Chinese government was behind cyber attacks

Bill Gertz:

The cyber-attack on Google and other U.S. companies was part of a suspected Chinese government operation launched last year that used human intelligence techniques and high-technology to steal corporate secrets, according to U.S. government and private-sector cybersecurity specialists.

More worrying, however, is the likelihood that the cyber-attacks that led Google this week to end its cooperation with Beijing-controlled censorship and move its search engine service to Hong Kong included planting undetectable software on American company networks that could allow further clandestine access or even total control of computers in the future.

An Obama administration official said the U.S. government was able, with some confidence, to link the attack, first discovered last summer, to Chinese government organs. However, the official declined to provide details to avoid making future Chinese cyber-attack identification more difficult.

"The attack was very targeted. It targeted engineers and quality assurance developers, people with very high levels of access into the organization," said George Kurtz, chief technology officer for computer security firm McAfee who investigated the attack for several of the affected companies.

...

Investigators traced the beginning of the attack to the discovery by the hackers of a previously unknown software flaw in the widely used Web browser Internet Explorer 6.0.

Once the software hole was identified, the attackers spent months gathering information on company executives who had high-level access to company data, such as source code and advanced research and development efforts.

Then using personal data gathered on the company officials from social networking sites such as Facebook, Twitter, LinkedIn and MySpace, the attackers sent e-mails or instant messages containing links to a pirated computer server in Taiwan that appeared to be from someone whom the company official knew and mistakenly trusted.

Once at the Taiwan server, the victimized computer automatically downloaded a software "payload" that covertly installed and created a virtual trap door or Trojan in the computer.

The combination of the Internet Explorer hole and the trap-door software were the keys that allowed the attackers to take over the computer, masquerade as a high-level trusted user and gain access and steal information normally available to only a handful of company specialists.

Another sign leading investigators to conclude that the operation was state-sponsored hacking was the fact that each of the companies was targeted differently, using software developed from the attackers' knowledge of individual networks and information storage devices, operating systems, the location of targeted data, how it was protected and who had access to it.

Google eventually learned of the attack when a Chinese human rights activist based in New York alerted the company that his e-mail account was being accessed by him in New York and an unknown user who was traced to Taiwan.

...

Gary Elliott, a Virginia-based information assurance and cyberwarfare specialist, said the techniques and methods used for the cyber-attack convinced him that the most likely source was either China's intelligence services or its military. He said China was known to have at least 2,000 cyberwarriors working on defensive and offensive operations several years ago.

"The very high level of hacker sophistication in these exploits, along with the 30 or so very well-thought-out and coordinated attacks against American companies, leads me to believe that there are very few places in the world that are capable of performing this type of cyberwarfare," Mr. Elliott said. "There was a large government military or intelligence agency behind this."

Mr. Elliott said operations like Aurora take months or even years to plan and require mapping technical infrastructures of the targeted companies, a capability the Russian mafia, which is known to be a formidable nongovernment cyberthreat, could not perform.

...

There is more.

China has claimed that these attacks are illegal in China, but it has taken no action to stop them which suggest the government is behind them. By losing Google, China has paid a high price for its misconduct, It will have a difficult time restoring trust.

The Washington Post reports that Western countries are beginning to push back openly against China as a result of these attacks.