Slashdot: Inside a Firewall Vendor’s 5-Year War With the Chinese Hackers Hijacking Its Devices

Source URL: https://it.slashdot.org/story/24/11/01/088213/inside-a-firewall-vendors-5-year-war-with-the-chinese-hackers-hijacking-its-devices?utm_source=rss1.0mainlinkanon&utm_medium=feed
Source: Slashdot
Title: Inside a Firewall Vendor’s 5-Year War With the Chinese Hackers Hijacking Its Devices

Feedly Summary:

AI Summary and Description: Yes

Summary: The text discusses a significant cybersecurity battle undertaken by Sophos against Chinese hackers targeting firewall products. This situation has implications for information security, particularly concerning the risks associated with outdated and unsupported devices within critical infrastructure.

Detailed Description: The article highlights a multifaceted cyber threat landscape where critical infrastructure and high-security entities are under continuous assault from sophisticated hacking campaigns. Sophos, a British cybersecurity firm, has engaged in an extensive five-year effort to counteract these threats.

– **Targeted Entities**: The attackers have focused on various sectors, including nuclear facilities, military sites, and critical infrastructure worldwide.
– **Source of Attacks**: Investigations linked the cyber activity to researchers and organizations based in Chengdu, China, notable for their connections to Sichuan Silence Information Technology and the University of Electronic Science and Technology.
– **Intrusion Tactics**: Sophos employed advanced tactics by embedding surveillance code within firewalls used by the attackers, enabling them to observe the hackers’ development processes, including the creation of a novel “bootkit” malware that integrates covertly into the firewall’s boot code.
– **Evolution of Attacks**: The nature of attacks transitioned from broad exploitation efforts in 2020 to more targeted actions aimed at government and infrastructure systems across Asia, Europe, and the United States.
– **Current Trend**: A critical insight from Sophos’ report reveals that attackers have recently shifted strategies from exploiting new vulnerabilities to targeting outdated devices that are no longer supported or updated.
– This involves exploiting “end-of-life” devices that companies continue to operate without adequate security updates and patches.
– In just the last 18 months, Sophos noted over a thousand such outdated devices under siege.

– **Recommendations**: Sophos’ CEO emphasizes the urgency for device owners to decommission unsupported systems and for security vendors to provide clear communication about end-of-life indicators. This insight interacts with broader security challenges like the “365-day vulnerability” or more extensive periods where devices become neglected, posing critical points for potential network breaches.

This incident encapsulates pressing concerns regarding information security and the necessity for organizations to remain vigilant against legacy system vulnerabilities as they relate to national and global security. The ongoing conflict also demonstrates how interconnected cybersecurity efforts must be, especially when dealing with threats from advanced persistent threat (APT) actors.