Vulnerabilities / Threats

3/9/2018
04:20 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

China's Vulnerability Database Altered to Hide Govt. Influence

Recorded Future says move designed to hide fact that CNNVD routinely delays publication of high-risk flaws so government can assess them for offensive use.

The operators of China's National Vulnerability Database (CNNVD) appear to be systematically delaying publishing information on certain high-threat vulnerabilities so the country's Ministry of State (MSS) can assess them for use in intelligence operations.

That's the assessment of threat-intelligence vendor Recorded Future based on its analysis of some recent changes to the CNNVD.

According to Recorded Future, CNNVD has altered the original publication dates for as many 267 vulnerabilities in the database to make it appear like the information was published weeks before it actually was.

Recorded Future published research last November saying the CNNVD had a policy of delaying publication of certain high value vulnerabilities while the MSS evaluated them for their potential operational utility. The vulnerability publication date changes seem to have been made after this first research was published.  

As one example, Recorded Future pointed to a Microsoft Office bug (CVE-2017-0199) that CNNVD did not publish until 57 days after the US National Vulnerability Database (NVD) had published it. During the publication lag, a Chinese APT group actively exploited the vulnerability, Recorded Future said. In another instance, CNNVD took 236 to publish details on a vulnerability that was used to send what Recorded Future described as vast amounts of user data to servers in China in a likely government surveillance operation.

According to Recorded Future, the CNNVD is generally faster than the NVD in publishing vulnerability details—except in the case of high-threat vulnerabilities. Last October for instance, when Recorded Future compared the speeds at which the two databases published vulnerability data, it found CNNVD to be faster than NVD on average by 20 days—13 days to 33 for the latter. The company has previously noted that 75% of vulnerabilities are shared online on security websites, dark web, and other sources before they get into the NVD.

Recorded Future's research also found that the China vulnerability database contained information on 1,746 more vulnerabilities than contained in the NVD. At the time, Recorded Future's assessment was that CNNVD was outperforming the NVD in reporting vulnerabilities overall.

The threat intelligence vendor had recommended the US could improve simply by incorporating content from the CNNVD. It concluded that because the NVD relies entirely on voluntary submissions it could not provide comprehensive coverage of vulnerability information.

However, Recorded Future's subsequent analysts showed that CNNVD's speed to publish did not apply to high-threat vulnerabilities. "High-threat vulnerabilities were consistently published substantially later (anywhere from 21 to 156 days later) than low-threat vulnerabilities," the company had noted in its November report. The publication lag was one way to identify the vulnerabilities that China's MSS was considering for potentially offensive uses.

Since then, CNNVD appears to have systematically changed the publication dates on at least 267 of the 268 vulnerabilities that Recorded Future had identified as being outliers. The entries have been backdated so the publication dates for the vulnerabilities now match the NVDs publication dates for those flaws.

The systematic manipulation is sure evidence that the CNNVD is attempting to hide the fact that it deliberately delays publication of certain flaws so the MSS can assess them for operational use. "There is no other logical explanation as to why only the initial publication dates for outlier CVEs would have been altered," the company said.

Related content:

 

 

Black Hat Asia returns to Singapore with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier solutions and service providers in the Business Hall. Click for information on the conference and to register.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Google Engineering Lead on Lessons Learned From Chrome's HTTPS Push
Kelly Sheridan, Staff Editor, Dark Reading,  8/8/2018
White Hat to Black Hat: What Motivates the Switch to Cybercrime
Kelly Sheridan, Staff Editor, Dark Reading,  8/8/2018
PGA of America Struck By Ransomware
Dark Reading Staff 8/9/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Now about that mortgage refinance offer from Wells Fargo .....
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2016-4975
PUBLISHED: 2018-08-14
Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32 which prohibit CR or LF injection into the "Location" or other outbound header key or value. Fixed in Apache HTTP Server 2.4.25 (A...
CVE-2018-6970
PUBLISHED: 2018-08-13
VMware Horizon 6 (6.x.x before 6.2.7), Horizon 7 (7.x.x before 7.5.1), and Horizon Client (4.x.x and prior before 4.8.1) contain an out-of-bounds read vulnerability in the Message Framework library. Successfully exploiting this issue may allow a less-privileged user to leak information from a privil...
CVE-2018-14781
PUBLISHED: 2018-08-13
Medtronic MMT 508 MiniMed insulin pump, 522 / MMT - 722 Paradigm REAL-TIME, 523 / MMT - 723 Paradigm Revel, 523K / MMT - 723K Paradigm Revel, and 551 / MMT - 751 MiniMed 530G The models identified above, when paired with a remote controller and having the "easy bolus" and "remote bolu...
CVE-2018-15123
PUBLISHED: 2018-08-13
Insecure configuration storage in Zipato Zipabox Smart Home Controller BOARD REV - 1 with System Version -118 allows remote attacker perform new attack vectors and take under control device and smart home.
CVE-2018-15124
PUBLISHED: 2018-08-13
Weak hashing algorithm in Zipato Zipabox Smart Home Controller BOARD REV - 1 with System Version -118 allows unauthenticated attacker extract clear text passwords and get root access on the device.