Vietnam Targeted in Complex Supply Chain Attack (zdnet.com) 23
A group of mysterious hackers has carried out a clever supply chain attack against Vietnamese private companies and government agencies by inserting malware inside an official government software toolkit. From a report: The attack, discovered by security firm ESET and detailed in a report named "Operation SignSight," targeted the Vietnam Government Certification Authority (VGCA), the government organization that issues digital certificates that can be used to electronically sign official documents. Any Vietnamese citizen, private company, and even other government agency that wants to submit files to the Vietnamese government must sign their documents with a VGCA-compatible digital certificate. The VGCA doesn't only issue these digital certificates but also provides ready-made and user-friendly "client apps" that citizens, private companies, and government workers can install on their computers and automate the process of signing a document.
Vietnamese hackers (Score:2)
Vietnam seems to have a good supply of local hackers, and they would be the ones most familiar with the system.
Re: (Score:2)
Vietnam seems to have a good supply of local hackers, and they would be the ones most familiar with the system.
Indeed.
However, if this would have happened to us, we would have screamed "nation state" straight away and pointed a finger of blame at one of the usual suspects.
Re: (Score:3)
Actually I would not be surprised if the attack on Vietnam is *also* of a nation state nature.
You just need to think who would benefit, or would lose less, from such an attack.
Re:Vietnamese hackers (Score:5, Insightful)
TFA is quite clear...
To think about it, which country stands to benefit most from a supply chain attack of Vietnam?
Which country's manufacturing jobs have been migrated to Vietnam?
Re: (Score:2)
Yes, China is a reasonable suspect. But to jump from "suspect" to "They did it!" is quite unreasonable.
Re: (Score:2)
Another fucking Trump failure. I thought the whole point of the tariffs and trade fight with China was to convince a ton of people to move their production sourcing elsewhere, Vietnam included, basically bootstrapping more production in places other than China with the idea that it might wind up being a permanent move.
But Trump also wanted to go after Vietnam, too? That's like undermining your entire trade strategy.
Re: (Score:2)
To think about it, which country stands to benefit most from a supply chain attack of Vietnam?
It sounds like you don't even know what a supply chain attack (as the term is used here) even means....
Hint: it doesn't mean they sabotaged manufacturing jobs.
Should not our governments protect us from this ? (Score:2)
or at least try to. I am not saying that we have no responsibility do to what we can but governments are much better resourced and by taking out crooks like this will benefit their populations. I know that some of these "crooks" are probably other governments and I also know that our own governments indulge in things like this; but unless serious effort is put into trying to stop this (and locking the crooks up) then it will just get worse and worse.
Re: (Score:2)
What do you expect the government to do?
Re: Should not our governments protect us from thi (Score:1)
Avoid the shitty premise of digital signatures. I mean I studied tech and worked in tech and I don't even a clue what the a priori of digital signatures is... it's basically just an attempt to weed out any one afraid of being charged with fraud but ultimately has zero actual security?
Re: (Score:2)
You must not like browsing the web much. Every single HTTPS connection is secured by a digital certificate.
That said, the internet isn't perfect and there are some other measures possible, but I don't think public / private key pair and message digest authentication are going anywhere any time soon.
Re: Should not our governments protect us from th (Score:2)
Website digital certificates and government approved digital signatures seem a bit different. They both have certificate authorities but the former is verifying more details in the handshake I believe. If one had to physical appearance before a government office to get their digital signature, I think my concerns are covered but I don't quite see how they key exchange can be done purely digitally while having convidence in a person being who they claim unless you assume the likelihood of fraud is miniscule
Re:Should not our governments protect us from this (Score:4, Interesting)
as some examples, how about
Re: (Score:2)
Should not our governments protect us from this ?
This is what government protection looks like. You can still rest, assured that those signed documents (probably) arent forged.
There. They protected you.
What does that malware infestation that they forced you into have to do with it? There are always consequences and why should anybody bother figuring out what they will be, so their good intentions should more that cover any of the gross negligence that has harmed millions of people by degree.
Clearly we need more government.
Rambo Did It. (Score:2)
That part of the world is competing with each other so there is no telling which enemy of theirs could have done it.
China. (Score:5, Interesting)
Vietnam and China have basically been at war for thousands of years. I would be surprised to learn that this was NOT them.
From the article:
The Slovak security firm didn't formally attribute the attack to any particular group, but previous reports linked the PhatomNet (Smanager) malware to Chinese state-sponsored cyber-espionage activities.
Re: (Score:2)
Vietnam and China have basically been at war for thousands of years. I would be surprised to learn that this was NOT them.
From the article:
The Slovak security firm didn't formally attribute the attack to any particular group, but previous reports linked the PhatomNet (Smanager) malware to Chinese state-sponsored cyber-espionage activities.
Warring since approximately 1400 CE is not *thousands* of years.
Curious as to who carried it out (Score:2)
If I were Vietnamese and had the skills and a dislike of the government and this centralized, government-controlled means of signing/certifying official documents, this seems like a great way to send a message.
Re: (Score:2)
and if you "were Vietnamese and had the skills and a dislike of the government and this centralized, government-controlled means of signing/certifying official documents", then you'd probably be scared shitless of being taken out and shot if you were ever connected to a caper like this. The Vietnam government is the typical post-communism dictatorship. In Russia, Putin uses gulags and poison and sometimes murder (but only for "special" people). In China Jinping uses re-education camps and capital punishment
China, of course. (Score:4, Interesting)
Trying to pre-empt and eliminate their growing competition in Vietnam, India, etc etc.
The Chinese Communist Party has no problem with industrial sabotage.
Any details how attackers got access? (Score:1)