finding a command and control (C&C) server is definitely not an indication of attack source, he told The Reg.

“In some cases it’s easy enough to trace back one hop but this is never enough because in some cases there are four or five hops and often they encrypt the traffic with VPNs,” Manky explained. “It means that you have to go to every related ISP in each different country, all of which may be subject to different legislation and law enforcement regimes.”

Manky argued that criminals focus their efforts on China because of the large numbers of potentially vulnerable PCs there and regulatory loopholes which allow unscrupulous domain registrars to continue operating. Both of these factors, to an extent, are also true of the United States.

“There are a lot of IP addresses in China and there are a lot of infected systems. Many are XP machines not even running Service Pack 2 so they’re easy pickings,” Manky said. “They’re infected and then brought under the control of operators outside of China – in the US, Latin America, Eastern Europe etc – and used as real estate which can be leased out by the operator.”

Beginner's guide to SSL certificates

Next page: Home-grown problems

More from The Register

next story
NASTY SSL 3.0 vuln to be revealed soon – sources (Update: It's POODLE)
So nasty no one's even whispering until patch is out
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
US government fines Intel's Wind River over crypto exports
New emphasis on encryption as a weapon?
To Russia With Love: Snowden's pole-dancer girlfriend is living with him in Moscow
While the NSA is tapping your PC, he's tapping ... nevermind
Forget passwords, let's use SELFIES, says Obama's cyber tsar
Michael Daniel wants to kill passwords dead
Slap for SnapChat web app in SNAP mishap: '200,000' snaps sapped
This is what happens if you hand your username and password to a 3rd-party
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.