Chinese Hacker Singlehandedly Responsible For Exploiting 81,000 Sophos Firewalls, DOJ Says (cybernews.com) 16
An anonymous reader shares a report: A Chinese hacker indicted earlier this month and the PRC-based cybersecurity company he worked for are both sanctioned by the US government for compromising "tens of thousands of firewalls" -- some protecting US critical infrastructure, putting human lives at risk.
In a series of coordinated actions, the US Treasury Department's Office of Foreign Assets Control (OFAC), the Department of Justice (DoJ), and the FBI said the massive cyber espionage campaign, which compromised at least 36 firewalls protecting US critical infrastructure, posed significant risks to national security.
A federal court in Indiana earlier this month unsealed an indictment charging 30-year-old Guan Tianfeng (Guan) with conspiracy to commit computer and wire fraud by hacking into firewall devices worldwide, including one "used by an agency of the United States." Guan, employed by the Chinese cybersecurity firm Sichuan Silence -- a known contractor for Beijing intelligence -- was alleged to have discovered a zero-day vulnerability in firewall products manufactured by UK cybersecurity firm Sophos.
In a series of coordinated actions, the US Treasury Department's Office of Foreign Assets Control (OFAC), the Department of Justice (DoJ), and the FBI said the massive cyber espionage campaign, which compromised at least 36 firewalls protecting US critical infrastructure, posed significant risks to national security.
A federal court in Indiana earlier this month unsealed an indictment charging 30-year-old Guan Tianfeng (Guan) with conspiracy to commit computer and wire fraud by hacking into firewall devices worldwide, including one "used by an agency of the United States." Guan, employed by the Chinese cybersecurity firm Sichuan Silence -- a known contractor for Beijing intelligence -- was alleged to have discovered a zero-day vulnerability in firewall products manufactured by UK cybersecurity firm Sophos.
"protecting US critical infrastructure"? (Score:2)
A Chinese hacker indicted earlier this month and the PRC-based cybersecurity company he worked for are both sanctioned by the US government for compromising "tens of thousands of firewalls" -- some protecting US critical infrastructure, putting human lives at risk.
"protecting US critical infrastructure"?
US critical infrastructure should have at the very least 2 firewall from different vendors chained together before being able to access anything.
Re: (Score:2)
I've heard of IP over Carrier Pigeon. But never IP over Chain. What kind of throughput do chains provide?
Re: (Score:2)
No difference in throughput, some difference in latency.
Re: (Score:2)
No one HA pairs different vendor firewalls together.
1.) All hardware vendor's are proprietary even if they use open source code.
2.) All of the hardware back-planes are vastly different.
You'll never see a Palo Alto and Cisco FTD HA paired together. It's best practice and cost efficient to use a next gen (layer 7) Palo Alto pair as your expensive edge wall and then something like a Juno or Checkpoint (layer 3) pair as an internal set to wall of network segments and then something else for your external VPN s
Re: (Score:2)
No one runs them together or 'in series'. The point is to segment large networks apart the firewalls are literal walls between transit layer hardware (routers/switches). All firewalls are ran in same vendor HA pairs and are connected together by router and switch stacks. You could have router/switch stacks that talk between different vendor firewalls but they will never be connected directly together that is pointless, two doors are never nailed together they are on different walls of the room.
Even in th
Re: (Score:1)
"but they will never be connected directly together that is pointless"
It would be no more pointless than a door, box, or vault which requires two keys turned in sync to open. Too often engineers get caught up in 'making it work' when the point of security infrastructure is to secure.
Suggestion: be proactive (Score:3)
If you regard security as a reactive issue, merely going after the people who exploit weakness then you are enabling people to have weak systems. A more robust approach would be to actively seek out weaknesses in devices and take them offline by force in addition to prosecuting hackers.
The way I see it, insecure equipment is like someone leaving a gun out on in their driveway. It's not technically illegal but only going after the people that steal the gun isn't going to solve anything.
Re: (Score:2)
Re: (Score:2)
Leaving a registered firearm anywhere in the US is a federal crime ask Hunter Biden about it.
Re: (Score:2)
Your under the illusion that enterprise security vendor's are not being proactive.
All enterprise firewalls are updated daily, sometimes multiple times a day for threat and malware protection.
What the article isn't telling you is Sophos is a mid grade British vendor that's about at the same level as a Barracuda or Fortigate firewall, not enterprise level.
The scandal isn't that a security company got hit by a zero day that took two days to fix. It's that there are US based companies using foreign products.
Re: (Score:2)
If you regard security as a reactive issue, merely going after the people who exploit weakness then you are enabling people to have weak systems. A more robust approach would be to actively seek out weaknesses in devices and take them offline by force in addition to prosecuting hackers.
Whichever entities got pwned again by this series of exploitations will not get a single dime out of this indictment. About the only thing resulting from this thing will be a Chinese individual, who should no longer travel to countries which extradite to the US. This can be seen as a restriction depending on life style and future plans of this individual.
Sadly I don't really get the impression, that corporate America/Europe feels the heat yet from all these shenanigans. Chinese gov't behaves like unruly tee
Sanctioned (Score:2)
A Chinese hacker indicted earlier this month and the PRC-based cybersecurity company he worked for are both sanctioned by the US government.
I had to read that three times before I realized they meant the other "sanctioned".
"Inflammable means flammable? What a country"
A loaded gun (Score:2)
Government rules made it obvious, that Boeing wasn't completing their duty of care. Likewise, the government examines cars to determine that Chinese car-builders aren't completing their duty of care.
There are no rules demanding IT infrastructure perform a duty of care, no government department examining infrastructure software: That needs to change. I like the metaphor by Slayer [slashdot.org]: Anything less, is leaving a loaded gun lying around.