Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
China Security United States

Cybersecurity Firm Says Chinese Hackers Breached Six US State Agencies (cnn.com) 19

Posted by BeauHD from the another-day-another-breach dept.
An anonymous reader quotes a report from CNN: A Chinese government-backed hacking group has breached local government agencies in at least six US states in the last 10 months as part of a persistent information-gathering operation, investigators at cybersecurity firm Mandiant said Tuesday. The wide range of state agencies targeted include "health, transportation, labor (including unemployment benefit systems), higher education, agriculture, and court networks and systems," the FBI and US Cybersecurity and Infrastructure Security Agency (CISA) said in a separate, private advisory to state governments obtained by CNN. For agencies in two states, the hackers broke into networks using a critical software flaw that was revealed in December just as the Biden administration was scrambling to respond to the flaw's discovery, according to Mandiant.

The hackers' motives aren't clear, but their victims are "consistent with an espionage operation," the firm said. The list of state agencies affected by the hacking could grow as the investigation continues. CISA on December 10 publicly warned that Log4J -- software used by big tech firms around the world -- had a vulnerability that hackers could easily exploit to gain further access to computer systems. Hundreds of millions of computers around the world ran the vulnerable software, US officials later estimated. For weeks, US officials urged companies to update their software; the White House hosted a meeting in January with tech executives to try to address the root problem of software that is not secure by design. Within hours of the CISA advisory, the Chinese hackers had begun using the Log4J flaw to break into the two US state agencies, according to Mandiant.

Agencies in four other states were hacked via other means. In one state, Mandiant said, the hackers accessed personal data on some Americans, including names, email addresses and mobile phone numbers. Mandiant declined to name the US states or agencies affected. While the hackers' ultimate objectives are unclear, state agencies could provide a wealth of useful information to foreign spies, whether data related to elections or government contracting. Mandiant blamed the hacking campaign on a group that the Justice Department has linked with China's civilian intelligence agency. That hacking group, according to a US indictment unsealed in September 2020, has been linked to attempts to breach hundreds of organizations around the world, from hardware makers to pro-democracy politicians in Hong Kong.
This discussion has been archived. No new comments can be posted.

Cybersecurity Firm Says Chinese Hackers Breached Six US State Agencies More

Cybersecurity Firm Says Chinese Hackers Breached Six US State Agencies

Comments Filter:

  • The US has Abysmal cyber security. As long as our nation lacks the ability to defend itself, we probably shouldn't be thinking about how to wage war, expand NATO, or defend the South China Sea. Because we're wide open to a counter-attack.

    • If they hadn't spent $6T in the Middle East recently we could have decent cybersecurity and solar panels on every household in America.

      Oh, but then we wouldn't need the energy wars, so nah?

      • Free colleg would cost $2.2 trillion over 10 years. And pay back in having a new generation of educated citizens able to drive further economic growth.

        Unlike our spending on pointless wars which is worse than simply piling up money and setting it on fire.

    • The US has Abysmal cyber security. As long as our nation lacks the ability to defend itself, we probably shouldn't be thinking about how to wage war, expand NATO, or defend the South China Sea. Because we're wide open to a counter-attack.

      There are obviously many security vulnerabilities throughout the US. However, these vulnerabilities are not uniform across organizations or in terms of severity. Some of these vulnerabilities might be significant in a war or in preparation for war, but many of those are low severity. Perhaps the more interesting question is how widespread these vulnerabilities are in potential opponents. Slashdot has no idea of Chinese or Russian security vulnerability, and hopefully US intelligence has a better idea.

      Th

      • I think it is fairly safe to say that civilian society, finance, and energy in in the US is more dependent on software and networking than in Russia.
        Another scenario is that maybe China's software is less secure, at least the important stuff, but the US's middle-important stuff still represents a very viable target.

        I think waging a conventional war while all your citizens are at home safe in their beds with food in their belly is one thing. It's another if you're waging a war while markets are shut down, tr

      • The really interesting question is how two large countries, both with vulnerabilities and capabilities to exploit those vulnerabilities, would fare in a real war. Hopefully, we stay in the cold war phase and don't find the answer via a hot war.

        Uh, I'd say the actual interesting question, is how the world will define CyberWar.

        Is that a "cold" war, or a "hot" war? Guess it depends on the impact. Rather scary thinking about the pathetically undefined that could lead to actual war.

      • If you work for a large software vendor, they know 100's if not 1000's of bugs and vulnerabilities. These are not shared. nor apps with outright incorrect logic. In the real world, the squeakiest wheel is fixed first, or a new feature if the customer is paying through the nose. Revenue and sales is firmly #1. There is no law requiring software firms to hand their list of 'challenges' over to say the CERT people, so they don't. Large customers have the source code, and it seems the largest agencies can't ret

    • 6 agencies down. Many more to go, fortunately :
      https://de.wikipedia.org/wiki/... [wikipedia.org]

    • Re: (Score:2)

      by gtall ( 79522 )

      Ah, your prescription for the U.S. is to retreat into a second-string nation too timid to defend its interests. How revealing of you.

  • The USA is a shining model for the world to learn from. Possibly the highest wealth inequality in history, other countries' oligarchs may want to study US systems to see how they work & what they can learn from them. In other words how to rape an entire population while making them believe they're free.

Slashdot Top Deals

Avoid strange women and temporary variables.

Close