Krebs on Security | The Washington Post
The Washington Post has everything a Chinese hacker could hope for: A Beijing bureau, stories that could cheese off authorities, a disagreement with the government about granting one of its China bureau chiefs a visa.
But while The New York Times, Associated Press, Bloomberg and The Wall Street Journal have reported incursions into their computer systems, the Post stayed silent. “We don’t have anything to share, but we constantly monitor our systems for threats and attacks,” Post spokesperson Kris Coratti told Poynter in an email late Thursday.
Former Washington Post reporter Brian Krebs said early Friday that another former Post employee told him the organization was hacked in 2012.
According to a former Washington Post information technology employee who helped respond to the break-in, attackers compromised at least three servers and a multitude of desktops, installing malicious software that allowed the perpetrators to maintain access to the machines and the network.
“They transmitted all domain information (usernames and passwords),” the former Post employee said on condition of anonymity. “ We spent the better half of 2012 chasing down compromised PCs and servers. [It] all pointed to being hacked by the Chinese. They had the ability to get around to different servers and hide their tracks. They seemed to have the ability to do anything they wanted on the network.”
Late Friday, the Post acknowledged it was in fact hacked.
“Like other companies in the news recently, we face cybersecurity threats,” Post spokeswoman Kris Coratti said. “In this case, we worked with [security company] Mandiant to detect, investigate, and remediate the situation promptly at the end of 2011. We have a number of security measures in place to guard against cyberattacks on an ongoing basis.” …
After the report by Krebs on Friday, some Post journalists grumbled about not being alerted to the intrusion and expressed concern that outside hackers may have had access to their e-mails or documents kept on their computers. Reporting that dealt with dissidents or political issues in China would have been especially sensitive.
“Nobody told me a word. Wish they had,” said longtime Post foreign correspondent Keith B. Richburg, who was acting bureau chief in Beijing at the time of the cyberattack and is leaving the company for a job at Harvard University.
If the Post hadn’t been hacked, what would that say about the status of one of the United States’ most prominent newspapers? This failure to be infiltrated contributes to a narrative of decline that the company should address immediately, perhaps instructing employees to begin clicking on suspicious links posthaste. As a “major New York media power player” demanded long ago in a vintage Onion gag, “I’d better see an envelope full of anthrax on my desk by noon tomorrow, or I’m gonna be seriously pissed.”
I prepared a Vine video to illustrate this state of affairs:
(As far as I know, my computer was not hacked, but this video is on YouTube because I am rubbish at Vine.)
Guessing @hblodget, @ariannahuff, @peretti & @drudge are jealous the Chinese haven’t hacked them. Or have they?…
— Jeff Jarvis (@jeffjarvis) January 31, 2013
Related: Hacks at Twitter, New York Times, WSJ and Washington Post highlight need for better security hygiene (Alex Howard/Digiphile) | The Onion freely and happily gives its employees’ passwords to China (The Onion)
Previously: Chinese hackers infiltrate The New York Times, Wall Street Journal
Comments