China Shows Their Cyber Warfare Cards, Oops

--
The hilarity.

Red China has been hacking into USA computers, as part of what has been a declared cyber war, since 1998, the year they were provided 'Most Favored Nation' status. In 2007 the US feds finally couldn't hide this fact any longer after they found their Windows computers exposed to the Internet had been invaded with bots that were feeding every available bit of data back to Red China.

So I am laughing away at this bizarro news report via Neowin.net:

China accidently leaks Cyber Warfare software, US IP addresses being exploited

Well DUH! (0_o)

The source article at ThePochTimes.com is here:

Slip-Up in Chinese Military TV Show Reveals More Than Intended

Piece shows cyber warfare against US entities

There is no big revelation here except for people with their heads buried in the sand. Also, I'm not so sure China made a booboo here. I think they just don't care. China knows perfectly well that thoughful people of the USA know that China has been hacking us since 1998. China knows that we uncovered their internal memo, circa 2007, formally declaring cyber war against the USA. We know the Chinese government financially backed the Red Hacker Alliance. Officially China says 'no', but who cares? They lie. We know they lie. They know we know they lie... (>_<)

'Here world, check out our cyber war hackware. Enjoy yourselves. HaHaHa.'

The ACTUAL issue here is what the H E L L are the US feds are going to do about it?!

AND:
What are YOU going to do about it?
Buy more cheap crap from China?
Feed the Chinese military machine?
Help herald in the next Chinese empire?

I'm not, if I can help it.

And good luck to me with that endeavor! The USA is firmly latched onto the teet of cheap labor from China. The US Vice President was just over there making all nice to the commy dictators in order to persuade them to keep propping up the US debt despite recent Tea Party boobery.

What is an informed public to do when our US Corporate Oligarchy prevent the rule of the sane?
--

McAfee Figures Out That Red China Has Been Hacking The USA For Five Years

Red China has been hacking the USA government since 1998, the year China was given 'Most Favored Nation' status. 1998 was the year the roots of China's government hacking gathered together and formed 'The Red Hacker Alliance'. It used to be that the Red Chinese government denied paying The Red Hacker Alliance for its services. These days TRHA has simply been integrated directly into the Chinese government. They no longer operate as in independent entity.


The USA government was forced to admit China's activity in 2007 after the public was informed that government Windows OS computers connected to the Internet had been infected with bot malware that was feeding ALL available USA government documents directly to China. An internal Chinese memo was also uncovered around that time which declared a cyber war against the USA.


And now we get to read that McAfee figured out, here in 2011, that Red China has been hacking the USA for the last five years. Incredible DUH Factor:

China Implicated in Massive Five-Year Long Cyberattack

Travel back to some of my earliest posts in this blog for more about the history of Red China's declared Cyber War against the USA. Here's a relevant article from 2006, five years ago:

'Red Hackers Alliance' seen behind attacks on U.S. sites

Here's a link to a post I made over at Soft32.com's Mac forum on May 31, 2007:

China Escalates Cyber War Against The World

As I quoted from the SANS Institute's NewsBites newsletter, Volume 9, Number 43:

--DoD Report: China Bolstering Cyber Warfare Capabilities  (May 28 & 29, 2007) 
China "has established information warfare units to develop viruses to  attack enemy computer systems and networks, and tactics and measures to  protect friendly computer systems and networks," according to a recent  report from the US Defense Department (DoD). In previous years, the  Pentagon's annual report to Congress on China's military power has  indicated that China was focusing on defensive measures, so the shift  to offensive tactics merits attention. 

So where have you been for five years McAfee? And why does the tech press think McAfee's late revelation is news?

Here are a further few China cyber war articles from way back when:

May 30, 2007

Cyber Warfare: Beyond Estonia-Russia, Rise of China's 5th Dimension Cyber Army for the 21st Century

September 14, 2007

China emerges as leader in cyberwarfare

October 9, 2009

Capability of the People’s Republic of China to Conduct Cyber Warfare and Computer Network Exploitation

CONCLUSION: Think about Red China screwing over the USA as well as the rest of the world the next time you buy cheap stuff 'Made In China'. Wonder why the USA still provides Red China with 'Most Favored Nation' status considering the fact that China has declared war against us. Think about the motives of the traitorous Corporate Oligarchy that really rules the USA government.

--

China Laughs At US Federal Security

Way back in 2007, when I started this blog, I had a run in with the members of China's 'Red Hacker Alliance'. I reposted their history and reiterated hacker crimes they'd been pulling against the USA since 1998, the year China was given 'Most Favored Nation' status. 2007 was the year the US feds finally admitted the reality of the situation, after the Chinese government memo declaring 'Technology War' on the USA became public knowledge, after the US feds discovered that every one of their computers connected to the Internet had been botted by Chinese malware, sending to China ever piece of accessible data.

•••

Now here we are 4 (FOUR) years later and THIS happens:

The Navy Bought Fake Chinese Microchips That Could Have Disarmed U.S. Missiles

If left undiscovered the result could have rendered useless U.S. missiles and killed the signal from aircraft that tells everyone whether it's friend or foe.

Who can blame China for laughing?

•••

How about the Obama administration offers me the CIO cabinet position? I couldn't possibly do any worse.
--

BBC: "US cyber war defences 'very thin', Pentagon Warns"

--

A quick post to note an article that finally points out the big DUH: That the US government has terrible cyber-security. It is well known, certainly if you've been following my posts, that the US government has been repeatedly PWNed by Red China since 1998. The US feds only admit, however, to being PWNed since 2007 when they discovered all their computers attached to the Internet had been infected with bots that were feeding every piece of their data over to Red China. It was also uncovered around that time that Red China had been circulating an internal memo declaring 'cyber war' on the USA. This is our #1 trading partner benefiting from 'Most Favored Nation' status. The mind boggles.

It's a good and short read, important if only because the Pentagon has finally come clean about their incredible LACK of readiness in the ongoing cyber-security warz.

US cyber war defences 'very thin', Pentagon Warns

And yes, despite FUD to the contrary, the US feds would be remarkably better off if only they would dump Windows and, chant along with me:

GET A MAC

Red China says: "Thank you USA for using Windows!" (0_o)

Mac OS X is far from perfect. But Windows is far from adequate. Mac OS X remains the single safest GUI operating system on the planet. Only OpenBSD and FreeBSD have better security reputations. Sorry Linux.
--

Oh good! China is cracking down on... blogs like mine

--
It astounds me how conveniently and deliberately citizens in my country, the USA, ignore the fact that 'China' is actually Red China, the biggest and most oppressive communist state in the world. I've had friends attempt to 'inform' me that China is functioning as a 'capitalist' state; That they depend on 'capitalism' for their income of foreign currency. What a nice fantasy. The fact remains that Red China will never be actually, factually capitalist while ruled by a totalitarian / communist regime. So next time you go buying your Walmart junk from China, think about the wonderful oppression of fellow human beings you're supporting.

Because I say stuff like the above, I am now one of many targets by the Red Chinese government for CENSORSHIP. Blogs like mine, or any other 'subversive' sources of information and opinion on the Internet, are going to be BLOCKED by the Red Chinese government.

When I read this news today, I first thought to myself "Oh good! Maybe I will no longer be spammed by kiddies in Red China every single time I post an article here at Mac-Security!" But I am willing to bet that somewhere in Red China some member of the Red Hacker Alliance will keep an eye on subversives such as myself and make sure we are tortured for our heresy from afar. Like I'll relent, confess my sins against Mao and kiss The Little Red Book, if only their terrifying spam will stop! (o_0)

You can read about this latest round of Red Chinese bullshite in an article from the Associated Press:

China Targets 'Foreign Forces' In Web Crackdown

The SANS Institute sez: NSA Helping to Harden Operating Systems

--
I'm kind of surprised to read this blurb from the latest edition of the SANS NewsBites newsletter (Vol. 11 Num 92):

--NSA Helping to Harden Operating Systems

(November 7, 18 & 19, 2009)

In testimony before the Senate Subcommittee on Terrorism and Homeland Security, National Security Agency (NSA) information assurance director Richard Schaeffer said that his agency helped Microsoft harden Windows 7 and that it is also helping Apple, Sun Microsystems, and Red Hat with similar endeavors. The NSA's involvement in the development process has led to speculation that backdoors will be built into the software to allow communications monitoring and interception. The NSA refutes those claims and says it is helping develop security guidelines and checklists. Schaeffer also said that agencies can protect their systems against 80 percent of known cyber attacks by following three steps: implementing best security practices, configuring networks properly, and monitoring networks effectively.

http://www.theregister.co.uk/2009/11/19/nsa_enhanced_windows7_security/

http://www.computerworld.com/s/article/9141105/NSA_helped_with_Windows_7_development

http://www.h-online.com/security/news/item/NSA-helps-Apple-Sun-and-Red-Hat-harden-their-systems-863889.html

http://fcw.com/Articles/2009/11/17/NSA-3-steps--better-cybersecurity.aspx

[Editor's Note (Pescatore): Ah, conspiracy theories. NSA and other government agencies have been involved in developing "gold" configuration definitions for standard software and network hardware products for a long time, along with the IT industry. Hardening in this case means better configuration and minimization of unneeded services.]

You can subscribe to the SANS newsletters HERE.

My concern about this news:

If the NSA is so good at hardening operating system security, and good at protecting their systems from 80% of known cyber attacks, how come the US federal government computer system has been PWNed by China and other countries every year since 1998, including 2009?

Read THIS list from the Center for Strategic & International Studies and have a heart attack. Included on the list are:

February 2009 - US Federal Aviation Administration hacked.

March 2009 - US federal computer containing plans for the new presidential helicopter hacked.

April 2009 - The revelation that the US power grid had been hacked.

May 2009 - US Homeland Security Information Network hacked.

So where was the NSA during all this? And the NSA has what skills to offer Microsoft, Apple, Sun and Red Hat? Just asking.

More likely the NSA is supplying their experiences in security FAILure, such as sharing what hacking methods were successful against federal computers during their watch. Just saying.

You know I'm itching to point out that switching to a proven secure operating system is always helpful. For example, why are the feds still using Windows?! It boggles my mind. Windows is dead last on the list of secure operating systems. The top 3 are still:

- OpenBSD
- FreeBSD
- Mac OS X (which incorporates BSD Unix)

But I'm just some laymen guy with a few science degrees and some decades of computer experience who rants about the ridiculous state of computer security in my country.
(o_0)
--

Proof Of Concept Trojan.OSX.Tored.A & Related Rants

--
Last month an eMail distributed proof of concept (aka nonfunctional) malware program was discovered for Mac OS X. A couple different companies claim they 'discovered' it. It is being labeled as a 'worm' because it is able to replicate itself after infection. It does not qualify as a virus because it does not damage the host computer. However, it is actually a Trojan horse because it requires user error in order to be installed. Its worm behavior is therefore secondary and cannot be used in its name. Sorry. (;_;)

Rant: I'm a biologist who became addicted to Mac technology and works as a professional Mac technologist. So how come I, without a computer science degree, am able to distinguish a Trojan horse from a worm while professional computer security companies can't? I am thoroughly baffled. Was there perhaps one person who made the initial error and everyone followed along like good little sheep? Likely. It became evident eight years ago in the USA that sheep are the 'in' thing to be. Shameful. End of rant.

The best reports I found on Tored.A are over at Intego, F-Secure and CA. The lamest report is at Sophos, not worth linking.

An interesting short article about Tored.A was posted over at the HowStuffWorks blog. I wrote a reply to the article and tossed in some of my usual educational chatter. Here is a repost for your pleasure:

Here are some useful facts:

1) Symantec started the Anti-Mac security FUD campaign back in August 2005. In the intervening three and a half years Mac OS X has failed to be deluged in malware. There was no doom and gloom. The sky did not fall. Symantec continues to make the single worst anti-malware app for Mac. Figures.

2) There is a standard naming system for malware. This is how it works: First comes the type of malware. Tored-A is a Trojan horse. It is NOT a 'worm' until AFTER it has been installed by a computer user, which is of secondary importance. Therefore, the first part of its standard name is 'Trojan'. Second comes the name of the operating system on which it runs. In this case it is 'OSX'. Third comes that identifying 'name' of the malware. The discoverer in this case chose 'Tored'. Why is up to them. Last comes the 'strain' or version of the malware. The first discovered version is called A. Next is B, etc. Take note that despite this long published standard, anti-malware companies usually don't care. That's why there are often many names for exactly the same malware, resulting in needless chaos and confusion.

3) There never was any such thing as 'security by obscurity' for Mac OS X. The fact is that Mac OS X is incredibly harder to hack than Windows. That is why there are only Trojan Horses for Mac OS X. They require user error in order to break into a Mac. There are no viruses, worms or illegal spyware/adware for Mac OS X for that reason.

Responding to the article:
"Many accounts say that the MacOS is naturally more secure than Windows."

Accounts have nothing to do with it. Mac OS X = UNIX = consistently proven to be the safest operating system commercially available. Its rivals are the Open Source operating systems FreeBSD and OpenBSD, both of which are integrated into Apple's CLI version of UNIX called 'Darwin OS', the basis of Mac OS X. That being said, UNIX / Mac OS X is NOT perfect. Security flaws are frequently being patched. Never at any time was there any myth that Mac OS X was not 'mortal'. If you want hacker heroes, applaud Dr. Charlie Miller and Dino Dai Zovi, the most revered of those who have proven how to break into a Mac (with user error required). They wrote a book about it called "The Mac Hacker's Handbook" published March 2009.

The least secure Apple software is NOT Mac OS X. It is in fact QuickTime, which Apple write and provide for both Windows and Mac OS X.

Windows was never designed to be secure until Vista. And even then Microsoft significantly failed. Theoretically Windows 7, which is mainly a paid service pack for Vista, may repair this problem, but it has not been proven at this time.

The future: Watch for the Mac malware coming out of Red China. Few people know that China formally declared a "Technology War" against the USA several years ago. China has been successfully cracking into US federal computers since 1998 when they formed The Red Hacker Alliance. Note that this was the year China was provided "Most Favored Nation Status" by the US government. Despite being caught red-handed cracking government computers all over the planet, the USA still maintains this favored status. Conclusion: We are out of our minds. Enjoy the results.

--