Tag Archive for: China

Chinese hacking group has found new way to bypass two-factor authentication

A group with alleged links to the Chinese government has been accused of hacking networks worldwide, but in a rare twist, it’s said to be bypassing two-factor authentication in the process.

The hack was detailed late last week by security researchers from Fox-IT Holding B.V. APT20, the group behind the campaign, targets web servers as the first point of entry with a particular focus on Jboss.

Once through the door, the group installs web shells then spreads throughout the network. Showing fairly typical behavior, the group seeks out passwords and administrator accounts to obtain more information from their targets utilizing virtual network credentials for more secure access.

Where it gets interesting is that the researchers claim they found evidence that APT20 was gaining access to VPN accounts that were protected by 2FA. Hacking 2FA isn’t new, and the process involved is somewhat complicated, but APT20 is said to have found a new way to bypass the process.

The hackers are believed to have stolen an RSA SecurID software token from a hacked system, then modified the key to work on different systems.

“The software token is generated for a specific system, but of course this system-specific value could easily be retrieved by the actor when having access to the system of the victim,” the security researchers explained. “As it turns out, the actor does not actually need to go through the trouble of obtaining the victim’s system-specific value, because this specific value is only checked when importing the SecurID Token Seed, and has no relation to the seed used to generate actual 2-factor tokens. This means the actor can actually simply patch the check which verifies if the imported soft token was generated for this system, and does not need to bother with stealing the system-specific value at all.”

While specifically applying to software-based tokens, the method is disturbing particularly given that 2FA is regularly held up as a way to prevent hacking such as this.

A full copy of the research into the group can be found here.

Programmer finds ridiculous ATM loophole that let him withdraw ₦377 million in cash

It sounds like something straight out of a movie: an unsatisfied bank programmer discovers the perfect scheme for making an ATM spit out free money.

But apparently, this story is true: The South China Morning Postand China’s Daily Economic News report that 43-year-old Qin Qisheng managed to withdraw over 7 million yuan (upwards of ₦377 million) from ATMs operated by his employer, Huaxia Bank — all by exploiting a crazy loophole.

According to the reports, the bank’s system didn’t properly record withdrawals made around midnight — effectively spitting out cash without removing the total from a user’s account. Normally, that might send up a red flag that a transaction had failed, but Qisheng allegedly inserted scripts into the system that suppressed those alerts.

Qisheng started pulling out money in November 2016, but it wasn’t until January 2018, some 1,358 withdrawals later, that the bank discovered the bad code in its system and brought him to the authorities.

Perhaps the most surprising part of this story: the bank didn’t want to keep pressing charges once he’d returned the money. Maybe fearing the bad publicity (apparently the loophole has already been fixed), Huaxia Bank reportedly asked police to drop the case — reportedly accepting Qisheng’s explanation that he was merely testing the bank’s security and was holding onto the money for the bank to reclaim. As one does.

The courts refused, though, and Qisheng is now looking at 10 and a half years in prison after losing his appeal. They didn’t buy the argument, considering that he’d moved the money to his personal bank account, instead of the bank’s dummy account, and had apparently been investing some in the stock market, too.

The Verge

China creates app to tell you if you are near someone in debt and encourages you to report them

The Chinese Government has developed a mobile app that tells users if they are near someone who is in debt. The app, called a “map of deadbeat debtors,” flashes when the user is within 500 meters of a debtor and displays that person’s exact location.

News of the app has caused quite a bit of controversy after it was originally reported by the state-run China Daily. It is an extension to China’s existing “social credit” system which scores people based on how they act in public. It’s no secret that China keeps a very close watch on its citizens, but this new public shaming approach takes it one step further.

The app is available through the WeChat platform which has become immensely popular in China. The government stated that “Deadbeat debtors in North China’s Hebei province will find it more difficult to abscond as the Higher People’s Court of Hebei on Monday introduced” the app.

Once a user is alerted that they are close to a debtor, the user can then view their personal information. This will reveal their name, national ID number, and why they were added to the debtor list. The debtor can then be publicly shamed or reported to the authorities if it is deemed that they are capable of repaying their debts.

The full social credit system will be operational in 2020 when plans indicate will be used to bar people with low scores from traveling, getting loans, and getting jobs. A person’s score can be lowered if they do things like playing an excessive amount of video games or posting fake news. On the other hand, a social credit score can be raised by things like volunteering or donating blood.


China busts iPhone smugglers who used drones to get them into Shenzhen

China customs officials have taken down smugglers who used drones to carry iPhones from Hong Kong into Shenzhen. They managed to transport 500 million yuan (about ₦28,728,000,000) worth of refurbished iPhones before the operation was busted, according to Reuters.

Under the cover of dark, the group of 26 used the unspecified drones to “fly two 200-meter (660-feet) cables between Hong Kong and the mainland.” From there, they loaded around 10 iPhones into small bags and sent each across the cable system. The smugglers could move up to 15,000 iPhones each night, so they managed to get things running pretty efficiently.

The local, state-owned Legal Daily reported this to be “the first case found in China that drones were being used in cross-border smuggling crimes.” As a result, Shenzhen customs plans to keep a close eye on this high-tech smuggling — perhaps using its own drones to help combat illegal cross-border activity.

Last year, China implemented a policy requiring owners of civilian drones over a given weight to register their flying gadgets using their real names. As is the case in the US and elsewhere, China has experienced its share of drone incidents, leading to delayed or disrupted flights. In the United States, drone owners must register any device over 0.55 pounds.

The Verge

Built-in Keylogger Found in MantisTek GK2 Keyboards—Sends Data to China

“The right keyboard can make all the difference between a victory and a defeat in a video game battlefield.”

If you are a gamer, you can relate to the above quote.

But what if your winning weapon betrays you?

The popular 104-key Mantistek GK2 Mechanical Gaming Keyboard that costs around €49.66 has allegedly been caught silently recording everything you type on your keyboard and sending them to a server maintained by the Alibaba Group.

This built-in keylogger in Mantistek GK2 Mechanical Gaming Keyboard was noticed by a few owners who headed on to an online forum to share this issue.

According to Tom’s Hardware, MantisTek keyboards utilise ‘Cloud Driver’ software, maybe for collecting analytic information, but has been caught sending sensitive information to servers tied to Alibaba.

After analysing more closely, Tom’s Hardware team found that Mantistek keyboard does not include a full-fledged keylogger. Instead, it captures how many times a key has been pressed and sending this data back to online servers.

The affected users also provided a screenshot showing how all your plain-text keystrokes collected by the keyboard are being uploaded to a Chinese server located at IP address:

However, even if there’s no malicious intent, capturing and uploading keystroke counts without users’ consent violates trust and puts systems’ security at risk by leaking sensitive information.


Since Alibaba Group also sells cloud services like Google and Amazon, this collected information is not necessarily being sent to the Alibaba itself, but someone who is using its cloud service.

Opening the IP address in question directly into a web browser and on a Chinese login page, which translates to “Cloud mouse platform background management system” and is maintained by Shenzhen Cytec Technology Co., Ltd.

Reportedly, the MantisTek keyboard’s software sends the collected data to two destinations at that IP address:

  • /cms/json/putkeyusedata.php
  • /cms/json/putuserevent.php

The best way to prevent your keyboard from sending your keystrokes to the Alibaba server is to stop using your Mantistek GK2 Mechanical Gaming Keyboard until you hear back from the company about this issue.

If you cannot prevent yourself from using the keyboard, but want to stop it from sending your key presses to the Alibaba server, just make sure the MantisTek Cloud Driver software is not running in the background, and block the CMS.exe executable in your firewall.

To block the CMS.exe executable, add a new firewall rule for the MantisTek Cloud Driver in the “Windows Defender Firewall With Advanced Security.”

The Hacker News

Apple removes VPN apps from the App Store in China

The Chinese government’s crackdown on the internet continues with the news that Apple has removed all major VPN apps, which help internet users overcome the country’s censorship system, from the App Store in China.

The move was first noted by ExpressVPN, a provider based outside of China, which said in a blog post “all major VPN apps” including its own had been purged from Apple’s China-based store. The company shared a note from Apple (below) explaining that its app was removed because “it includes content that is illegal in China.”

The app continues to be available for users across the world outside of China, the company said. However, the process to create an App Store account in a different country is unknown to many users, so it is unlikely to fill the void of the missing Chinese app.

Another provide, Star VPN, tweeted that its app had also been removed.

Apple had not replied for comment at the time of writing.

ExpressVPN shared a note from Apple notifying it of the removal of its app in China

The App Store purge is hugely impactful because VPNs represent the only way that a China-based individual can bypass state censorship controls to access the internet without restrictions. The Chinese government effectively illegalized VPNs when new rules issued in January required them to receive government approval in order to operate. That appears to be why Apple was forced to remove ExpressVPN and others like it.

Apple may believe it is best for its business to co-operate with requests from Beijing, but this App Store purge just created one of the biggest setbacks for the free internet in China’s history.

“We’re disappointed in this development, as it represents the most drastic measure the Chinese government has taken to block the use of VPNs to date, and we are troubled to see Apple aiding China’s censorship efforts. ExpressVPN strongly condemns these measures, which threaten free speech and civil liberties,” ExpressVPN wrote on its blog.

Today’s news is the latest in a series of developments against the free internet from China.

Two popular VPN services were forced offline in China earlier this month leaving their users, which included professionals who require access to the global internet for work, without an alternative. Government officials denied a story from Bloomberg that the country’s mobile operators had been told to ban VPN apps by early 2018, but other steps have clearly been taken. Reuters reported earlier this month that the Great Firewall, the term for China’s internet censorship apparatus, had been “upgraded” with new capabilities. VPN services subsequently found that they had been hit by the most sophisticated attacks from China to date. High-end hotels have even ceased offer VPNs to guests.

Those new capability apparently also made it possible for the government to interfere with messaging apps. While now blocked entirely, WhatsApp users found that they were unable to send videos and photos through the chat app and issues seemed to extend to WeChat, China’s most popular messaging service. The censorship seemed to be linked to the response to the death of dissident Liu Xiaobo, a recipient of the Nobel Peace Prize, who lost a battle to liver cancer earlier this month having been denied permission to leave custody to seek medical treatment overseas.

Going direct to Apple is becoming an effective way to enforce censorship since the U.S. firm controls what apps are available in China. The tactic proved successful for China earlier this year when Apple removed the New York Times app from the local Chinese App Store. The Times and Wall Street Journal are among a number of international news sites blocked in China, according to censorship monitoring service Great Fire.

It’s unclear whether similar action has been taken with Android stores in China. The Google Play Store is not present in China, where a handful of third-party app stores are the most influential distributors of Android apps.

Not-for-profit group GreatFire offers ‘censorship-proof’ alternatives like its Android VPN FreeBrowser and other services that include a collaboration with The New York Times, but Apple’s iOS doesn’t permit similar options.

Apple just announced Isabel Ge Mahe as the first managing director for its Chinese business and, beyond battling a sales slump in China, the long-time Apple executive is tasked with the difficult job of managing a relationship with Beijing. The U.S. firm recently announced plans to develop its first China-based data center, a move that is thought to be related to the country’s new cybersecurity laws which went into effect June 1.

tech crunch

How to tell if you’ve been hacked by Russia, China, or North Korea

WannaCry had North Korea’s fingerprints all over it. The massive ransomware attack that hit over 150 countries last week reportedly contained code linked to other cyber crimes allegedly perpetrated by the Hermit Kingdom. But while it might take weeks or months for researchers to identify the culprit through forensic analyses, another set of clues already points to North Korea: motive.

There are rarely smoking guns when it comes to major cyber attacks, but clear patterns and evidence have emerged that indicate which foreign governments are responsible for the biggest ones. Would Russia or China have tried to take down hospitals in the U.K. for a measly $300? Probably not. China veers more towards stealing military and trade secrets, while Russia prefers operations that destabilize foreign governments. But North Korea will definitely hack for cash.

Here’s a quick guide to distinguishing cyber threats from North Korea, China, or Russia:

1. North Korea

Why are they attacking? What are their goals?

North Korea is a relative newcomer to the field of cyber warfare, yet it has quickly established itself as a formidable foe. The isolated country has long employed a strategy of asymmetrical warfare, so cyber attacks fit neatly into its preference for cheap, unpredictable operations that hold minimal risks of retaliation. Hit hard by sanctions, cash-strapped North Korea has recently shifted its cyber capabilities to generate income through theft and ransom — a strategy it might have just blown up to a global scale.

Who do they target?

Before the WannaCry attack, North Korea’s primary targets were South Korean banks and media companies as well as American corporations and international institutions. An attempted cyber attack on a Polish bank last year, for instance, inadvertently revealed that North Korea was also targeting the World Bank, the European Central Bank, and Bank of America. An indiscriminate attack like WannaCry might be a first, but it would hardly be surprising given their past behavior.

What do they take? How do they use it?

Even before it was implicated in the WannaCry attack, North Korea had taken to ransom. Last year, the country stole the personal data of more than 10 million customers from Interpark, a South Korean online retailer. Interpark was alerted to the breach after it received an anonymous message that demanded $2.7 million in bitcoin or else the attack would be publicized. Interpark refused to pay the ransom and alerted South Korean authorities. Interestingly, despite causing so much havoc, the WannaCry operation has seen relatively meager returns: Only about $70,000 in bitcoin has been netted to date.

North Korea’s most profitable operation, however, wasn’t ransomware at all, but a heist. Last year, it attempted to steal nearly $1 billion from a bank in Bangladesh, and successfully made off with $81 million.

All of the country’s attacks aren’t for money, though. Before WannaCry, its highest profile attack was on Sony Pictures Entertainment, when it infiltrated the company’s network in an attempt to stop the release of a comedy about the imagined assassination of North Korean leader Kim Jong Un. Hackers released a trove of embarrassing emails that were widely reported on. But what received less attention was the damage done to Sony’s systems. A highly destructive form of malware was introduced and over 70 percent of its computers were left inoperable.

How did they get in?

North Korea’s sophisticated cyber capabilities are surprising considering its extreme isolation and poor infrastructure. Given the country’s limited connectivity to the outside world, its massive army of hackers, estimated to be 1,700 strong, are allowed to live and work abroad, mostly in China, Southeast Asia, and Europe. The ability to live outside of North Korea is actually a major perk for hackers given how few opportunities there are to leave the barren country. As an added bonus, many North Korean hackers are allowed to run illegal gambling websites to earn additional income.

What’s next?

With the United States and other nations ratcheting up sanctions in response to North Korea’s growing nuclear program, it is likely that North Korean hackers will continue to generate cash from hacking. Whether it returns to targeted operations or tries another indiscriminate attack like WannaCry, though, remains to be seen.

2. China

Why are they attacking? What are their goals?

Chinese cyber attacks are closely aligned with China’s broader national goals of rapidly developing its economic and military might. To that end, Chinese cyber attacks have been aimed at gathering intelligence and stealing military and trade secrets, effectively saving China billions of dollars in research and development costs and helping it quickly catch up to the U.S. in certain key areas.

Who do they target?

China’s targets stretch across American businesses, industries, and government agencies. It is widely believed that China has been responsible for many high-profile cyber attacks against the U.S. in recent years, including: stealing plans for the F-35 fighter jet; infiltrating the U.S. Chamber of Commerce’s and the State Department’s networks; making off with the personal records of over 20 million Americans from the Office of Personnel Management; and breaking into the 2008 McCain and Obama presidential campaigns.

What did they take? How did they use it?

China employs a “grain of sands” approach to hacking, meaning they steal massive amounts of information — often low-level — and sift through it to find valuable nuggets.

When Coca-Cola was in the midst of negotiating the purchase of a Chinese company, for instance, Chinese hackers were poring over Coca-Cola’s systems, hoping to learn more about their negotiation strategy. In a more far-reaching and pernicious attack, Chinese hackers broke into RSA, a computer security company that supplies the SecurID tokens many employees at U.S. banks, intelligence agencies, and military contractors use to securely access computer systems. Two months later, Chinese hackers successfully penetrated Lockheed Martin’s systems partly using data stolen in the heist.

Other cyber attacks have focused on companies that manage critical infrastructure like electrical power grids and gas and water lines. One successful effort targeted a company with detailed blueprints and remote access to over 60 percent of oil and gas pipelines in North America.

How did they do it?

China loves to phish. Most cyber attacks begin with an innocent-seeming email often with an attachment. Once the attachment is opened, hackers are able to gain entry into computer networks and hunt for information. Such attacks are called spear phishing and were used to gain access to Coca-Cola, RSA, and even the State Department. Once inside, hackers can carefully prowl a network, stealing information or unleashing damaging malware.

What’s next?

After decades of widespread and brazen cyber attacks, Chinese intrusions have dramatically fallen. Since the Obama administration signed an agreement with the Chinese government to curb economic espionage in 2015, Chinese cyber attacks have decreased more than 90 percent. Chinese hackers have since turned their attention inwards to help President Xi Jinping root out corruption, and have significantly ramped up attacks on Russian industries.

3. Russia

Why are they attacking? What are their goals?

Russia possesses highly advanced cyber capabilities and is a “near peer” to the United States, according to Gen. Keith Alexander, the former head of the NSA and the military’s Cyber Command. America’s Cold War adversary has moved beyond espionage and regularly uses influence operations and electronic warfare to disrupt and destabilize countries hostile to Russian interests.

Who did they target?

Like China, Russia targets an array of Western businesses, defense contractors, government agencies, and most notably political campaigns. However, unlike China, Russia has used stolen information far more publicly.

What did they take? How did they use it?

The first major Russian cyber attack on the U.S. was uncovered in 1996. After a two-year investigation, it was discovered that hackers had broken into NASA, the Air Force, the Navy, and the Department of Energy, stealing whole weapon designs. Since then, Russia has changed tactics to influence operations and full-out cyber warfare.

Following a 2007 dispute between the Kremlin and Estonia, a former Soviet satellite state, over the relocation of a monument, Russian hackers shut down nearly all of the Estonian government’s websites, many of the country’s major news outlets, and its biggest banks. The attacks lasted nearly three weeks.

Cyber attacks were also unleashed during Russia’s war with Georgia in 2008 as well as its invasion of Crimea in 2011. In 2015, Ukraine blamed Russia for a cyber attack that left over 200,000 Ukrainians without power.

Off the battlefield, Russia has focused on influence operations aimed at undermining opponents of Russia, destabilizing governments, and discrediting democratic processes. The most notable instances, of course, were during the U.S. presidential election last year, when Russia allegedly stole and published emails from Clinton campaign chairman John Podesta and hacked into the Democratic National Committee servers in an effort to damage Hillary Clinton’s candidacy.

Meanwhile, in Europe this year, hackers successfully stole emails from the campaign of now-French President Emmanuel Macron and infiltrated Germany Parliament’s computer networks.

How did they do it?

Like China, Russia relies on spear-phishing attacks to gain access to networks. Their willingness, however, to cause physical damage is unique and highly advanced.

In its attack on Ukraine’s power grid, Russia showed the world its sophisticated capabilities. In a carefully planned attack that took months to execute, Russian hackers slowly wormed their way into Ukrainian power companies’ networks, then carefully studied the infrastructure and planted malware at power substations before launching a synchronized assault.

What’s next?

Unless it is severely punished, Russia will continue to use cyber attacks to hack elections, spread false information, and sow chaos.

The Week