Vulnerabilities / Threats

3/9/2018
04:20 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

China's Vulnerability Database Altered to Hide Govt. Influence

Recorded Future says move designed to hide fact that CNNVD routinely delays publication of high-risk flaws so government can assess them for offensive use.

The operators of China's National Vulnerability Database (CNNVD) appear to be systematically delaying publishing information on certain high-threat vulnerabilities so the country's Ministry of State (MSS) can assess them for use in intelligence operations.

That's the assessment of threat-intelligence vendor Recorded Future based on its analysis of some recent changes to the CNNVD.

According to Recorded Future, CNNVD has altered the original publication dates for as many 267 vulnerabilities in the database to make it appear like the information was published weeks before it actually was.

Recorded Future published research last November saying the CNNVD had a policy of delaying publication of certain high value vulnerabilities while the MSS evaluated them for their potential operational utility. The vulnerability publication date changes seem to have been made after this first research was published.  

As one example, Recorded Future pointed to a Microsoft Office bug (CVE-2017-0199) that CNNVD did not publish until 57 days after the US National Vulnerability Database (NVD) had published it. During the publication lag, a Chinese APT group actively exploited the vulnerability, Recorded Future said. In another instance, CNNVD took 236 to publish details on a vulnerability that was used to send what Recorded Future described as vast amounts of user data to servers in China in a likely government surveillance operation.

According to Recorded Future, the CNNVD is generally faster than the NVD in publishing vulnerability details—except in the case of high-threat vulnerabilities. Last October for instance, when Recorded Future compared the speeds at which the two databases published vulnerability data, it found CNNVD to be faster than NVD on average by 20 days—13 days to 33 for the latter. The company has previously noted that 75% of vulnerabilities are shared online on security websites, dark web, and other sources before they get into the NVD.

Recorded Future's research also found that the China vulnerability database contained information on 1,746 more vulnerabilities than contained in the NVD. At the time, Recorded Future's assessment was that CNNVD was outperforming the NVD in reporting vulnerabilities overall.

The threat intelligence vendor had recommended the US could improve simply by incorporating content from the CNNVD. It concluded that because the NVD relies entirely on voluntary submissions it could not provide comprehensive coverage of vulnerability information.

However, Recorded Future's subsequent analysts showed that CNNVD's speed to publish did not apply to high-threat vulnerabilities. "High-threat vulnerabilities were consistently published substantially later (anywhere from 21 to 156 days later) than low-threat vulnerabilities," the company had noted in its November report. The publication lag was one way to identify the vulnerabilities that China's MSS was considering for potentially offensive uses.

Since then, CNNVD appears to have systematically changed the publication dates on at least 267 of the 268 vulnerabilities that Recorded Future had identified as being outliers. The entries have been backdated so the publication dates for the vulnerabilities now match the NVDs publication dates for those flaws.

The systematic manipulation is sure evidence that the CNNVD is attempting to hide the fact that it deliberately delays publication of certain flaws so the MSS can assess them for operational use. "There is no other logical explanation as to why only the initial publication dates for outlier CVEs would have been altered," the company said.

Related content:

 

 

Black Hat Asia returns to Singapore with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier solutions and service providers in the Business Hall. Click for information on the conference and to register.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
'PowerSnitch' Hacks Androids via Power Banks
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/8/2018
The Case for a Human Security Officer
Ira Winkler, CISSP, President, Secure Mentem,  12/5/2018
Windows 10 Security Questions Prove Easy for Attackers to Exploit
Kelly Sheridan, Staff Editor, Dark Reading,  12/5/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
10 Best Practices That Could Reshape Your IT Security Department
This Dark Reading Tech Digest, explores ten best practices that could reshape IT security departments.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-8651
PUBLISHED: 2018-12-12
A cross site scripting vulnerability exists when Microsoft Dynamics NAV does not properly sanitize a specially crafted web request to an affected Dynamics NAV server, aka "Microsoft Dynamics NAV Cross Site Scripting Vulnerability." This affects Microsoft Dynamics NAV.
CVE-2018-8652
PUBLISHED: 2018-12-12
A Cross-site Scripting (XSS) vulnerability exists when Windows Azure Pack does not properly sanitize user-provided input, aka "Windows Azure Pack Cross Site Scripting Vulnerability." This affects Windows Azure Pack Rollup 13.1.
CVE-2018-8617
PUBLISHED: 2018-12-12
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8583, CVE-2018-8...
CVE-2018-8618
PUBLISHED: 2018-12-12
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8583, CVE-2018-8...
CVE-2018-8619
PUBLISHED: 2018-12-12
A remote code execution vulnerability exists when the Internet Explorer VBScript execution policy does not properly restrict VBScript under specific conditions, aka "Internet Explorer Remote Code Execution Vulnerability." This affects Internet Explorer 9, Internet Explorer 11, Internet Exp...