{"id":17268,"date":"2013-03-01T10:00:40","date_gmt":"2013-03-01T16:00:40","guid":{"rendered":"http:\/\/techcitement.com\/?p=17268"},"modified":"2013-03-01T03:13:08","modified_gmt":"2013-03-01T09:13:08","slug":"11-things-to-know-about-the-chinese-hacking-scandal","status":"publish","type":"post","link":"https:\/\/techcitement.com\/culture\/politics\/11-things-to-know-about-the-chinese-hacking-scandal\/","title":{"rendered":"11 Things To Know About The Chinese Hacking Scandal"},"content":{"rendered":"<p>Some of us wonder about the future. We wonder what the future would be like if written by our favorite authors: William Gibson, Iain Banks, Jules Verne. The more cautious and knowledgeable warn against living in the worlds of Clive Barker, Jeff Noon, and Stephen King. Others argue about the dangers of Aldous Huxley and George Orwell. What now seems to be the case is that we are living in the world of Tom Clancy and club-fingered gun fetishist Skip Woods.<\/p>\n<p>It&#8217;s been revealed by the <em>New York Times<\/em> that America is under attack! By no less than the Chinese Army operating out an anonymous twelve-story building in a rundown unassuming suburb of Shanghai, Pudong. Luckily, Jason Bourne is on the case.<\/p>\n<p>Except, there is no Jason Bourne. The U.S. government &#8212; despite investing billions into various spook shows, drone surveillance, and DAARPA projects &#8212; seem to have no clue how to counter this attack, let alone admit it&#8217;s even going on. While President Obama hinted at the breach in his State of the Union address recently, these hackers have been targeting the products of years of outsourcing and widening circles of supply chains.<b id=\"internal-source-marker_0.6411664376500994\"> <\/b><\/p>\n<p><iframe loading=\"lazy\" src=\"http:\/\/www.youtube.com\/embed\/FhsU85fDmTc\" height=\"323\" width=\"575\" allowfullscreen=\"\" frameborder=\"0\"><\/iframe><\/p>\n<p style=\"text-align: center;\"><a href=\"https:\/\/techcitement.com?attachment_id=17271\" rel=\"attachment wp-att-17271\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-17271     aligncenter\" alt=\"New-York-Times-office\" src=\"https:\/\/techcitement.comadmin\/wp-content\/uploads\/2013\/02\/New-York-Times-office.gif\" width=\"575\" height=\"377\" \/><\/a><\/p>\n<h3 style=\"text-align: left;\">Issue Potentially Caused By The <em>New York Times<\/em>\u2019s Sloppy Reporting<\/h3>\n<p>On October 25 of last year, the <em>New York Times <\/em> ran <a href=\"http:\/\/www.nytimes.com\/2012\/10\/26\/business\/global\/family-of-wen-jiabao-holds-a-hidden-fortune-in-china.html\">a lengthy, front-loaded article<\/a> by David Barboza accusing the Chinese Prime Minister, Wen Jaibao, of potentially using his family as catspaws to amass a gigantic fortune. The following day, the <em>NYT<\/em> had its site blocked in China.<\/p>\n<p>Similarly, Bloomberg published <a href=\"http:\/\/www.bloomberg.com\/news\/2012-06-29\/xi-jinping-millionaire-relations-reveal-fortunes-of-elite.html\">an article on June 29 of 2012<\/a> describing the wealth accumulated by the family of Vice President Xi Jinping, who&#8217;s expected to become the country\u2019s next top leader as general secretary of the Communist Party during the coming Party Congress in March. Since then, Bloomberg has also had its site blocked in China.<\/p>\n<h3>But, No, Not Really<\/h3>\n<p>On January 30, the <em>NYT<\/em> <a href=\"http:\/\/www.nytimes.com\/2013\/01\/31\/technology\/chinese-hackers-infiltrate-new-york-times-computers.html\">reported that Chinese hackers<\/a> had been infiltrating its servers for the previous four months &#8212; since the story on Wen Jaibao had run the previous October &#8212; scraping corporate passwords of every one of its employees, breaking into the PCs of 53 of those workers. These hackers also infiltrated the email accounts of a couple of reporters who cover China, including David Barboza. <em>Bloomberg News<\/em> shortly followed suit in fessing up to having been compromised on January 31, with the <em>Washington Post<\/em> finally admitting its servers had also been compromised in 2012, following four years of attempts, on February 2.<\/p>\n<p>Since 2008, Chinese hackers began targeting American news organizations as part of an effort to monitor coverage of Chinese issues (as opposed to paying for subscriptions like everybody else).<\/p>\n<p>In a November 2011 intelligence report, government officials specifically accused China and Russia of stealing intellectual property for economic gain.<\/p>\n<h3>Who Da Mandiant?<\/h3>\n<p>The hacking story blew up on February 27, when Mandiant, a reclusive security company, decided to blow the whistle and give its findings to the <em>New York Times<\/em>.<\/p>\n<p>A highly detailed <a href=\"http:\/\/www.mandiant.com\/apt1\">60-page study<\/a> released by Mandiant tracked individual members of the most sophisticated of the Chinese hacking groups \u2014 known to many of its victims in the United States as &#8220;Comment Crew&#8221;. Over the course of several investigations, Mandiant found evidence that Chinese hackers had stolen emails, contacts, and files from more than 30 journalists and executives at Western news organizations and had maintained a &#8220;short list&#8221; of journalists for repeated attacks.<\/p>\n<p>Mandiant provided an advance copy of its report to the <em>New York Times<\/em>, saying it hoped to \u201cbring visibility to the issues addressed in the report.\u201d<\/p>\n<p>Kevin Mandia, founder and chief executive of Mandiant, told the\u00a0<em>New York Times<\/em> that:<\/p>\n<blockquote><p>Either they are coming from inside Unit 61398 or the people who run the most-controlled, most-monitored Internet networks in the world are clueless about thousands of people generating attacks from this one neighborhood.<\/p><\/blockquote>\n<p><!--nextpage--><\/p>\n<h3>The Coca-Cola Connection<\/h3>\n<p>A \u00a02009 attack on Coca-Cola coincided with a failed attempt to acquire the China Huiyuan Juice Group for $2.4 billion. As Coca-Cola executives were negotiating what would have been the largest purchase of a Chinese company to leverage greater market share in Asia, the Comment Crew was busy rummaging through Coke&#8217;s computers in an apparent effort to learn more about the company\u2019s negotiation strategy.<\/p>\n<p>In 2011, a similar attack happened to <a href=\"http:\/\/www.emc.com\/domains\/rsa\/index.htm\">RSA<\/a>, the computer security company best known for its SecurID token carried by employees at United States intelligence agencies, military contractors, and many major financial companies.<\/p>\n<p>Other victims have included the Chertoff Group, headed by the former secretary of the Department of Homeland Security, Michael Chertoff. Attacks have been made on a contractor for the National Geospatial-Intelligence Agency and the National Electrical Manufacturers Association, a lobbying group that represents companies that make components for power grids.<\/p>\n<p>One potentially messy target was the Canadian arm of Telvent, who designs software that gives oil and gas pipeline companies and power grid operators remote access to valves, switches, and security systems. Telvent keeps detailed blueprints on more than 60 percent of the oil and gas pipelines in North and South America, and the company has remote access to the systems.<\/p>\n<p>\u201cWe have seen over the last years an increase in not only the hacking attempts on government institutions but also non-governmental ones,\u201d <a href=\"http:\/\/www.nytimes.com\/2013\/02\/01\/technology\/wall-street-journal-reports-attack-by-china-hackers.html\">said Hilary Clinton in response to this information<\/a>. Clinton added that the Chinese \u201care not the only people who are hacking us.\u201d<\/p>\n<div id=\"attachment_17270\" style=\"width: 585px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/techcitement.com?attachment_id=17270\" rel=\"attachment wp-att-17270\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-17270\" class=\" wp-image-17270     \" alt=\"Where the magic happens.\" src=\"https:\/\/techcitement.comadmin\/wp-content\/uploads\/2013\/02\/an20130220a2a.jpg\" width=\"575\" height=\"390\" \/><\/a><p id=\"caption-attachment-17270\" class=\"wp-caption-text\">Where the magic happens.<\/p><\/div>\n<h3 style=\"text-align: left;\">Where?<\/h3>\n<p>On the outskirts of Shanghai, in Pudong, along the east side of the Huangpu River across from Puxi, off the Datong Road, sits a large, twelve-story white office building amidst a three-acre compound surrounded by small businesses and nondescript apartment complexes. Recently, a BBC news crew tried to film outside and were summarily arrested.<\/p>\n<p>The Comment Crew has been tracked to an inauspicious apartment building located 600 meters away. One hacker was tracked back to the People\u2019s Liberation Army\u2019s Information Engineering University, described by American computer security researchers as one of the Chinese military\u2019s top training schools for computer hacking. Recruitment notices have also been found for Unit 61398.<\/p>\n<h3>P.L.A. Unit 61398, That\u2019s My Number<\/h3>\n<div id=\"attachment_17272\" style=\"width: 585px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/techcitement.com?attachment_id=17272\" rel=\"attachment wp-att-17272\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-17272\" class=\"wp-image-17272  \" alt=\"You can see my house from here...\" src=\"https:\/\/techcitement.comadmin\/wp-content\/uploads\/2013\/02\/pict10.jpg\" width=\"575\" height=\"391\" \/><\/a><p id=\"caption-attachment-17272\" class=\"wp-caption-text\">You can see my house from here.<\/p><\/div>\n<p style=\"text-align: left;\">Unit 61398 \u2014 formally, the second Bureau of the People\u2019s Liberation Army\u2019s General Staff Department\u2019s third department \u2014 exists almost nowhere in official Chinese military descriptions. Yet intelligence analysts who have studied the group say it&#8217;s the central element of Chinese computer espionage. The unit was described in 2011 as the \u201cpremier entity targeting the United States and Canada, most likely focusing on political, economic, and military-related intelligence\u201d by the <a href=\"Project 2049 Institute\">Project 2049 Institute<\/a>, a non-governmental organization in Virginia that studies security and policy issues in Asia.<\/p>\n<p>Set up around 2002, the unit started recruiting heavily in 2003 from universities around China.<\/p>\n<div id=\"attachment_17275\" style=\"width: 618px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/techcitement.com?attachment_id=17275\" rel=\"attachment wp-att-17275\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-17275\" class=\" wp-image-17275 \" alt=\"Worst Craigslist hookup - ever.\" src=\"https:\/\/techcitement.comadmin\/wp-content\/uploads\/2013\/02\/screen-shot-2013-02-20-at-12.38.55-pm.png\" width=\"608\" height=\"344\" \/><\/a><p id=\"caption-attachment-17275\" class=\"wp-caption-text\">Worst Craigslist hookup &#8211; ever.<\/p><\/div>\n<p style=\"text-align: left;\">Translation:<\/p>\n<blockquote>\n<p style=\"text-align: left;\">The Graduate School has received notice that Unit 61398 of China\u2019s People\u2019s Liberation Army (located in Pudong District, Shanghai) seeks to recruit 2003-class computer science graduate students. Students who sign the service contract will receive a 5,000 yuan per year National Defense Scholarship. After graduation, students will work in the unit.<\/p>\n<p style=\"text-align: left;\">Interested Zhejiang University 2003-class graduate students should please contact Teacher Peng in the Graduate Division before May 20. (Cao Guangbiao room 108; phone: 87952168)<br \/>\nGraduate Division<br \/>\nMay 13, 2004<\/p>\n<\/blockquote>\n<p>The first suspicious activities were detected around 2006 by Symantec. Attacks often involved spear-phishing emails with such subject lines as &#8220;U.S. Stocks Reverse Loss as Consumer Staples, Energy Gain.zip&#8221; and &#8220;New contact sheet of the AN-UYQ-100 contractors.pdf.&#8221;<\/p>\n<p>The Mandiant report, however, didn&#8217;t break any new ground in the Comment Crew discussion.<\/p>\n<p>&#8220;There really wasn&#8217;t much new that came out of that Mandiant report, except for them identifying a specific building and putting all these details on that in there,&#8221; <a href=\"http:\/\/www.informationweek.com\/security\/attacks\/china-denies-us-hacking-accusations-6-fa\/240149058\">said former Gartner Group analyst John Pescatore<\/a>.<\/p>\n<p>While the Obama administration has never publicly discussed the Chinese unit\u2019s activities, a secret State Department cable written the day before Barack Obama was elected president in November 2008 described at length American concerns about the group\u2019s attacks on government sites. (At the time, American intelligence agencies called the unit \u201cByzantine Candor\u201d, a code word dropped after the cable was published by WikiLeaks.)<br \/>\n<!--nextpage--><\/p>\n<h3>Watching The Defectives<\/h3>\n<p>Comment Crew are so named for the attackers\u2019 penchant for embedding hidden code or comments into webpages. Based on the digital crumbs the group left behind, its attackers have been known to use the same malware, web domains, internet protocol addresses, hacking tools, and techniques across attacks.<\/p>\n<p>\u201cBut those are only the ones we could easily identify,\u201d said Mr. Mandia to the\u00a0<em>New York Times.<\/em><\/p>\n<p>Other security experts estimate that the group is responsible for thousands of attacks. Mandiant discovered that two sets of IP addresses used in the attacks were registered in the same neighborhood as Unit 61398\u2019s building.<\/p>\n<p>\u201cIt\u2019s where more than 90 percent of the attacks we followed come from,\u201d said Mr. Mandia.<\/p>\n<p>The only other possibility, the report concludes with a touch of sarcasm, is that \u201ca secret, resourced organization full of mainland Chinese speakers with direct access to Shanghai-based telecommunications infrastructure is engaged in a multiyear enterprise-scale computer espionage campaign right outside of Unit 61398\u2019s gates.\u201d<\/p>\n<p>One of the most visible hackers followed is UglyGorilla, who first appeared on a Chinese military forum in January 2004, asking whether China has a \u201csimilar force\u201d to the \u201ccyber army\u201d being set up by the American military. By 2007, UglyGorilla was turning out a suite of malware with what the report called a \u201cclearly identifiable signature.\u201d Another hacker, called DotA by Mandiant, created email accounts used to plant malware. That hacker was tracked frequently using a password that appeared to be based on his military unit\u2019s designation. DotA and UglyGorilla both used the same IP addresses linked back to Unit 61398\u2019s neighborhood.<\/p>\n<p>Mandiant discovered several cases in which attackers logged into their Facebook and Twitter accounts to get around China\u2019s firewall that blocks ordinary citizen\u2019s access, making it easier to track down their real identities.<\/p>\n<h3>Byzantine Candor<\/h3>\n<p>This has all been brewing up over the last decade. What we\u2019re seeing here is a growing counter to many intelligence groups established by America, and countless other countries, that has become big enough or cocky enough to become sloppy and exposed. The Comment Crew could have easily become a tool of power factions in the Chinese political system to be thrown under the bus of international relations to discredit the likes of reformists like Wen Jaibao. Symantec has been tracking the hackers for over six years with no headlines, after all.<\/p>\n<p><em>Bloomberg<\/em> <a href=\"http:\/\/www.bloomberg.com\/news\/2012-07-26\/china-hackers-hit-eu-point-man-and-d-c-with-byzantine-candor.html\">ran a piece about them last July<\/a>\u00a0complete with timeline, without all the Chicken Little screeching and wailing that the <em>New York Times<\/em>\u2019s piece has caused. The rather specifically-named <a href=\"http:\/\/www.fiercegovernmentit.com\/story\/chinese-attacks-byzantine-candor-penetrated-federal-agencies-says-leaked-ca\/2010-12-06\"><em>FierceGovernmentIT<\/em> reported on Byzantine Candor in December of 2010<\/a>.<\/p>\n<div id=\"attachment_17269\" style=\"width: 585px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/techcitement.comadmin\/wp-content\/uploads\/2013\/02\/scopebyzantinecandor.png\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-17269\" class=\" wp-image-17269  \" alt=\"Image source: Bloomberg News\" src=\"https:\/\/techcitement.comadmin\/wp-content\/uploads\/2013\/02\/scopebyzantinecandor.png\" width=\"575\" height=\"237\" \/><\/a><p id=\"caption-attachment-17269\" class=\"wp-caption-text\">Graph by <a href=\"http:\/\/analysisintelligence.com\/tag\/chinese-hacking\/\">Analysis Intelligence<\/a><\/p><\/div>\n<p style=\"text-align: center;\">\n<p style=\"text-align: left;\">Shawn Henry, former executive assistant director of the FBI in charge of the agency\u2019s cyber division, told <em>Bloomberg:<\/em><\/p>\n<blockquote>\n<p style=\"text-align: left;\">What the general public hears about &#8212; stolen credit card numbers, somebody hacked LinkedIn \u00a0&#8211; that\u2019s the tip of the iceberg, the unclassified stuff. I\u2019ve been circling the iceberg in a submarine. This is the biggest vacuuming up of U.S. proprietary data that we\u2019ve ever seen. It\u2019s a machine.<\/p>\n<\/blockquote>\n<h3>China\u2019s Response<\/h3>\n<p>Following the January 30 <em>New York Times<\/em> article, officials at the Chinese embassy in Washington insisted that their government doesn&#8217;t engage in computer hacking and that such activity is illegal. The Chinese officials describe China itself as a victim of computer hacking and accurately point out that there are many hacking groups inside the United States.<\/p>\n<p>The following day, the Chinese Ministry of Foreign Affairs\u00a0 said that the allegations were \u2018\u2018unprofessional.\u2019\u2019<\/p>\n<p>Hong Lei, a ministry spokesman, said:<\/p>\n<blockquote><p>Making unfounded accusations based on preliminary results is both irresponsible and unprofessional, and is not helpful for the resolution of the relevant problem. China resolutely opposes hacking actions and has established relevant laws and regulations and taken strict law enforcement measures to defend against online hacking activities.<\/p><\/blockquote>\n<p>&#8220;The Defense Ministry and China Military Online websites have faced a serious threat from hacking attacks since they were established,&#8221; Defense Ministry spokesman Geng Yansheng is quoted by Reuters news agency as saying at a monthly press conference.<\/p>\n<p>&#8220;Like other countries, China faces a serious threat from hacking and is one of the primary victims of hacking in the world,&#8221; Geng said. &#8220;Numbers of attacks have been on the rise in recent years.&#8221;<\/p>\n<p>Geng said that 144,000 such attacks occurred each month last year and that an analysis of the IP addresses showed that 62.9 percent of them came from the U.S.<\/p>\n<p>&#8220;We hope that the U.S. side can explain and clarify this,&#8221; Geng said, \u201cbut we do not point fingers at the U.S. based on the aforementioned findings, and every country should deal with cyber security in a professional and responsible manner.\u201d<\/p>\n<h3>But America Did It First<\/h3>\n<div id=\"attachment_17276\" style=\"width: 585px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/techcitement.com?attachment_id=17276\" rel=\"attachment wp-att-17276\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-17276\" class=\" wp-image-17276 \" alt=\"Iran leads the world in green-screen technology.\" src=\"https:\/\/techcitement.comadmin\/wp-content\/uploads\/2013\/02\/111610-tehran-natanz-ahmadinejad-stuxnet_full_600.jpg\" width=\"575\" height=\"375\" \/><\/a><p id=\"caption-attachment-17276\" class=\"wp-caption-text\">Iran leads the world in green-screen technology.<\/p><\/div>\n<p style=\"text-align: left;\">\n<p style=\"text-align: left;\">The United States government also has cyberwarriors. Working with Israel, the United States has used malicious software called <a href=\"http:\/\/topics.nytimes.com\/top\/reference\/timestopics\/subjects\/c\/computer_malware\/stuxnet\/index.html?inline=nyt-classifier\">Stuxnet<\/a> to disrupt Iran\u2019s uranium enrichment program. Government officials insist they operate under strict, if classified, rules that bar using offensive weapons for non-military purposes or stealing corporate data.<\/p>\n<h3>America\u2019s Response<\/h3>\n<p>The United States government is planning to begin a more aggressive defense against Chinese hacking groups. Under a directive signed by President Obama last week, the government plans to share with American Internet providers information it has gathered about the unique digital signatures of the largest of the groups, including Comment Crew and others emanating from near where Unit 61398 is based.<\/p>\n<p>Government warnings won&#8217;t explicitly link those groups, or the giant computer servers they use, to the Chinese army. The question of whether to publicly name the unit and accuse it of widespread theft is the subject of ongoing debate.<\/p>\n<p>President Obama alluded to this concern in his State of the Union speech.<\/p>\n<blockquote><p>We know foreign countries and companies swipe our corporate secrets. Now our enemies are also seeking the ability to sabotage our power grid, our financial institutions, our air-traffic control systems. We cannot look back years from now and wonder why we did nothing.<b id=\"internal-source-marker_0.7660110932774842\"><br \/>\n<\/b><\/p><\/blockquote>\n","protected":false},"excerpt":{"rendered":"<p>Some of us wonder about the future. We wonder what the future would be like if written by our favorite authors: William Gibson, Iain Banks, Jules Verne. The more cautious and knowledgeable warn against living in the worlds of Clive Barker, Jeff Noon, and Stephen King. Others argue about the dangers of Aldous Huxley and [&hellip;]<\/p>\n","protected":false},"author":32,"featured_media":17277,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[905,1920,730],"tags":[2950,3029,4091,4092,3,2479,219,4093,2032,304,2746,2046],"_links":{"self":[{"href":"https:\/\/techcitement.com\/wp-json\/wp\/v2\/posts\/17268"}],"collection":[{"href":"https:\/\/techcitement.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/techcitement.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/techcitement.com\/wp-json\/wp\/v2\/users\/32"}],"replies":[{"embeddable":true,"href":"https:\/\/techcitement.com\/wp-json\/wp\/v2\/comments?post=17268"}],"version-history":[{"count":4,"href":"https:\/\/techcitement.com\/wp-json\/wp\/v2\/posts\/17268\/revisions"}],"predecessor-version":[{"id":17280,"href":"https:\/\/techcitement.com\/wp-json\/wp\/v2\/posts\/17268\/revisions\/17280"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/techcitement.com\/wp-json\/wp\/v2\/media\/17277"}],"wp:attachment":[{"href":"https:\/\/techcitement.com\/wp-json\/wp\/v2\/media?parent=17268"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/techcitement.com\/wp-json\/wp\/v2\/categories?post=17268"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/techcitement.com\/wp-json\/wp\/v2\/tags?post=17268"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}