China's Cyber Power At Least a Decade Behind the US, Study Finds (nikkei.com) 117
Hmmmmmm shares a report from the Financial Times: China's strengths as a cyber power are being undermined by poor security and weak intelligence analysis, according to new research that predicts Beijing will be unable to match US cyber capabilities for at least a decade. The study, published on Monday by the International Institute for Strategic Studies, comes as a series of hacking campaigns have highlighted the growing threat of online espionage by hostile states.
IISS researchers ranked countries on a spectrum of cyber capabilities, from the strength of their digital economies and the maturity of their intelligence and security functions to how well cyber facilities were integrated with military operations. China, like Russia, has proved expertise in offensive cyber operations -- conducting online spying, intellectual property theft and disinformation campaigns against the US and its allies. But both countries were held back by comparatively loose cybersecurity compared with their competitors, according to the IISS. As a result, only the US is ranked as a "top tier" cyber power by the think tank, with China, Russia, the UK, Australia, Canada, France and Israel in the second tier. The third tier comprises India, Indonesia, Japan, Malaysia, North Korea, Iran and Vietnam.
Greg Austin, an expert in cyber, space and future conflict at the IISS, said media reports focusing only on the positive sides of China's digital advances -- such as its aspirations to become a global leader in artificial intelligence -- had contributed to an "exaggerated" perception of its cyber prowess. "On every measure, the development of skills for cybersecurity in China is in a worse position than it is in many other countries," he said. What set the US apart in the first tier, according to the IISS, was its unparalleled digital-industrial base, its cryptographic expertise and the ability to execute "sophisticated, surgical" cyber strikes against adversaries. Unlike opponents such as China and Russia, the US also benefited from close alliances with other cyber powers, including its Five Eyes partners.
IISS researchers ranked countries on a spectrum of cyber capabilities, from the strength of their digital economies and the maturity of their intelligence and security functions to how well cyber facilities were integrated with military operations. China, like Russia, has proved expertise in offensive cyber operations -- conducting online spying, intellectual property theft and disinformation campaigns against the US and its allies. But both countries were held back by comparatively loose cybersecurity compared with their competitors, according to the IISS. As a result, only the US is ranked as a "top tier" cyber power by the think tank, with China, Russia, the UK, Australia, Canada, France and Israel in the second tier. The third tier comprises India, Indonesia, Japan, Malaysia, North Korea, Iran and Vietnam.
Greg Austin, an expert in cyber, space and future conflict at the IISS, said media reports focusing only on the positive sides of China's digital advances -- such as its aspirations to become a global leader in artificial intelligence -- had contributed to an "exaggerated" perception of its cyber prowess. "On every measure, the development of skills for cybersecurity in China is in a worse position than it is in many other countries," he said. What set the US apart in the first tier, according to the IISS, was its unparalleled digital-industrial base, its cryptographic expertise and the ability to execute "sophisticated, surgical" cyber strikes against adversaries. Unlike opponents such as China and Russia, the US also benefited from close alliances with other cyber powers, including its Five Eyes partners.
Another great study... (Score:5, Insightful)
Re:Another great study... (Score:5, Insightful)
Indeed. Also, even if the US has superior capabilities, the "outdated" Chinese capabilities seem to be quite enough to hack US critical infrastructure and companies time and again.
Re:Another great study... (Score:5, Interesting)
Not everyone who can hack people goes around actually hacking civilian targets, and not everybody who gets hacked tells the world about it. And as Bruce Schneier is fond of pointing out, cyber defense is much harder than cyber offense -- an attacker often needs to find just one usable exploit, but defenders must prevent them all.
Re: (Score:1)
Also true for classical weapons. (Score:4, Insightful)
Cost of an attack (say, a missile) is much lower than the cost of the defense against it (counter-missiles and related detection/tracking systems).
One of war strategies is simply overwhelming defense capabilities by attacking first, launching multiple cheap attacks and exhausting first the deployed then the stored defense missiles. Their production would simply not keep up.
Cyberweapons likely make the attack costs even lower.
Re: (Score:2)
Cost of an attack (say, a missile) is much lower than the cost of the defense against it
That really depends on the situation and the types of weapons available. Anciently when supply lines were hard to set up (because everything needed to be carted in by horses), a simple wall could be a powerful defense keeping out invaders. And before horses were available, it was even more difficult.
We can see the same thing in martial arts. In Jiu Jitsu, defenses are relatively easy (grab the sleeve, hug the leg), which really slows down the action. In Karate, defense is relatively difficult (gotta dodge a
Re: (Score:2)
Not always. Asymmetric war is usually more expensive for the well-resourced party, regardless of attack versus defense.
"When I take action, I'm not going to fire a $2 million missile at an empty tent and hit a camel in the butt. It's going to be decisive." - George W Bush
Re:Another great study... (Score:5, Insightful)
You have to wonder if China holds back its really good exploits because there is simply no need to deploy them against targets running RDP on Windows 7 with admin password 12345.
China certainly seems to be taking security seriously, e.g. developing domestic CPUs that lack American crypto components like RNGs because they can't trust them. Don't seem to be seeing big infrastructure hacks by ransomware gangs like the US is experiencing either, although that could just be down to lack of reporting.
Either way, shields up here.
Re: (Score:2)
RDP on Win 7 is equipped with the NLA capabilities, just as Win 10 is. That much to the RDP.
And when you are in RDP, you essentially are sitting in front of the PC.
Re:Another great study... (Score:5, Insightful)
Hmm, interesting this was modded troll. Seems that the patriots are still here, still in denial.
Until you admit the problem it will never get fixed.
Re: (Score:3, Insightful)
Patriots are always in denial. No country is great enough to justify patriotism.
Re: (Score:3)
Patriotism is fine, nationalism is not [smbc-comics.com]. It's an important distinction.
Re: (Score:2)
Patriots are always in denial. No country is great enough to justify patriotism.
Yeah, this country is just as good as the ones with state trials that executes those accused of witchcraft. Rule by consent of the governed and constitutional law is way overrated, hardly worth the effort to preserve if you ask me.
Man I don't know why I get called a subversionist Chinese shill, do you?
Re: (Score:2)
So you are not conversant with the difference between "bad" and "worse" and it is all the same to you?
Re: (Score:2)
Re:Another great study... (Score:4, Interesting)
Might even be because I mentioned GamerGate on another story. That often makes them go through your post history and randomly mod stuff troll.
Re: (Score:1)
Re: (Score:1)
If you read some of the things written by figures in the GamerGate movement at the time, it's clear they saw it as something they could use for their own ends. That's why it evolved into the alt-right, it was always a deliberate gateway and testing ground for new techniques.
That's also why a lot of GG has alt-right tropes like anti-Semitic conspiracy theories. Getting kids to hate the Jews for interfering with their video games primed them for other conspiracies involving Jews.
Re: (Score:2)
Re: Another great study... (Score:2)
I think gamer behavior is just what you get when people just want to have fun and let their filters go. I was in a World of Warcraft guild that had a bit of everything in it - black, Indian, gay, Jewish, transexual. If you can name it, we had it. And yet we would regularly talk like your typical gamers anyways, uttering every politically incorrect word and phrase that exists at least twice daily, and nobody cared.
Re: (Score:2)
Re: (Score:2)
Might even be because I mentioned GamerGate on another story. That often makes them go through your post history and randomly mod stuff troll.
Yes, I noticed that too. People with small minds given too much power. Old story.
Re: (Score:2)
Until you admit the problem it will never get fixed.
I'll admit that your comments are consistently overrated.
Re: (Score:2)
Pretty much, yes. Also remember that even the US buys exploits, nothing prevents China from doing the same.
Re: (Score:1)
Pretty much, yes. Also remember that even the US buys exploits, nothing prevents China from doing the same.
The US writes exploits sir, then those exploits are studied in the same country they were written in. What is the chinese equivalent of a CVE or any thing the like? You don't need it once someone else writes and patches their own software that you use.
Re: (Score:2)
There are no CVEs for exploits offered in the black market. At least not until used.
Re: (Score:1)
Re: (Score:3)
You have to wonder if China holds back its really good exploits because there is simply no need to deploy them against targets running RDP on Windows 7 with admin password 12345.
Yes, nothing good comes from underestimating China, but I don't think that much if anything bad will result overestimating them. The rates of technological, industrial, and scientific progress in that country are stunning.
I can see that there might be advantages from pretending to underestimate China's capabilities though, from those in power who want to seem to be "on top of things", and/or those for whom the prospect of bloody war is the only thing that allows them to "get it up". In retrospect, perhaps t
Re: (Score:2)
"I don't think that much if anything bad will result overestimating them." We did that to the Soviets after Sputnik, and it got us to the Moon. So you may have a point there.
Speaking of which, the Chinese have said they'll put men on Mars in 2033. I'd like someone here in the US to sit up and take notice. His initials might be E.M.
Re: (Score:2)
Speaking of which, the Chinese have said they'll put men on Mars in 2033. I'd like someone here in the US to sit up and take notice. His initials might be E.M.
12 years is a long time - long enough for things to change such that Musk and China might start a joint venture to put men on Mars. Elon's not a patient man, and the US seems to be empire in decline. Musk might think that China would be a good partner; I suspect that people at that level of wealth and power don't see the world very much differently than the rulers of China do.
Re: (Score:3)
You don't sit on exploits forever because most of them eventually get found and fixed even if you don't exploit them. Their usefulness has a window.
Re: (Score:2)
Re: (Score:2)
''the "outdated" Chinese capabilities seem to be quite enough to hack US critical infrastructure and companies time and again.''
That is because it's state mandated and private companies are open game. As long as they are the cheapest producer of electronic products, they will continue to embed questionable firmware. Most of the world doesn't care, it's cheap and it works but it's all CCP.
Re:Another great study... (Score:5, Interesting)
10 years isn't really that big of a gap. The study is basically pointing out that where China is today, is were the US was in 2011. Not that it will take 10 years for China to catch up to the United States. Especially being a good portion of the Modern IT Infrastructure in the United States was built in China, China isn't waiting for Moor's Law to catch up to them, just effort by the Chinese state and/or its people to have more priority.
Also Power isn't everything. The United States has the World Most Powerful military, greater than what has ever been seen on earth. However the conflicts in the likes with Korea, Vietnam, Afghanistan, Iraq has shown us, that Power isn't everything, unless your goal is just complete death. The same is with Cyber Power, the United States my be more powerful to handle a large attack. However what happens is small attacks, and using our own cyber power against us.
The interesting thing about malware, is once it gets onto your network, it uses your systems to do the attack, so a large complex system, will just need a small injection point somewhere to get in. Often from a random employee who clicks on that link in the email, thinking it was from someone important. To get in, and that code will use any advantage to spread.
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
Capabilities of cyber power by a government say nothing about private businesses who cut costs by ignoring security and not hiring anyone who knows anything about security.
Re: Another great study... (Score:2)
If anything like that happened in China or Russia you'd probably never hear about it. The power structure in both countries only holds up because their people mostly think that it is infallible. Take that away, and you have nothing. If something like that happens, they'd fight tooth and nail to ensure nobody hears about it.
Given the US isn't using any diplomatic efforts to stop them from hacking our infrastructure (which would necessitate us voluntarily not hacking theirs) I think it's safe to say that ther
Re: Another great study... (Score:3)
I used to worry about war with China until I saw Steve1989 do reviews of their MREs which had gone bad within a year of manufacture. They don't even give enough of a shit about their people to feed their army decent food.
Re: (Score:2)
Re: (Score:2)
Too bad you're not smart enough to figure it out.
Re: (Score:2)
Maybe ... eat it before it goes bad?
That's what I do with my food. Maybe the Chinese developed a similar system.
Re: (Score:2)
Well developed countries put a lot of R&D into MRE's. Soldiers can be operational for a couple days without food. You can survive theoretically for a couple weeks with no food if you're not doing anything. Ca
Re: (Score:3)
Re: (Score:2)
How many years do you plan to operate without supply? Unless you expect to not be able to manufacture your MREs anymore, there's generally little reason to want them to last for generations.
Re: (Score:2)
Why are you even commenting, you pretended not to know what an MRE is earlier?
Re: (Score:2)
I guess you might misinterpret something I said.
Re: (Score:2)
MREs are supposed to last years idiot.
Re: (Score:2)
Wow, we're already at ad-hominem in the first comment? That's a new low, even for /.
MREs are supposed to be food that is easy to transport, get ready to eat (preferably without any relevant work input by the soldier) and has a sensible nutrition balance and calorie density. Shelf life is a plus, but mostly a matter of how good your logistics are.
I do admit, considering how the US army works, a shelf life of a couple years is preferable. But that's the one quality that can actually the easiest be compensated
Re: (Score:2)
Yes I do.
Do you understand the duty of logistics in an army? One of them is to know when and how to distribute your supplies to avoid them going bad.
Re: (Score:2)
Ohh, they made something that has flattish surfaces similar to an F35, we're doomed!
Another great study...by another CIA "charity" (Score:1)
From the Department of Wishful Thinking.
Greg Austin, an expert in cyber, space and future conflict at the IISS [iiss.org]
LMFAO, study author Greg Austin, with a PhD in "international law"...
Is the CIA not even trying anymore? At least stick a mouthpiece with something other than a cocksucking degree...for example math, engineering...Greg Austin, PhD "international law" LMFAO
And Greg Austin, PhD "international law", literally his entire publication history is an obsession with China...why is he wasting his obvious expertise on what he now calls a "second t
Re: (Score:2)
Really? That's enough for "Insightful" moderation? But I figured out an excuse to keep the Subject...
An old study called Cyber War is better. Or at least better if the description in the Slashdot summary is accurate. If not, then the summary failed to motivate reading the article? But Clarke analyzed things in terms of offense, defense, and vulnerability, leading me to the conclusion that China had (and still has) the best balance.
But I have news regarding Huawei, one of the major Chinese "players". You m
Raises a question (Score:3)
What happens after that "decade"? China overtakes the USA?
Re: (Score:3)
Windows 13 will be out by then.
And by obsoleting a new generation of hardware in 2026 with the release of Windows 12, things will be totally secure in 2031.
Soo, all that successful hacking is meaningless? (Score:3)
Because I think the Chinese have at least the capabilities and experience of the US, probably a lot more because they care less about being caught.
Alternatively, all the reports about successful Chinese hacking are complete bullshit.
Really, you cannot on one hand accuse an opponent of being incompetent and on the other hand of conducting one successful operation after the other. It makes you look stupid and disconnected.
Re: (Score:2)
There might be an element of "blame China" when people don't know how they were hacked. I'm always reminded of a story about some "dark guys with beards" stealing IT equipment in Australia soon after 9/11, basically an admission they had no clue and were laying down on the job so blame the terrorists.
Then again if malware gangs are deploying stolen US cyber weapons and Snowden was able to exfiltrate large volumes of data you have to assume other governments did too.
Re: (Score:1)
Re:hacking (Score:3)
Re: (Score:2)
It sounds weird, when primitive banging to the doors is counted as hacking. They are advanced at spying, punishing and restricting their own citizen, minorities, that's right. They can be spreading firmware, they have control of. But for destructive hacking success track record you mostly look at actors from another nation-state. No mercy there, thus advances.
Re: (Score:2)
Re: (Score:2)
Logs are full of that disguise. White noise. Not to be qualified as hacking. Attempts to log-in.
Re: (Score:2)
You shouldn't start addressing like this. It just seems in your simple passion, that you've got leverage to turn tables over. Actually, it is you, who is flopping short.
Re: (Score:2)
One of the problems is that "banging on the door" does often actually get you in.
Re: (Score:2)
Occasionally. Going circles trough dictionaries can only work for the most irresponsible admin.
Re: (Score:2)
There are very clueless admins out there. Will not even accuse them of being irresponsible, just utterly incompetent.
Re: hacking (Score:2)
it costs nothing to take a million attempts. if a fraction of a percent end up working then it is fruitful. it's kind of why war dialing a block of phone numbers was so common back in the olden days. you might find an unsecured modem or pbx that you can bounce through. sadly people are not really any more security aware than the were 30 years ago.
Re: (Score:2)
Or maybe those institutions just have crap security. Or maybe the students like to run apps or dodgy P2P software that turns their computers into bots.
I only found out how big P2P was in China when I started looking for Chinese subtitles for Game of Thrones for my wife. There are people who grab the subtitles from the censored Chinese stream, re-time them for the uncensored HBO version that they pirated and add in the missing parts, then release within a few hours of the world-wide premier of each episode.
Sophistication (Score:2)
Really, you cannot on one hand accuse an opponent of being incompetent and on the other hand of conducting one successful operation after the other.
I think you can, if you differentiate between the sophistication of the attacks. It's one thing if a China-backed hacking group aims Nessus at a public website, finds a vulnerability, and siphons password-protected data off of it.
It's another if they hand-craft malware, installed via a spearfishing campaign, to evade intrusion detecting firewalls and pump data out of a secured intranet.
One attack takes a team of specialized programmers and network engineers, with enough hardware and capital to duplicate the
Re: (Score:2)
Because I think the Chinese have at least the capabilities and experience of the US, probably a lot more because they care less about being caught.
Alternatively, all the reports about successful Chinese hacking are complete bullshit.
Really, you cannot on one hand accuse an opponent of being incompetent and on the other hand of conducting one successful operation after the other. It makes you look stupid and disconnected.
By numbers, 1.5 billion population with a 10% educated people, beats the USA with 350million and 20% educated people. The ratio just gives China the leadership in the world. The USA will slowly slip, slide away to be a technologically able country, but will lack the $ to retain #1 position. No country has exclusivity on intelligence. I did not include India that may follow china sometime in the next century. Religous lead oligopolies will never succeed long term.
So, in 2011... (Score:4, Interesting)
i'm glad that China doesn't possess "unparalleled digital-industrial base, cryptographic expertise and the ability to execute "sophisticated, surgical" cyber strikes against adversaries" as per article, though.
Re: (Score:2)
Re: (Score:2)
lol that article is hilarious, admin is sad because the file was deleted before he could delete it. but it was assuredly already copied, so that's irrelevant
Re: (Score:2)
unparalleled digital-industrial base,
This is a really weird way of measuring hacking ability.
The obvious example: Tanks (Score:5, Insightful)
. . . because quantity has a quality all it's own.
The example: Tanks in World War II: The German Tiger II Panzer was, by far, the technically best tank of the Second World War. But the US Sherman and the Soviet T-34 were both far cheaper and easier to produce, and won by sheer numbers.
We (the US) may be the Tiger II, but we're getting swarmed by T-34 equivalents from pretty much everywhere. . . .
Re: The obvious example: Tanks (Score:1)
Re: (Score:1)
More like the US thinks it is the world government and that's only wrong if somebody else is doing it.
Imagine China or Russa bombing random people in Honduras or Panama or the Ukraine because they are planning an uprise, however misguided...
If this headline says anything, it says that the USA is the main threat in thwme world and will be for at least a decade.
INB4 Americans, so brainwashed, they can't imagine somebody criticizing the US AND not being pro-China/-Russia.
Or imagine Russia/China sending arms and military advisors to Honduras, Panama and then activists suddenly start to disappear... Or imagine Russia invading The Ukraine....Wait did that happen?
Re: (Score:2)
While I don't have much to say about the Sherman tanks (though some of the later versions were much better than one might think), the T34-85 was a GREAT tank. And unlike the Tiger II, didn't break down every few dozen miles (yah, the Tiger II had a superb gun, heavy armour,
Re: (Score:2)
I was looking at the tanks from a manufacturing standpoint, but, yes, the logistics of the Tiger II was seriously sub-optimal. . .
Re: (Score:2)
"Amateurs study tactics. Professionals study logistics"
Perhaps the biggest failure of the Germans in WW2 (in terms of fighting the war) was an inability to remember the KISS (Keep It Simple Stupid) principle when designing things.
Re: (Score:2)
The Tiger II is a pretty good parallel for the US industry: Superior on paper, but overengineered, overly complicated, hard and expensive to maintain, very prone to failure and getting spares was really tricky because the manufacturers didn't just let anyone do it because it could've cut into their bottom line.
Considering⦠(Score:1)
Objects in mirror (Score:2)
I believe poor intelligence analysis (Score:1)
Can we agree (Score:4, Interesting)
"Cyber", as a noun, just makes no sense to me. When I hear it, I think people are throwing it around as some vague voodoo to confuse the audience, or by people who don't know what the hell they're talking about. "Watch out, here comes the cyber!" "I know a lot about cyber." To whit [wired.com]
Re: (Score:2)
Re: (Score:2)
I seem to recall that,under certain circumstances, "cyber" is a verb. (evil grin)
Re: (Score:2)
asl want 2 cyber?
Exceptions (Score:2)
China is behind now (Score:2)
But they tend to cut through a decade of advancement in only a few years. They've managed to dominate the tech manufacturing industry through force of will by a central authority and systematic espinoge. Why is cyber warfare going to be any different?
Tell that to Colonial Pipeline (Score:2)
Sophistication != efficacy (Score:2)
These sort of reports seem to just be puff pieces designed to pat oneself on the back over a perceived sense of superiority and technological sophistication, while it says very little about whether these "backwards" methods are actually effective for their stated purpose or not. The US and South Korea were both laughing at a captured NK drone, for example, which was basically a toy plane with a camera taped to it, yet in the process glossed over the far more important part where it had actually managed to s
Behinds (Score:2)
So our security is in the 1990's and they are in the 1980's?
Seems Highly Unlikely (Score:2)
Even if they didn't have anything internal, their ability to steal what they want or need suggests that 10 years is an absurdly long estimate.
What was it like 10 years ago? (Score:2)
Lemme guess: The US was 20 years ahead.
China and Russia are friendly, however: (Score:2)
All I can say is: put your most valuable data backups on an air-gapped mass storage device, with the power disconnected from it.
*only (Score:1)
China is ONLY 10 years behind
Ok China, but... (Score:3)
Others have already pointed out how foolish this assessment is of Chinese capabilities, but even worse is their idiot designation of North Korea as third tier.
North Korea is top tier in domestic security for the simple reason that they don't use ANY computers in critical infrastructure. It's hard to automate critical infrastructure you've never built, let alone install stupidly vulnerable Internet-connected systems the way the US does.
North Korea is also top tier in offensive capability. No one has outright stolen more cryptocurrency than North Korean hackers. They have so much they had to bring in a US consultant to give them ideas how to launder it all into something usable. (He got indicted [justice.gov] for answering their questions.)
Given their wildly inaccurate assessment of North Korea and their feeble assessment of China, this report isn't worth the paper it was printed on to hand out to Congressional staffers who won't read it or understand it if they did.