Newsfeed
Nachrichtenbote
Hong Kong has been in the headlines lately thanks to the Occupy central campaign (#occupycentral, #OccupyHK) and the umbrella revolution (#umbrellarevolution, #UmbrellaMovement). DPHK, Democratic Party Hong Kong and Alliance for True Democracy (ATD) are central players in this movement. Recent development has turned this into more than a fight for democracy. The sites of these organizations were infected with malware, and that turned it into a fight for #digitalfreedom as well. Volexity has the story with all the technical details. It seems to be RATs (Remote Access Trojans) that could be used for a variety of purposes. And the purpose of this is really the interesting question. Who did it and why?
Cybercrime of today is to a large extent social engineering aiming to lure victims to run malware and infecting their devices. Its very common for cybercriminals to drive more users to infected sites or phishing pages by riding on shocking headlines. So infecting sites that are in the middle of global attention is attractive for any cybercriminal, even without any kind of political motivation.
These organizations are involved in a political struggle against one of the worlds leading cyber-superpowers. So it sounds very plausible that China would be behind this malware attack out of political motives. A lot of the visitors on these sites are involved in the movement somehow, either as leaders or at grass root level. Their enemy could gain a lot of valuable information by planting RATs even in a small fraction of these peoples devices.
The publicity around the issue will also scare people away from the sites. Twitter can be used efficiently to orchestrate the protests, so an infected site will probably have little practical impact. Blocking services like Twitter is possible but a very visible and dramatic action, and even that can be circumvented with VPNs like F-Secure Freedome. But the site is more important for spreading the protesters message to a global audience. The impact may be significant at this level. Here again, China would be the one who benefits.
The moral of the story is naturally that political activists are attractive targets for cyber-attacks. Theres no evidence that these cases have political motives. But you dont have to be a genius to figure out that China is the prime suspect. And that makes this case noteworthy. Criminals usually target private people and states other states. But here we seem to have a state targeting ordinary people belonging to a political organization. This kind of attack is a very real threat for people running opposition movements. And the threat is not limited to less democratic countries. The police forces in many western countries already have both technology and legal support for using malware against suspects. And usually without proper transparency and control of its usage.
Frankly speaking, I would not be very surprised if a similar case was discovered here in Europe. We do currently not have democratic movements of the same magnitude as the Umbrella movement. But we do have a lot of organizations that are being watched by the authorities. Ultra-right groups is an obvious example.
Micke
On 15/10/14 At 07:00 AM
Weiterlesen...
Cybercrime of today is to a large extent social engineering aiming to lure victims to run malware and infecting their devices. Its very common for cybercriminals to drive more users to infected sites or phishing pages by riding on shocking headlines. So infecting sites that are in the middle of global attention is attractive for any cybercriminal, even without any kind of political motivation.
These organizations are involved in a political struggle against one of the worlds leading cyber-superpowers. So it sounds very plausible that China would be behind this malware attack out of political motives. A lot of the visitors on these sites are involved in the movement somehow, either as leaders or at grass root level. Their enemy could gain a lot of valuable information by planting RATs even in a small fraction of these peoples devices.
The publicity around the issue will also scare people away from the sites. Twitter can be used efficiently to orchestrate the protests, so an infected site will probably have little practical impact. Blocking services like Twitter is possible but a very visible and dramatic action, and even that can be circumvented with VPNs like F-Secure Freedome. But the site is more important for spreading the protesters message to a global audience. The impact may be significant at this level. Here again, China would be the one who benefits.
The moral of the story is naturally that political activists are attractive targets for cyber-attacks. Theres no evidence that these cases have political motives. But you dont have to be a genius to figure out that China is the prime suspect. And that makes this case noteworthy. Criminals usually target private people and states other states. But here we seem to have a state targeting ordinary people belonging to a political organization. This kind of attack is a very real threat for people running opposition movements. And the threat is not limited to less democratic countries. The police forces in many western countries already have both technology and legal support for using malware against suspects. And usually without proper transparency and control of its usage.
Frankly speaking, I would not be very surprised if a similar case was discovered here in Europe. We do currently not have democratic movements of the same magnitude as the Umbrella movement. But we do have a lot of organizations that are being watched by the authorities. Ultra-right groups is an obvious example.
Micke
On 15/10/14 At 07:00 AM
Weiterlesen...