May 30, 2014
China Hacking Is Deep and Diverse, Experts Say
Danny Yadron, James T. Areddy and Paul Mozur
Wall Street Journal
China’s Internet espionage capabilities are deeper and more widely dispersed than the U.S. indictment of five army officers last week suggests, former top government officials say, extending to a sprawling hacking-industrial complex that shields the Chinese government but also sometimes backfires on Beijing.
Some of the most sophisticated intruders observed by U.S. officials and private-sector security firms work as hackers for hire and at makeshift defense contractors, not the government, and aren’t among those named in the indictment. In recent years, engineers from this crowd have broken into servers atGoogle Inc., Lockheed Martin Corp. and top cybersecurity companies, former U.S. officials and security researchers alleged.
The Chinese have often told their U.S. counterparts they don’t condone hacking but also that they can’t police what they don’t control, according to former U.S. officials. While it is possible Beijing makes this claim simply as an excuse for inaction—given its strict control of domestic Internet traffic—experts in the field, including former U.S. officials, say the Chinese hacking landscape is chaotic and hard to follow.
This structure brings “a political gain to being able to say ‘we can’t control all attacks,’ ” said Adam Segal, a China and cybersecurity scholar at the Council on Foreign Relations in New York. “But I think there is a cost when hackers go after targets that are too sensitive or get involved in a crisis and the government can’t control the signaling.”
Sometimes freelancers appear to take orders from the military, at other times from state-owned firms seeking a competitive advantage, U.S. security firms say. It remains unclear how exactly those orders are given, security researchers said.
This diffusion of China’s hacking activities underscores the challenge the U.S. faces in addressing what Washington considers economic espionage.
"Part of the consternation when we were pushing them was there is not complete knowledge of what’s going on," said a former U.S. official, recalling cyber negotiations with China.
Kevin Mandia, chief operating officer of FireEye Inc., FEYE +0.79% a cybersecurity firm, said some of the best hacks appear to be by one of several Chinese groups, which his colleagues refer to as “unknown.”
China sharply criticized last week’s indictments by the U.S. Justice Department, which included a People’s Liberation Army officer the U.S. identified as Wang Dong and who is known online as UglyGorilla. China categorically denied the accusations and suspended cybersecurity talks with the U.S.
A spokesman for China’s Ministry of National Defense on Tuesday likened the indictment to evidence of weapons of mass destruction produced by the U.S. before its 2003 invasion of Iraq.
"With its network technology and infrastructure, the U.S. has a unique superiority. It wouldn’t be difficult for them to fabricate evidence," said Geng Yansheng at the ministry’s monthly news conference. The ministry didn’t respond to requests for comment for this article.
China has previously sought to tighten the leash on its cyberwarriors. Four years ago, authorities arrested three people for running a “hacker training website” called Black Hawk Safety Net with over 170,000 members.
Some researchers say they suspect China’s government doesn’t necessarily know when its military personnel are using their high-tech systems for alleged illegal activity. In a 2011 report, Mark Stokes, executive director of the Virginia-based think tank Project 2049 Institute, referred to one such incident rumored among analysts. He said an inability by the PLA “to control intrusive cyber activities directed against foreign entities may indicate a profound weakness in the governance of China’s sprawling cyber-infrastructure.”
Today, much of China’s alleged state-sponsored hacking is conducted under the Third Department of the PLA’s General Staff Department, which operates on a mandate similar to, if broader than, the National Security Agency, researchers say.
The Shanghai men named in last week’s indictment are part of a group known in the hacking world as “Comment Crew,” which operates within the Third Department that monitors North America. The Third Department also runs cryptology and cyberdefense research groups, as well as satellite interception operations, and has resources such as super computers, according to reports by experts who track such activity.
Nongovernment hacking, however, has continued to flourish, with strategies and lines of code being traded in anonymous Internet bazaars. The U.S. indictment hinted at a private-public partnership. It alleged the Shanghai PLA unit that is home to the five indicted men was “hired” by unnamed government-owned firms to “provide information technology services,” meaning theft of U.S. corporate secrets.
A weakness of Army hackers is their ability or willingness to be identified, researchers say. Comment Crew is characterized by easily traceable electronic fingerprints like the repeated use of certain email addresses and nicknames. The indictment included photographs, full names, office address and working hours. None of the group could be reached for comment.
"If you know the name of the ninja, then obviously he’s not a great secret warrior," said Jason Healey, an expert on cybersecurity at the Atlantic Council in Washington.
Security researchers say they are more impressed with those known only by the fallout from their work. U.S. officials and researchers say they are tracking between 20 and 30 Chinese groups.
In 2009, an anonymous group researchers refer to as “Aurora” infiltrated the servers that run Google’s Gmail service and stole information from accounts. The hack was so stealthy the firm initially thought one of its employees was responsible, the former U.S. official said. A Google spokesman declined to comment.
Aurora is believed to include two teams totaling 10 to 15 members with university computer-sciences backgrounds, dispersed across various Chinese cities, said Darien Kindlund, director of threat research at FireEye.
In 2013, Mandiant, now a unit of FireEye, released its own report on Comment Crew. Much of that intelligence was contained in the U.S. indictment. Mr. Kindlund said he has files on several members Aurora but declined to release them. Because Aurora is made up of seemingly private citizens, “there is potential blowback” if the people he is monitoring aren’t actually working for the state, he said.
Since the Google intrusions, Aurora hacked into Lockheed Martin, the U.S. Labor Department, RSA, EMC EMC +0.79% Cop’s security unit and Bit9 Inc., a Massachusetts company with contracts to keep hackers out of some of the biggest U.S. firms and the U.S. government, according to people familiar with investigations into those intrusions.
Attribution in cyberspace isn’t an exact science and relies on spotting strings of code and matching online personas to real-world people. Regardless, “whoever these guys are, they’re pretty damn good,” Mr. Mandia said of Aurora.
No comments:
Post a Comment