APT Attackers Hit Japan's Biggest Defense Contractor

Mitsubishi Heavy Industries became the latest high-profile target of cyberespionage -- driving home the reality that the advanced persistent threat (APT) isn't just a U.S. problem.

This isn't the first time a Japanese defense contractor has been hit by APT attackers -- it's just the first time such an attack has gone public, security experts say. News of the attack was first reported in the Japanese press and was then picked up by Reuters today.

According to a translated statement by Mitsubishi Heavy Industries, which builds submarines, missiles, and nuclear power components, the company first detected the intrusion in mid-August.

"We've found out that some system information such as IP addresses have been leaked and that's creepy enough," a spokesman for Mitsubishi Heavy is quoted as saying in a Reuters report. "We can't rule out small possibilities of further information leakage but so far crucial data about our products or technologies have been kept safe."

Some 80 machines were infected with malware at the firm's Tokyo headquarters and manufacturing and research and development facilities: Kobe Shipyard & Machinery Works, Nagasaki Shipyard & Machinery Works and Nagoya Guidance & Propulsion System Works were among the sites reported to have been infiltrated by attackers. Around eight different types of malware were detected on the various machines, the reports said.

Richard Bejtlich, chief security officer and vice president at Mandiant, says the Japanese have been working on an initiative to defend against APT-type attacks. "There's no doubt that Japan is worried about Chinese espionage … I understand that there's an initiative starting next year to help their industry resist those attacks," Bejtlich says.

While the attack on a high-profile industrial power in Japan isn't really a surprise, it confirms theories that these types of attacks are a global problem. "It's validation that this isn't simply a U.S. problem," Bejtlich says. "Hopefully, people [worldwide] will realize this isn't a manufactured threat, but it's a real problem and fairly widespread."

Mitsubishi Heavy Industries, meanwhile, said in a statement that network addresses might have been leaked and that it's still investigating the attack and the extent of the data exposure.

"I don't suppose we need another wake-up call, but this news leaves a disconcerting after-taste," says Will Irace, director of research for Fidelis. "There are some good technologies available to help advanced persistent defenders safeguard their enterprises. But it still feels like we're fighting blind because targeted companies are reluctant to come forward with details on how they were victimized."

Irace says he'd like victims to cooperate more closely to share information. "The deck is stacked against them: Strategy is going to be at least as important as technology if they're going to catch up," Irace says.

Mandiant's Bejtlich says while the Mitsubishi attack isn't likely to help spur more cooperation among victim organizations around the world, it could encourage some diplomatic cooperation. "At the diplomatic level, it makes a difference," he says. "It continues to point to the Chinese as doing something that is not considered to be responsible."

There's really no technical way to resolve the cyberespionage problem, he says, but it could be addressed at the national and diplomatic levels.

Meanwhile, details were scarce about how the attackers got in and how far they got. Adam Powers, chief technology officer for Lancope, says it appears Mitsubishi Heavy Industries relied too heavily on its perimeter security. "Many organizations place the bulk of their cyberdefense technology at the perimeter of the network. Unfortunately, once the attackers breach the perimeter defenses, it's easy to compromise additional unprotected resources behind the outer wall. Once the attackers have a persistent foothold within the network, detection and remediation can become very difficult," Powers says. "Given the scope of the attack on Mitsubishi Heavy Industries, it may be months before all of the breached resources are discovered."

Mitsubishi Heavy Industries had $3.4 billion in contracts with Japan's Ministry of Defence for the year as of March – one-fourth of the agency's spending for the year, according to Reuters. The company makes surface-to-air Patriot missiles and AIM-7 Sparrow air-to-air missiles, and manufactures wings for Boeing's 787 Dreamliner jet.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.