Vulnerabilities / Threats

3/9/2018
04:20 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

China's Vulnerability Database Altered to Hide Govt. Influence

Recorded Future says move designed to hide fact that CNNVD routinely delays publication of high-risk flaws so government can assess them for offensive use.

The operators of China's National Vulnerability Database (CNNVD) appear to be systematically delaying publishing information on certain high-threat vulnerabilities so the country's Ministry of State (MSS) can assess them for use in intelligence operations.

That's the assessment of threat-intelligence vendor Recorded Future based on its analysis of some recent changes to the CNNVD.

According to Recorded Future, CNNVD has altered the original publication dates for as many 267 vulnerabilities in the database to make it appear like the information was published weeks before it actually was.

Recorded Future published research last November saying the CNNVD had a policy of delaying publication of certain high value vulnerabilities while the MSS evaluated them for their potential operational utility. The vulnerability publication date changes seem to have been made after this first research was published.  

As one example, Recorded Future pointed to a Microsoft Office bug (CVE-2017-0199) that CNNVD did not publish until 57 days after the US National Vulnerability Database (NVD) had published it. During the publication lag, a Chinese APT group actively exploited the vulnerability, Recorded Future said. In another instance, CNNVD took 236 to publish details on a vulnerability that was used to send what Recorded Future described as vast amounts of user data to servers in China in a likely government surveillance operation.

According to Recorded Future, the CNNVD is generally faster than the NVD in publishing vulnerability details—except in the case of high-threat vulnerabilities. Last October for instance, when Recorded Future compared the speeds at which the two databases published vulnerability data, it found CNNVD to be faster than NVD on average by 20 days—13 days to 33 for the latter. The company has previously noted that 75% of vulnerabilities are shared online on security websites, dark web, and other sources before they get into the NVD.

Recorded Future's research also found that the China vulnerability database contained information on 1,746 more vulnerabilities than contained in the NVD. At the time, Recorded Future's assessment was that CNNVD was outperforming the NVD in reporting vulnerabilities overall.

The threat intelligence vendor had recommended the US could improve simply by incorporating content from the CNNVD. It concluded that because the NVD relies entirely on voluntary submissions it could not provide comprehensive coverage of vulnerability information.

However, Recorded Future's subsequent analysts showed that CNNVD's speed to publish did not apply to high-threat vulnerabilities. "High-threat vulnerabilities were consistently published substantially later (anywhere from 21 to 156 days later) than low-threat vulnerabilities," the company had noted in its November report. The publication lag was one way to identify the vulnerabilities that China's MSS was considering for potentially offensive uses.

Since then, CNNVD appears to have systematically changed the publication dates on at least 267 of the 268 vulnerabilities that Recorded Future had identified as being outliers. The entries have been backdated so the publication dates for the vulnerabilities now match the NVDs publication dates for those flaws.

The systematic manipulation is sure evidence that the CNNVD is attempting to hide the fact that it deliberately delays publication of certain flaws so the MSS can assess them for operational use. "There is no other logical explanation as to why only the initial publication dates for outlier CVEs would have been altered," the company said.

Related content:

 

 

Black Hat Asia returns to Singapore with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier solutions and service providers in the Business Hall. Click for information on the conference and to register.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
How the US Chooses Which Zero-Day Vulnerabilities to Stockpile
Ricardo Arroyo, Senior Technical Product Manager, Watchguard Technologies,  1/16/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The Year in Security 2018
This Dark Reading Tech Digest explores the biggest news stories of 2018 that shaped the cybersecurity landscape.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-3906
PUBLISHED: 2019-01-18
Premisys Identicard version 3.1.190 contains hardcoded credentials in the WCF service on port 9003. An authenticated remote attacker can use these credentials to access the badge system database and modify its contents.
CVE-2019-3907
PUBLISHED: 2019-01-18
Premisys Identicard version 3.1.190 stores user credentials and other sensitive information with a known weak encryption method (MD5 hash of a salt and password).
CVE-2019-3908
PUBLISHED: 2019-01-18
Premisys Identicard version 3.1.190 stores backup files as encrypted zip files. The password to the zip is hard-coded and unchangeable. An attacker with access to these backups can decrypt them and obtain sensitive data.
CVE-2019-3909
PUBLISHED: 2019-01-18
Premisys Identicard version 3.1.190 database uses default credentials. Users are unable to change the credentials without vendor intervention.
CVE-2019-3910
PUBLISHED: 2019-01-18
Crestron AM-100 before firmware version 1.6.0.2 contains an authentication bypass in the web interface's return.cgi script. Unauthenticated remote users can use the bypass to access some administrator functionality such as configuring update sources and rebooting the device.