備註請放最後面 違者新聞文章刪除
1.媒體來源:
reuters
2.記者署名:
Raphael Satter
3.完整新聞標題:
Chinese spyware code was copied from America's NSA: researchers
4.完整新聞內文:
WASHINGTON (Reuters) - Chinese spies used code first developed by the U.S.
National Security Agency to support their hacking operations, Israeli
researchers said on Monday, another indication of how malicious software
developed by governments can boomerang against their creators.
以色列研究人員周一說，中國間諜使用美國國家安全局最初開發的代碼來支持其黑客行動
，這再次表明了政府開發的惡意軟件如何對他們的創作者進行猛烈抨擊。
Tel Aviv-based Check Point Software Technologies issued a report noting that
some features in a piece of China-linked malware it dubs “Jian” were so
similar they could only have been stolen from some of the National Security
Agency break-in tools leaked to the internet in 2017.
總部位於特拉維夫的Check Point軟件技術公司發布了一份報告，指出中國的一個
惡意程式叫做"Jian"的，他有些地方太像偷來的。在2017年時，一些國安局的破解工具
被外流到網路上。
Yaniv Balmas, Checkpoint’s head of research, called Jian “kind of a
copycat, a Chinese replica.”
Checkpoint的研究主管Yaniv Balmas稱Jian為“模仿者，中國複製品。”
The find comes as some experts argue that American spies should devote more
energy to fixing the flaws they find in software instead of developing and
deploying malicious software to exploit it.
這一發現之所以出現，是因為一些專家認為，美國間諜應該投入更多精力來修復他們在軟
件中發現的缺陷，而不是開發和部署惡意軟件來加以利用。
The NSA declined comment. The Chinese Embassy in Washington did not respond
to requests for comment.
國家安全局拒絕置評。 中國駐華盛頓大使館未回應。
A person familiar with the matter said Lockheed Martin Corp – which is
credited as having identified the vulnerability exploited by Jian in 2017 –
discovered it on the network of an unidentified third party.
一位知情人士說，洛克希德·馬丁公司（Lockheed Martin Corp）在一個身份不明的第三
方網絡上發現了該漏洞。洛克希德·馬丁公司（Lockheed Martin Corp）在2017年發現了
Jian利用的漏洞。
In a statement, Lockheed said it “routinely evaluates third-party software
and technologies to identify vulnerabilities.”
洛克希德公司在一份聲明中說，“它定期評估第三方軟件和技術以識別漏洞。”
Countries around the world develop malware that breaks into their rivals’
devices by taking advantage of flaws in the software that runs them. Every
time spies discover a new flaw they must decide whether to quietly exploit it
or fix the issue to thwart rivals and rogues.
全世界的國家都在利用運行惡意軟件的漏洞來開發可侵入其競爭對手設備的惡意軟件。
每次間諜發現新的漏洞時，他們都必須決定是悄悄地利用它還是解決該問題以阻止競爭對
手和流氓。
That dilemma came to public attention between 2016 and 2017, when a
mysterious group calling itself the “Shadow Brokers” published some of the
NSA’s most dangerous code to the internet, allowing cybercriminals and rival
nations to add American-made digital break-in tools to their own arsenals.
這種困境在2016年至2017年間引起了公眾的注意，當時一個自稱為“影子經紀人”的神秘
組織向網路發布了NSA最為危險的一些code，從而使網絡犯罪分子和競爭國家可以將美
國製造的數位入侵工具加入到他們自己的武力。
How the Jian malware analyzed by Checkpoint was used is not clear. In an
advisory published in 2017, Microsoft Corp suggested it was linked to a
Chinese entity it dubs “Zirconium,” which last year was accused of
targeting U.S. election-related organizations and individuals, including
people associated with President Joe Biden’s campaign.
目前尚不清楚如何使用Checkpoint分析的Jian惡意軟件。 在2017年發布的一份諮詢報告
中，微軟公司暗示它與一個叫做“鋯”的中國公司有聯繫，該公司去年被指控針對美國
與選舉相關的組織和個人，包括與喬·拜登總統競選活動有關的人。
Checkpoint says Jian appears to have been crafted in 2014, at least two years
before the Shadow Brokers made their public debut. That, in conjunction with
research published in 2019 by Broadcom Inc-owned cybersecurity firm Symantec
about a similar incident, suggests the NSA has repeatedly lost control of its
own malware over the years.
Checkpoint表示，Jian似乎是在2014年製作的，至少在Shadow Brokers公開亮相之前兩年
。 這與博通公司旗下網絡安全公司賽門鐵克在2019年發布的關於類似事件的研究相結合
，表明NSA多年來已經屢屢失去對其自身惡意軟件的控制權。
Checkpoint’s research is thorough and “looks legit,” said Costin Raiu, a
researcher with Moscow-based antivirus firm Kaspersky Lab, which has helped
dissect some of the NSA’s malware.
莫斯科防毒軟體公司卡巴斯基實驗室的研究員Costin Raiu說，Checkpoint的研究是徹底的
“看起來很合法”，該組織已經幫助分析了NSA的某些惡意程式。
Balmas said a possible takeaway from his company’s report was for spymasters
weighing whether to keep software flaws secret to think twice about using a
vulnerability for their own ends.
Balmas說，間諜公司可以從公司的報告中得出結論，他們可以權衡是否對軟件漏洞進行
保密，以便為自己的目的考慮使用漏洞。
“Maybe it’s more important to patch this thing and save the world,” Balmas
said. “It might be used against you.”
Balmas說：“也許修補這個東西並拯救世界更重要。” “它可能會被用來對付你。”
5.完整新聞連結 (或短網址):
https://www.reuters.com/article/us-usa-cyber-china-idUSKBN2AM11R
6.備註:
這新聞就兩個點，一是美國國安局出了內鬼，專把自己人的code外洩，二是中國居然連
這個東西都要抄，不愧是作弊大國