The U.S. Lags Behind China in Spotting Cyberthreats

In March, the Apache Software Foundation announced it had discovered a critical flaw in its software, one now famous as the unpatched Achilles’ heel of Equifax Inc. that allowed hackers to make off with sensitive information on 145 million Americans. We don’t yet know who got into Equifax, but we do know Chinese hackers looking to exploit the bug, and Chinese companies defending against attacks, had a head start. Details of the flaw were published to China’s National Vulnerability Database within a day of Apache’s announcement. It didn’t show up in the official U.S. database for three days. By then, researchers were already documenting a wave of global attacks exploiting the faulty code.

China’s advantage is usually much greater, according to research published on Oct. 19 by Recorded Future, a cybersecurity company. There’s an average 20-day gap between when China’s database publishes information on newly discovered bugs and when its U.S. equivalent does, based on 17,940 vulnerabilities added to both databases over the past two years, the analysis showed.