Attacks/Breaches
1/13/2010
05:03 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Chinese Spy Agency Behind Google Cyber Attack, Report Claims

The cyber attacks that contributed to Google's reevaluation of its operations in China also hit 33 other companies.

In a blog post heard around the world, though muffled in China's state-controlled media, Google said on Tuesday that it and at least 20 other companies in the the Internet, finance, technology, media and chemical sectors had been targeted in a sophisticated cyber attack in December.

Due to this attack, which resulted in the theft of unspecified intellectual property, and a hostile business climate, Google said it would stop censoring Google.cn, a decision which could lead to the closure of the company's Chinese search service. Whether that happens will depend on how the Chinese government reacts.

U.S. Secretary of State Hillary Rodham Clinton on Tuesday expressed concern about Google's claims and asked the Chinese government for an explanation. She said she intended to give a speech next week "on the centrality of Internet freedom in the 21st century."

A report issued on Tuesday by iDefense, a computer security company owned by Verisign, states that 33 other companies were targeted in the attack. It also says that those responsible were working either directly on on behalf of official intelligence entities of the People's Republic of China.

"Two independent, anonymous iDefense sources in the defense contracting and intelligence consulting community confirmed that both the source IPs and drop server of the attack correspond to a single foreign entity consisting either of agents of the Chinese state or proxies thereof," the report says.

Eli Jellenc, head of international cyber intelligence at Verisign iDefense, stopped short of claiming that the attackers were formally employed by a Chinese intelligence agency.

"We can't determine whether the attackers themselves have 'intelligence agency' on their office door or are a paid proxy," he said.

Adobe on Tuesday said that it learned of "a sophisticated, coordinated attack against corporate network systems managed by Adobe and other companies" on January 2 and that it is investigating the incident. It said that it had no evidence that any sensitive information had been compromised.

Both Google and Adobe declined to provide further details about the attacks, stating that the incidents are still under investigation.

Internet Web hosting company Rackspace has confirmed that it was subject to attack, noting that no customer data was compromised or altered.

According to The Washington Post, Dow Chemical and Northrop Grumman may also have been targets of the attacks.

Other targets of the attack have yet to be publicly identified.

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-3304
Published: 2014-10-30
Directory traversal vulnerability in Dell EqualLogic PS4000 with firmware 6.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the default URI.

CVE-2013-7409
Published: 2014-10-30
Buffer overflow in ALLPlayer 5.6.2 through 5.8.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in a .m3u (playlist) file.

CVE-2014-3446
Published: 2014-10-30
SQL injection vulnerability in wcm/system/pages/admin/getnode.aspx in BSS Continuity CMS 4.2.22640.0 allows remote attackers to execute arbitrary SQL commands via the nodeid parameter.

CVE-2014-3584
Published: 2014-10-30
The SamlHeaderInHandler in Apache CXF before 2.6.11, 2.7.x before 2.7.8, and 3.0.x before 3.0.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted SAML token in the authorization header of a request to a JAX-RS service.

CVE-2014-3623
Published: 2014-10-30
Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vect...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.