US Chamber of Commerce Infiltrated By Chinese Hackers 173
SpzToid writes "The Wall Street Journal is now reporting that a group of hackers in China breached the computer defenses of the United States Chamber of Commerce. The intrusion was quietly shut down in May 2010, while FBI investigations continue. 'A spokesman for the Chinese Embassy in Washington, Geng Shuang, said cyberattacks are prohibited by Chinese law and China itself is a victim of attacks. ... Still, the Chamber continues to see suspicious activity, they say. A thermostat at a town house the Chamber owns on Capitol Hill at one point was communicating with an Internet address in China, they say, and, in March, a printer used by Chamber executives spontaneously started printing pages with Chinese characters.'"
According the article, the group "gained access to everything stored on its systems" and may have "had access to the network for more than a year before the breach was uncovered."
errr (Score:2, Funny)
a printer used by Chamber executives spontaneously started printing pages with Chinese characters.'"
Did you try switching it off then back on again?
Re:errr (Score:5, Insightful)
Re: (Score:1)
Re: (Score:2)
My ribbon printer (Image writer 2) for my old old Apple Mac used to do that when you asked it to print draft. Never figured out why, but now you make me think of it, it seems like the right reason.
Re: (Score:3)
Re: (Score:1)
I have a printer driver that doesn't play nice with Firefox. The printer can't properly recognize the fonts used by Firefox so it prints out garbage characters. Now if I tell the printer to download the fonts rather than using embedded fonts it works just fine. Everyone would call the garbage characters Chinese.
Re: (Score:1)
Everyone who is an idiot, maybe.
Re: (Score:2)
Re: (Score:3)
Right. The average user.
Re: (Score:2)
Re: (Score:3)
Re: (Score:2, Funny)
Yeah, that part of the summary amused me. It's as if the following took place somewhere in China:
Good work, now print out that data you've discovered.
Yes sir... it should be on the printer now.
There's nothing here, what printer did you send it to?
Doh!!!!
Re:errr (Score:4, Funny)
The hackers wanted to damage the US physically by using precious toner and paper as well as wearing down the printer parts.
Re: (Score:2)
Investigators are not that naive.
Re: (Score:2)
That depends on which investigators you are referring to..
Re: (Score:2)
I've worked in the field. With the basic principles of investigation, oversight, and review, it is nigh impossible for the suggested conclusion to be drawn. There are far too many checks to the system.
Re: (Score:2)
Re: (Score:1)
Re: (Score:3, Funny)
I remember back around '04 or so, there was a virus that wanted to spread itself via SMB shares. If it managed to contact a printer, it somehow thought it was a file share and tried to copy its code over. This would result in hundreds of pages (thank you HP for form feed support in whatever printer language this was) being printed with a few garbage characters on each page. One printer actually wore out some rollers from having to do this.
But yeah, your average ID-10T couldn't identify a Chinese character
Re: (Score:2)
Maybe it actually printed Quotations from Chairman Mao, or "AHAHAHA, WHITE DEVILS ARE STUPID! PWNED BY LI MING" repeatedly?
Actually, there are a lot of anecdotes along the lines of "Found unsecured printer on the internet, told it to print War and Peace. 10 times."
This is good news (Score:4, Funny)
a printer used by Chamber executives spontaneously started printing pages with Chinese characters.
Finally we've tracked down that bad printer driver to China.
Re: (Score:2)
"Finally we've tracked down that bad printer driver to China."
It can't be in China. The printer is an HP and their software is too bloated to fit.
Re: (Score:2)
It's kinda worrying when people see Chinese characters coming out of a printer and assume it is due to hacking. Maybe they have some staff who can speak Chinese, or even Japanese or Korean (because what are the chances they can tell the difference)?
Since there is no translation given of the text printed I'm going to have to invoke the "pics or it didn't happen" defence.
Idiots. (Score:1, Insightful)
Dont blame chinese. the hackers could as well be kiddies. Hell, it could as well be a random bot mistakenly and randomly gaining entry. Since the level of stupidity is as high as to put thermostats online as controllable from internet, go figure how did they treat rest of the network.
Re:Idiots. (Score:5, Insightful)
Re:Idiots. (Score:5, Insightful)
However, I would blame the intruder for getting shot, or mauled by my two pit bull terriers.
Re: (Score:2, Funny)
Getting shot by your two put bull terriers?
That sounds like the best home defense system ever.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Attractive Nuisance. [wikipedia.org]
If you have a honeypot you know the script kiddies will want to play in, you should protect it.
Re: (Score:2)
Re: (Score:2)
A good lawyer could make the connection. True, a better case could be made if the script kiddie contracted a virus while crawling around your system.
Re: (Score:2)
Re: (Score:2)
From my end, he sounds more like the type that would blame a homeowner that would put up a sign on his front door that says, "Door unlocked; combination to safe with valuables is ... . On vacation until ..."
Re: (Score:2)
Re: (Score:2)
You're sound like the type that would blame the homeowner for keeping their doors unlocked instead of the intruder for going in without permission.
Blame? Nope. Call a retard? Abso-fucking-lutely.
I have a good friend that lives out in the sticks, he used to brag all the time to us city folk how he left his doors unlocked routinely because it was just so much safer out there and how we were all suckers for living 'like prisoners' in the crime-infested city. Then one day he forgot to shut his garage door and half the shit in there walked away, thousands of dollars worth of tools, exercise equipment, and other crap. Boy did we have a laugh at his exp
Not just that (Score:2)
It is more like blaming the houseowner for putting handles on the doors, since these faciliate entry.
Re: (Score:2)
Home owner? You mean bank owner. In both cases thief get the blame, but in the second, owner deserves his share as well.
Your analogy would work for "$some_random_person mail account was hacked" - and you'll notice there's usually just expected schadenfreude and "I've got same combination on my luggage!" jokes, but no blame assigned to the owner in that case.
Re: (Score:2)
Blaming the intruder for their choice to exploit the CHOICE of the homeowner to be vulnerable is appropriate, but the homeowner still CHOSE vulnerability.
We live in a bad fucking world, and if you don't prepare accordingly that indicates you are stupid.
Re: (Score:2)
You're making a lot of assumptions here based on very thin statements above, and I wouldn't arrive at the same conclusion. The report is only that the thermostat is communicating with a Chinese address. It doesn't say the thermostat was or wasn't behind a firewall. It doesn't say the origins of the sessions with a Chinese server originated from China. It doesn't say they hacked into the thermostat from outside. It doesn't say the thermostat is even available via external access -- IP might just be the
I don't see the problem (Score:4, Informative)
Chamber of Commerce Smear Campaign King and Irony (Score:5, Informative)
The US Chamber of Commerce is a lobbying organization -- it's not like they have Industrial Super Secrets. Besides, a high proportion of their clients are Chinese anyway and presumably have pretty good access to the organization already.
True, The Chamber Of commerce also hacks anyone [thinkprogress.org] who criticizes their illegal and immoral behaviour [nytimes.com]. HBGary Federal payback [salon.com] perhaps?
Re: (Score:3)
Re: (Score:2)
They are a very influential lobbying organization. A lot of what they hand congressmen (in paper bags full of money) turns directly into policy and law. Intelligence on economic policy is extremely vital, so their emails and whatnot would absolutely be worth reading by the Chinese government.
Maybe not kiddies this time.
Re: (Score:2)
I think you mean, "I don't see why this is a bigger problem than cracking other people's networks." It's obviously a problem for people to be breaking into others' systems; it's just that you're saying that the USCoC is nothing special. Right?
It sounds, to me, like a combination of "Remember, no matter how hard they work to imply otherwise, the 'US Chamber of Commerce' is just a private lobbying group, not part of the government" and "Awww, so sad, couldn't have happened to a nicer bunch of people."
I'm not a huge fan of internet security being a total free-fire zone; but the USCoC are pretty much slime, have been known to use dirty tricks themselves, so it just isn't feasible to exude too many tears for them.
Thinking too small (Score:2)
Yeah but grabbing and leaking a few documents detailing bribery & coercion of politicians would have been nice.
Not nearly as nice as getting a handle on the politicians would be, eh?
"US Chamber" of Commerce (Score:5, Informative)
Re: (Score:2, Informative)
I'm sorry I don't have mod points today or you would get a +1 informative from me. Most non-Americans don't know that small "detail".
Re: (Score:2, Funny)
"Think tank" is a bit generous, don't you think? "Bribery factory" is more like it.
Re: (Score:2)
Re:"US Chamber" of Commerce (Score:4, Informative)
Legit government agency?
Most cities of any reasonable size at all have Chamber of Commerce organizations. These are always made up of groups of businesses that belong to the private Chamber organization. Sure they work with government in their municipalities, but they are private organizations.
The name US Chamber of Commerce strikes me as being a national incarnation of the local concept. As such, I don't think its name construes that its a government group.
The local chambers (Score:1)
The local chambers are non-profit entities whose purpose is promoting local businesses.
The US Chamber of Commerce is not this type of organization, nor is it affiliated with them in any way, but it has been intentionally named to mislead you into thinking it is.
Re: (Score:2)
That's one purpose, and it depends on how you define "promote". They also have other purposes, such as local-level lobbying to influence zoning boards, municipal regulations, etc.
Where I grew up, they were also active in promoting unregulated capitalism (they called it free-market, though it isn't in the economic sense of the term free-market) in the schools. It's "funny" that they (local Chambers) sponsored programmin
Re: (Score:2)
The local Chambers also have a political agenda that isn't always perfect.
But local Chambers of Commerce don't run around bribing politicians and working together to make sure that it's perfectly acceptable to send millions of jobs overseas and that they're allowed to sell whatever shitty lead-painted stuff China produces and that no regulation of any sort should exist, ever.
Business in local Chambers of Commerce can't run around trying to set Federal or even State regulation of stuff, or screw around wit
There's a CoC in every town around here.... (Score:2)
Where did you grow up, such that you're utterly unaware of local Chambers of Commerce that are clearly non-governmental?
Seriously, they're in every town around here, and they're always running some booth at a fair or some charity event.
It's been well known to me, for years, that the local chamber of commerce is comprised of local business owners. I'm honestly not sure how anyone could be confused about the non-governmental status of any level of CoC.
Re:There's a CoC in every town around here.... (Score:4, Interesting)
It's been well known to me, for years, that the local chamber of commerce is comprised of local business owners. I'm honestly not sure how anyone could be confused about the non-governmental status of any level of CoC.
Right - I think the more insidious aspect of the name "US Chamber of Commerce" is that it implies for many a parent organization to the local chambers of commerce.
Which isn't true - they're a nasty lobbying organization that happened to pick a name that borders on fraudulent misappropriation of mark. The local chambers have had to pend the past 5 years or so telling their communities, "no, that's not us."
Re: (Score:2)
The problem is, there's no 'mark' per se. Chambers of Commerce are not any sort of collective. They're just completely-seperate NPOs started by local business owners. In fact, nothing stops people from starting a competing one to existing CoCs. (Although they're kind of pointless if many businesses do not join.)
There are a few national networks that let CoCs stay in touch (In addition to the direct connections they usually develop to nearby ones.), and the 'US Chamber of Commerce' does indeed operate as on
Thank you China (Score:4, Insightful)
Do you think China will be willing to shut down the rest of our lobbies for us too? Then we maybe able to accomplish something in government.
Don't be confused (Score:5, Insightful)
The US Chamber of Commerce is a LOBBYING organization (y'know, some of the folks behind SOPA and other crap) and is NOT the US Department of Commerce, the cabinet department that (supposedly) promotes economic growth.
I'm having trouble feeling bad or worried about this.
In fact..... (Score:2)
Thermostat Infiltration Attack!!! (Score:5, Funny)
Hey Larry, does it seem a little warm in here today?
Yeah, it is kinda warm.
Oh my God! We've been hacked by the Chinese!!!
Re: (Score:1)
Re: (Score:1)
You do realize they could attack the thermostat in the White House and get Obama to catch pneumonia?
Online home thermostat like have little security / (Score:2)
Online home thermostat like have little security any ways or some one just left it on the default password. Hell maybe even they have a open wifi with no password or have it on WEP that is very easy to hack.
Honey- they're in- everybody's eggs! (Score:1)
Pretty sure that was what General Curtis Goatheart told his wife when he determined their eggs were really an alien attack.
But that is beside the point.
What are the chances that all of those made in China net enabled thermostats have a default password and a default 'phone home' to a Chinese address?
Sure a default non routable address would be appropriate but that too is another issue for several manufacturers.
Re: (Score:2)
The first thing I'd do if I wanted to have some lulz playing with their thermostat is find a proxy in China.
Presumably the first thing any serious government sponsored Chinese hacker would do is find an overseas proxy to work from. If this stuff even happened it was probably just script kiddies or people searching for accessible control pages on Google. Seriously, if you type in the title of any common CCTV control software's web interface you will find thousands of unprotected cameras to watch and even con
Chamer of Commerce isn't a GOVERNMENT agency (Score:5, Informative)
It's a lobbying group for businesses. Therefore, the Chinese can hack away all they want with my blessing. No harm done.
In fact, considering the harm brought onto US citizens by the Chamber of Commerce, the more damage done to them by the Chinese, the better it is for American citizens.
Re: (Score:1)
Harming business is good for American citizens? Care to explain how that works?
Harming the US Chamber of Commerce is good for American citizens. There. All better now? Or do you need further explanation?
Re: (Score:2)
Tripe (Score:3, Interesting)
Re: (Score:2)
Hacking into the Chamber of Commerce would let you know which government officials had shown themselves open to graft and bribery to sell out their constituents.
This is useful information for a foreign power to have.
Why hack the government, when you can hack the ones who really control the government?
Re: (Score:2)
At least 5%-10% of Taiwanese now live and work in China. With close economic ties like this, your US/China war scenario is pretty darn near impossible.
They're not anything even remotely close to North and South Korea.
The Obvious (Score:5, Insightful)
A thermostat at a town house the Chamber owns on Capitol Hill at one point was communicating with an Internet address in China
What the fuck is a thermostat doing being accessible from the internet?
Re: (Score:1)
Re: (Score:3)
Also, to be fair, anything given a public IP address will be communicating with an Internet address in China before long.
Re: (Score:2)
Re: (Score:2)
A thermostat at a town house the Chamber owns on Capitol Hill at one point was communicating with an Internet address in China
What the fuck is a thermostat doing being accessible from the internet?
I know. Don't they secure these things using NAT?
Re: (Score:2)
I knew someone would say something like this. I have absolutely no problem with the thermostat being networked. I have a problem with it being remotely accessible from the internet at large.
If there's some reason it has to be accessible from outside the firewall (and is there, really?), tunnel through a VPN.
Have the chineese never heard of proxies? (Score:2)
Seems to me it's more likely to be various Chinese teenage hackers.
The professionals are smart enough to realize that IP addresses from China are readily noticed.
Re: (Score:1)
I'm sure they've heard of proxies. That is how one gets around the Great Firewall, after all. I'm not sure they really care to keep their tracks covered. When you air videos of yourself doing a denial-of-service attack, using publicly available tools, on state TV OpSec is probably not your highest priority.
Their highest priority seems to be annoying influential people, who will then complain to the media. The media being technical doofuses breathlessly report that the Chinese Military owned Important Americ
Re: (Score:2)
The professionals are smart enough to realize that IP addresses from China are readily noticed.
...and just as readily written off as "dirty Chinese hackers!" instead of being investigated.
Re: (Score:1)
Dear Hackers: Thank You! (Score:5, Funny)
To The Hackers This May Concern:
On behalf of all American citizens who understand the poisonous effects of lobbying on American democracy and society, I would like to thank you for your hard work. The US Chamber of Commerce is not a government agency, but may as well be so for all intents and purposes. It lobbies our elected officials to adopt policies that favor only big business, with the misguided belief that only laissez-faire capitalism will improve the American way of life. Nothing is further from the truth.
In short, you're doing us a favor.
If it's not too much to ask, could you please submit your findings to Wikileaks, or just post them on a publicly accessible blog? I think more of my countrymen should know about the inner workings of this nefarious herd of swine, and their attempts to sell naked greed as enlightened self-interest.
May we also interest you in targeting other groups, such as "The Club for Growth", "Americans for Prosperity", and "Crossroads GPS"? I'm sure you'd find them just as interesting.
Thanks again,
- Meoward
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
The first is, these single issue voters would make it impossible to govern, if they win. The second is the demographic trends are against them.
Since 2000, 45 million Americans have attained voting age. About 15 million older Americans have passed away. Remember how they used anti-gay voter initiatives to increase their vo
Re: (Score:2)
The problem for Republicans is trying to distract their voters from those same actions.
Security? (Score:1)
Re: (Score:2)
Other than the fact that they own assorted members of Congress, the US Chamber of Commerce is not part of the US government, any more than the USA Network or the US Tennis Association is.
Did I miss something? (Score:2)
Should the Chinese government be looking to hack for secrets, I doubt they would choose the Chamber of Commerce for their target, much less leave the tracks leading right back home to them.
FUD is FUD.
More importantly... (Score:1)
Paranoia (Score:2)
The printer thing sounds like a standard malfunctioning printer driver -> any decent IT person has run into this problem before. Printer spits out pages and pages of gibberish, and it's a sign that the printer driver needs to be reconfigured. Probably trying to print using a PostScript driver instead of a PCL driver, or something to that effect.
And this is from 2010. Slow news day? Or someone desperately trying to play up the "h@x0r$" card, to drum up a little money for a solution in need of a problem?
La
Good Hackers? (Score:2)
Good Hackers?
Considering that the USCOC is a Conservative/Republican cesspool of manipulation, I sincerely hope that the hackers are simply stockpiling information to use AGAINST these asshats.
I eagerly await the Wikileaks release of information gleaned from these "investigations", but I would accept a more public, strategic release of information that torpedoes any chances of Conservatives/Republicans gaining further benefit from the USCOC.
Isn't it ironic (not the song, this time) (Score:2)
Not a big deal (Score:3)
The chamber being cracked by China , is a lot like breaking into your own home.
Re: (Score:2)
The sordid history of the seditious acts of the US Chamber of Commerce date well back to the Nixon Administration's appointment of former chair Lewis Powell to the Supreme Court. He wrote a now-infamous memo, (at the time, secret) to other business leaders, in reaction to Ralph Nader's efforts with Consumers Union, about the horrible threat posed to the American Way of Life, by a politically empowered Middle Class. In this memo, he outlined a strategy, including de-funding the political opposition (basica
Re: (Score:2)
Re: (Score:2)
They already influence the chamber (Score:2)
Not officially, but China already has its hands in the chamber; this use of this is a nice backdoor to get into well connected powerful people in the USA. It would be a wise move for China but other parties bouncing off a computer in China could be doing it as well; same motivation either way.
You know, the CIA has been doing plenty of operations for the benefit of US corporations for over a generation now. (you look it up, it happened and likely still happens. Wikileaks only covered the state dept messing a
Re: (Score:2)
No, it's just posted for the humor of "A thermostat at a town house the Chamber owns on Capitol Hill at one point was communicating with an Internet address in China, they say, and, in March, a printer used by Chamber executives spontaneously started printing pages with Chinese characters.'" According the article, the group "gained access to everything stored on its systems" and may have "had access to the network for more than a year before the breach was uncovered."
Gaining access to everything stored on t