Experts suggest that Chinese government routinely employs 'vast army of hackers' to carry out covert spying campaigns
Chinese officials have denied the allegations, which prompted skepticism from Times executives who devoted weeks to tracking the move. Photograph: Justin Lane/EPA
Revelations that China apparently targeted the New York Times in a campaign of cyber-espionage have cast a rare spotlight on attempts by Beijing to crack down on any criticism of its ruling elite.
The move, which was detected and then monitored by the Times's digital staff, is believed to have been linked to the newspaper's hard-hitting October exposé on the vast wealth accumulated by the family of leading communist and outgoing premier Wen Jiabao.
Government officials in Beijing have vehemently denied the allegations, though that has prompted scepticism among New York Times executives who devoted long weeks to tracking, checking and ultimately exposing the move.
"This is business-as-usual from what we can tell for aspects of the Chinese government," said Marc Frons, head of the newspaper's digital technology and its chief information officer. Frons told The Guardian that the paper was expecting further such attempts to infiltrate its computer systems. "It is really spy versus spy," he said. "I don't think we can relax. I am pretty sure that they will be back."
The hackers gained entry to the newspaper's internal systems and accessed the personal computers of 53 employees including David Barboza, its Shanghai bureau chief and author of the Wen exposé, and Jim Yardley, a former Beijing bureau chief.
An investigation by Mandiant, a cyber-security company hired by the New York Times, concluded that the hacks were likely part of an elaborate spy campaign with links to the country's military. The company traced the source of the attacks to university computers that the "Chinese military had used to attack United States Military contractors in the past", the Times said.
Although the hackers gained passwords for every Times employee, Mandiant found that they only sought information that was related to the Wen story. "They were after David Barboza's source list; confidential names and numbers and looking to find out who he was talking to," said Frons.
The Times said it worked with telecommunications company AT&T and the FBI to trace the hackers after AT&T noticed suspicious activity on the paper's computer networks on 25 October, one day after the article appeared in print. A later analysis concluded that hackers initially broke into Times computers on 13 September when reporting for the Wen story was in its final pre-publishing stages.
Instead of immediately going public, however, the Times took the decision to watch the hackers and see what they were after, though it took steps to isolate vital commercial information, such as reader email addresses and subscriber information, behind security walls. "We let them play in our environment so that we could watch what tools they were using and watch what they were doing," Frons said.
The Wall Street Journal said on Thursday that its computer systems had also been been infiltrated by Chinese hackers trying to monitor the newspaper's coverage of China.
Despite the vociferous denials the exposure of the hacking is likely to be a source of public embarrassment to Beijing. Yet it is unlikely to blunt its extensive activities when it comes to conducting cyber warfare. Experts say the contours of a Chinese cyber attack have become familiar. They begin with slightly malfunctioning computer networks, usually at the headquarters of a military contractor, government office or multinational internet company. Sensitive files might go missing; servers may crash.
While the attack's surreptitious nature allows Chinese authorities to hide behind a veneer of deniability, security firms have discovered a number of uncanny similarities among such incidents. Most targeted groups could pose some threat to the Chinese government. They include American military contractors, Tibetan and Uyghur independence groups, activist networks, and lately, western media organizations. Bloomberg was hacked after publishing a similar exposé last summer.
According to the UK-based cyber-security researcher Greg Walton, western experts know a fair amount about Chinese hackers' methods – their "tools, techniques and procedures," in information technology parlance. "But we know very little about the people behind these machines," he said. "If we want to tackle a problem of such complexity, and of such danger to civil society networks transnationally, were going to have to do a tremendous amount of research into the people behind these programs."
Cyber security companies suggest that the Chinese government and military employ a vast army of hackers, carrying out a covert spy campaign against organizations that it feels run counter to their interests. They operate in places like Shanghai and coastal Shandong Province, but usually avoid detection by tunnelling through easily-infiltrated computers at servers and universities in the United States. The New York Times investigation found that they typically begin working at 8am and adhere to a standard office schedule.
Their organizational structure is still unclear – the hackers could be on the People's Liberation Army's payroll, or just as easily be loosely-affiliated vigilante organizations operating with tacit government approval, like renegade consulting companies.
"If anything, the fact that these groups aren't being run by the Chinese government makes the problem worse," Bruce Schneier, a cybersecurity expert at a telecommunications company in London, wrote on theDiscovery Channel's tech blog last year. "Without central political coordination, they're likely to take more risks, do more stupid things and generally ignore the political fallout of their actions."
The hackers frequently use a technique called "spear phishing," in which they send a piece of malware to a target via email; the hapless user may then download malicious files by clicking on a seemingly innocuous attachment. Chinese hackers have used this technique to compromise the Gmail accounts of senior US, South Korean and Australian government officials, and have attempted to access the White House's Military Office, home to the US's nuclear launch codes.
In November, Bloomberg reported that a Silicon Valley-based software engineer was hacked shortly after filing a civil lawsuit against Chinese authorities. The firm spent months under digital siege – hackers shut down its web servers, gained access to confidential files, and spied on an employee with her own webcam.
The intrusions drove the company to the brink of bankruptcy. "If they could just put the company out of business, the lawsuit goes away," the engineer told Bloomberg. "They didn't need guys with guns or someone to break my kneecaps."
No comments:
Post a Comment
Comments always welcome!