China: Online predator or hapless host?
Reg man asks if all the China-bashing is justified
Analysis The People’s Republic of China has been singled out in increasingly unequivocal language by the US and its allies as one of, if not the greatest, source of online attacks, be they perpetrated by criminals or the Chinese state itself. But amid all the anti-Beijing bluster, has China been given an unfairly bad rep?
At first sight there is obviously a growing amount of evidence pinning the source of state-sponsored espionage activity on the Middle Kingdom. Verizon’s Data Breach Investigations Report – sourcing its data from law enforcement and security agencies across the globe – claimed 96 per cent of state-affiliated attacks came from China. Then there was FireEye’s Advanced Cyber Attack Landscape report, which revealed that 89 per cent of APT callback activities are associated with APT tools either made in the country or associated with Chinese hacking groups. Consultancy Mandiant went further in a high profile February report, alleging a concrete link between notorious hacking group Comment Crew (aka APT1) and the People’s Liberation Army. Most recently, a Pentagon report issued last week claimed: “numerous computer systems around the world, including those owned by the US government, continued to be targeted for intrusions, some of which appear to be attributable directly to the Chinese government and military.”
Broadening the net beyond state-sponsored attacks, the information security industry seems pretty much in agreement that China is a major attack “source”. Symantec’s latest global Internet Security Threat Report for 2013 claimed the country was the number one source of network attacks, accounting for 29.2 per cent of the global number, and second behind the US when it came to “malicious activity” in 2012. Spam blacklist service Composite Blocking List (CBL), meanwhile, placed Chinese IP addresses the world’s worst offenders, accounting for 22.5 per cent of the global list.
The latest stats from China’s Computer Emergency Reponse Team (CNCERT) reported 1.4m infected computers in the country – 0.4m controlled by Trojans or Botnets and 1 million by Conficker. Panda Security earlier this year branded China the most malware-ridden nation, claiming 55 per cent of its computers were infected.
All of which paints China as a very, very, naughty nation indeed.
The nature of the internet, however, means a large number of IP addresses fingered as attack sources or compromised computers is no indication that attacks are actually being launched by actors from within that country. It is more accurately an indication that within that country exist a large number of vulnerable machines and perhaps inadequate law enforcement or industry regulation. In fact, China always claims it is a victim, not a perpetrator, of cyber attacks – many of which it says come from the US.
The biggest difficulty security researchers face is explaining the true origin of an attack, says Fortinet’s global security strategist, Derek Manky. Attacks can be routed through several compromised machines used as proxies all over the world – finding a command and control (C&C) server is definitely not an indication of attack source, he told The Reg.
“In some cases it’s easy enough to trace back one hop but this is never enough because in some cases there are four or five hops and often they encrypt the traffic with VPNs,” Manky explained. “It means that you have to go to every related ISP in each different country, all of which may be subject to different legislation and law enforcement regimes.”
Manky argued that criminals focus their efforts on China because of the large numbers of potentially vulnerable PCs there and regulatory loopholes which allow unscrupulous domain registrars to continue operating. Both of these factors, to an extent, are also true of the United States.
“There are a lot of IP addresses in China and there are a lot of infected systems. Many are XP machines not even running Service Pack 2 so they’re easy pickings,” Manky said. “They’re infected and then brought under the control of operators outside of China – in the US, Latin America, Eastern Europe etc – and used as real estate which can be leased out by the operator.”
In order to flourish, this kind of “Crime-as-a-Service” also requires so-called bulletproof hosting firms where hackers can run C&C servers and register malicious domains safe from the prying eyes of law enforcement. “These places provide a safe haven. Two or three different actors in China come to mind, accepting domain registrations which ultimately lead to attack campaigns – it’s a black hole,” said Manky.
“Interestingly China has done something. It had a problem with fraudulent registrations so the government acted to [tighten registration], but … there are still loopholes in the system – not just China but everywhere.”
The latest CNCERT stats reveal 140 malicious domains, just over a third located in mainland China, which could have been hosted in this way by attackers outside of the country.
FireEye EMEA product manager Jason Steer told El Reg that China was number three in the firm’s recent report for hosting C&C systems, below the US and South Korea, but agreed with Manky that this in no way signifies that actors inside the country are attacking global targets in huge numbers.
“Actually, I'd argue something different: attacks coming from within your country indicate that C&C servers are set up in-country to dupe defenders. Attackers are less easy to spot and find with traffic staying in country first and then being moved on,” he said.
“Given the size of China and the size of its PC population, it's an obvious place to attack from – with high speed internet and the same insecure computers running Windows there as they do across the world. As it rolls out high speed internet, clearly it’s a good place to locate systems without questions being asked.”
For the record, China's internet population at the end of 2012 stood at 564 million, around 50m more than a year previously. That's still only 42 per cent penetration but still a lot of users to target, meaning China is likely to remain an attractive location for global crime gangs to launch attacks from for some time to come. The vulnerabilities in the nation's address space are also being exploited by home-grown attackers, of course, as a report on China’s Online Underground Economy released last August shows. It claimed that nearly a quarter of the country’s internet users and 1.1m web sites were affected in 2011, at a cost of over 5bn yuan (£526m).
Trend Micro VP of cyber security Tom Kellermann told The Reg that there are over 90,000 members of the Chinese shadow economy.
“Over the past two years there has been an explosive growth in criminal hacking within China targeting Chinese corporations,” he added. “The great firewall of China has numerous vulnerabilities and as the nation becomes global economic hegemon the king of the mountain is beginning to experience the dark side of globalisation.”
China’s challenge is to promote greater levels of information security awareness among its vast populace, especially as more and more users come online for the first time, and tighten up the loopholes which have allowed bulletproof hosters to flourish. Such steps will make it less attractive for criminals – reducing the number of attacks launched by operators outside the country using compromised Chinese IP addresses, as well as cutting its domestic cyber crime problems.
It’s difficult to feel much sympathy with Beijing given the apparent volume and persistence of state-sanctioned attacks originating from within the Great Firewall. But it’s also worth remembering that activity of this kind is certainly being carried out to a lesser or greater extent by all major global powers.
In a notable report from last September, Trend Micro’s Kellermann even concluded that “hackers from the former Soviet bloc are a more sophisticated and clandestine threat than their more well-known East Asian counterparts”. China’s problem is that it’s currently the noisiest out there. Perhaps if it wants the damaging headlines to go away it needs to get its own house in order and get caught less frequently. ®