Feeds

China: Online predator or hapless host?

Reg man asks if all the China-bashing is justified

5 things you didn’t know about cloud backup

Analysis The People’s Republic of China has been singled out in increasingly unequivocal language by the US and its allies as one of, if not the greatest, source of online attacks, be they perpetrated by criminals or the Chinese state itself. But amid all the anti-Beijing bluster, has China been given an unfairly bad rep?

At first sight there is obviously a growing amount of evidence pinning the source of state-sponsored espionage activity on the Middle Kingdom. Verizon’s Data Breach Investigations Report – sourcing its data from law enforcement and security agencies across the globe – claimed 96 per cent of state-affiliated attacks came from China. Then there was FireEye’s Advanced Cyber Attack Landscape report, which revealed that 89 per cent of APT callback activities are associated with APT tools either made in the country or associated with Chinese hacking groups. Consultancy Mandiant went further in a high profile February report, alleging a concrete link between notorious hacking group Comment Crew (aka APT1) and the People’s Liberation Army. Most recently, a Pentagon report issued last week claimed: “numerous computer systems around the world, including those owned by the US government, continued to be targeted for intrusions, some of which appear to be attributable directly to the Chinese government and military.”

Broadening the net beyond state-sponsored attacks, the information security industry seems pretty much in agreement that China is a major attack “source”. Symantec’s latest global Internet Security Threat Report for 2013 claimed the country was the number one source of network attacks, accounting for 29.2 per cent of the global number, and second behind the US when it came to “malicious activity” in 2012. Spam blacklist service Composite Blocking List (CBL), meanwhile, placed Chinese IP addresses the world’s worst offenders, accounting for 22.5 per cent of the global list.

The latest stats from China’s Computer Emergency Reponse Team (CNCERT) reported 1.4m infected computers in the country – 0.4m controlled by Trojans or Botnets and 1 million by Conficker. Panda Security earlier this year branded China the most malware-ridden nation, claiming 55 per cent of its computers were infected.

All of which paints China as a very, very, naughty nation indeed.

The nature of the internet, however, means a large number of IP addresses fingered as attack sources or compromised computers is no indication that attacks are actually being launched by actors from within that country. It is more accurately an indication that within that country exist a large number of vulnerable machines and perhaps inadequate law enforcement or industry regulation. In fact, China always claims it is a victim, not a perpetrator, of cyber attacks – many of which it says come from the US.

Attribute this!

The biggest difficulty security researchers face is explaining the true origin of an attack, says Fortinet’s global security strategist, Derek Manky. Attacks can be routed through several compromised machines used as proxies all over the world – finding a command and control (C&C) server is definitely not an indication of attack source, he told The Reg.

“In some cases it’s easy enough to trace back one hop but this is never enough because in some cases there are four or five hops and often they encrypt the traffic with VPNs,” Manky explained. “It means that you have to go to every related ISP in each different country, all of which may be subject to different legislation and law enforcement regimes.”

Manky argued that criminals focus their efforts on China because of the large numbers of potentially vulnerable PCs there and regulatory loopholes which allow unscrupulous domain registrars to continue operating. Both of these factors, to an extent, are also true of the United States.

“There are a lot of IP addresses in China and there are a lot of infected systems. Many are XP machines not even running Service Pack 2 so they’re easy pickings,” Manky said. “They’re infected and then brought under the control of operators outside of China – in the US, Latin America, Eastern Europe etc – and used as real estate which can be leased out by the operator.”

Next gen security for virtualised datacentres

Next page: Home-grown problems

More from The Register

next story
Microsoft: We plan to CLEAN UP this here Windows Store town
Paid-for apps that provide free downloads? Really
Snowden on NSA's MonsterMind TERROR: It may trigger cyberwar
Plus: Syria's internet going down? That was a US cock-up
Who needs hackers? 'Password1' opens a third of all biz doors
GPU-powered pen test yields more bad news about defences and passwords
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Hear ye, young cyber warriors of the realm: GCHQ wants you
Get involved, get a job and then never discuss work ever again
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
Microsoft cries UNINSTALL in the wake of Blue Screens of Death™
Cache crash causes contained choloric calamity
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.