Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

3/9/2018
04:20 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

China's Vulnerability Database Altered to Hide Govt. Influence

Recorded Future says move designed to hide fact that CNNVD routinely delays publication of high-risk flaws so government can assess them for offensive use.

The operators of China's National Vulnerability Database (CNNVD) appear to be systematically delaying publishing information on certain high-threat vulnerabilities so the country's Ministry of State (MSS) can assess them for use in intelligence operations.

That's the assessment of threat-intelligence vendor Recorded Future based on its analysis of some recent changes to the CNNVD.

According to Recorded Future, CNNVD has altered the original publication dates for as many 267 vulnerabilities in the database to make it appear like the information was published weeks before it actually was.

Recorded Future published research last November saying the CNNVD had a policy of delaying publication of certain high value vulnerabilities while the MSS evaluated them for their potential operational utility. The vulnerability publication date changes seem to have been made after this first research was published.  

As one example, Recorded Future pointed to a Microsoft Office bug (CVE-2017-0199) that CNNVD did not publish until 57 days after the US National Vulnerability Database (NVD) had published it. During the publication lag, a Chinese APT group actively exploited the vulnerability, Recorded Future said. In another instance, CNNVD took 236 to publish details on a vulnerability that was used to send what Recorded Future described as vast amounts of user data to servers in China in a likely government surveillance operation.

According to Recorded Future, the CNNVD is generally faster than the NVD in publishing vulnerability details—except in the case of high-threat vulnerabilities. Last October for instance, when Recorded Future compared the speeds at which the two databases published vulnerability data, it found CNNVD to be faster than NVD on average by 20 days—13 days to 33 for the latter. The company has previously noted that 75% of vulnerabilities are shared online on security websites, dark web, and other sources before they get into the NVD.

Recorded Future's research also found that the China vulnerability database contained information on 1,746 more vulnerabilities than contained in the NVD. At the time, Recorded Future's assessment was that CNNVD was outperforming the NVD in reporting vulnerabilities overall.

The threat intelligence vendor had recommended the US could improve simply by incorporating content from the CNNVD. It concluded that because the NVD relies entirely on voluntary submissions it could not provide comprehensive coverage of vulnerability information.

However, Recorded Future's subsequent analysts showed that CNNVD's speed to publish did not apply to high-threat vulnerabilities. "High-threat vulnerabilities were consistently published substantially later (anywhere from 21 to 156 days later) than low-threat vulnerabilities," the company had noted in its November report. The publication lag was one way to identify the vulnerabilities that China's MSS was considering for potentially offensive uses.

Since then, CNNVD appears to have systematically changed the publication dates on at least 267 of the 268 vulnerabilities that Recorded Future had identified as being outliers. The entries have been backdated so the publication dates for the vulnerabilities now match the NVDs publication dates for those flaws.

The systematic manipulation is sure evidence that the CNNVD is attempting to hide the fact that it deliberately delays publication of certain flaws so the MSS can assess them for operational use. "There is no other logical explanation as to why only the initial publication dates for outlier CVEs would have been altered," the company said.

Related content:

 

 

Black Hat Asia returns to Singapore with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier solutions and service providers in the Business Hall. Click for information on the conference and to register.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
US Mayors Commit to Just Saying No to Ransomware
Robert Lemos, Contributing Writer,  7/16/2019
A Lawyer's Guide to Cyber Insurance: 4 Basic Tips
Beth Burgin Waller, Chair, Cybersecurity & Data Privacy Practice , Woods Rogers PLC,  7/12/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-13951
PUBLISHED: 2019-07-18
The set_ipv4() function in zscan_rfc1035.rl in gdnsd 3.2.0 has a stack-based buffer overflow via a long and malformed IPv4 address in zone data.
CVE-2019-13952
PUBLISHED: 2019-07-18
The set_ipv6() function in zscan_rfc1035.rl in gdnsd 3.2.0 has a stack-based buffer overflow via a long and malformed IPv6 address in zone data.
CVE-2019-10100
PUBLISHED: 2019-07-18
The Sleuth Kit 4.6.0 and earlier is affected by: Integer Overflow. The impact is: Opening crafted disk image triggers crash in tsk/fs/hfs_dent.c:237. The component is: Overflow in fls tool used on HFS image. Bug is in tsk/fs/hfs.c file in function hfs_cat_traverse() in lines: 952, 1062. The attack v...
CVE-2019-10102
PUBLISHED: 2019-07-18
SaltStack Salt 2018.3, 2019.2 is affected by: SQL Injection. The impact is: An attacker could escalate privileges on MySQL server deployed by cloud provider. It leads to RCE. The component is: The mysql.user_chpass function from the MySQL module for Salt (https://github.com/saltstack/salt/blob/devel...
CVE-2019-10102
PUBLISHED: 2019-07-18
Gitea 1.7.0 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Attacker is able to have victim execute arbitrary JS in browser. The component is: go-get URL generation - PR to fix: https://github.com/go-gitea/gitea/pull/5905. The attack vector is: victim must open a specifically ...