Attacks/Breaches
4/19/2011
12:37 PM
50%
50%

Leaked Cables Indicate Chinese Military Hackers Attacked U.S.

U.S. authorities have reportedly traced the "Byzantine Hades" spear-phishing attacks to specific Chinese military groups.

According to secret government cables, the Chinese military has been launching massive numbers of spear-phishing attacks against U.S. government agencies and companies. In the cables, U.S. government officials assert that these China-driven attacks, which they've dubbed "Byzantine Hades," have been occurring since at least 2002.

"The attacks coming out of China are not only continuing, they are accelerating," Alan Paller, director of research at the SANS Institute, told Reuters, which has obtained a new batch of cables--from WikiLeaks, via a third party--that it said provide even more evidence that China is behind many of these attacks. An April 2009 cable, it said, "even pinpoints the attacks to a specific unit of China's People's Liberation Army," based on tracing the website from which the attacks originated. The site was registered to the exact postal code where one of the Chinese army's electronic espionage units is headquartered, in the city of Chengdu.

According to secret U.S. government cables from 2008, released in December 2010 by WikiLeaks, government agencies have been targeted with social engineering attacks--spear phishing--since late 2002 by "Byzantine Candor," which is the government's code name for a subset of Byzantine Hades.

"Intruders have relied on techniques including exploiting Windows system vulnerabilities and stealing login credentials to gain access to hundreds of [U.S. government] and cleared defense contractor systems over the years," according to the 2008 cables. "The intruders then install malware such as customized keystroke-logging software and command-and-control utilities onto the compromised systems and exfiltrate massive amounts of sensitive data from the networks."

These Chinese attacks have reportedly stolen terabytes of data, including government login IDs, passwords, as well as blueprints for sensitive military systems, such as the quiet electric drive used by U.S. submarines to help evade detection.

The volume of attacks is such that "we have given up on the idea we can keep our networks pristine," Stewart Baker, a former senior cyber-security official at the U.S. Department of Homeland Security and National Security Agency, told Reuters.

The cables, new and old, provide more evidence that Chinese hackers--perhaps government-backed--have been launching large numbers of attacks against U.S. government agencies and businesses. The most notable of those attacks was arguably Operation Aurora, which targeted Google and some 33 other companies.

Google was compromised via targeted phishing attacks--aka spear phishing--that employ fake but personalized emails to trick people into visiting malicious websites or executing email attachments, which then attempt to exploit known vulnerabilities on the user's computer, giving attackers full control over it, and its contents.

Security experts say that the majority of attacks emanating from China still employ spear-phishing. As evidenced by the recent hacks of Epsilon and EMC's RSA--neither attack has been linked to China--spear-phishing attacks remain quite effective and difficult to block.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6501
Published: 2015-03-30
The default soap.wsdl_cache_dir setting in (1) php.ini-production and (2) php.ini-development in PHP through 5.6.7 specifies the /tmp directory, which makes it easier for local users to conduct WSDL injection attacks by creating a file under /tmp with a predictable filename that is used by the get_s...

CVE-2014-9652
Published: 2015-03-30
The mconvert function in softmagic.c in file before 5.21, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not properly handle a certain string-length field during a copy of a truncated version of a Pascal string, which might allow remote atta...

CVE-2014-9653
Published: 2015-03-30
readelf.c in file before 5.22, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not consider that pread calls sometimes read only a subset of the available data, which allows remote attackers to cause a denial of service (uninitialized memory ...

CVE-2014-9705
Published: 2015-03-30
Heap-based buffer overflow in the enchant_broker_request_dict function in ext/enchant/enchant.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allows remote attackers to execute arbitrary code via vectors that trigger creation of multiple dictionaries.

CVE-2014-9709
Published: 2015-03-30
The GetCode_ function in gd_gif_in.c in GD 2.1.1 and earlier, as used in PHP before 5.5.21 and 5.6.x before 5.6.5, allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted GIF image that is improperly handled by the gdImageCreateFromGif function.

Dark Reading Radio
Archived Dark Reading Radio
Good hackers--aka security researchers--are worried about the possible legal and professional ramifications of President Obama's new proposed crackdown on cyber criminals.