Attacks/Breaches

4/19/2011
12:37 PM
50%
50%

Leaked Cables Indicate Chinese Military Hackers Attacked U.S.

U.S. authorities have reportedly traced the "Byzantine Hades" spear-phishing attacks to specific Chinese military groups.

According to secret government cables, the Chinese military has been launching massive numbers of spear-phishing attacks against U.S. government agencies and companies. In the cables, U.S. government officials assert that these China-driven attacks, which they've dubbed "Byzantine Hades," have been occurring since at least 2002.

"The attacks coming out of China are not only continuing, they are accelerating," Alan Paller, director of research at the SANS Institute, told Reuters, which has obtained a new batch of cables--from WikiLeaks, via a third party--that it said provide even more evidence that China is behind many of these attacks. An April 2009 cable, it said, "even pinpoints the attacks to a specific unit of China's People's Liberation Army," based on tracing the website from which the attacks originated. The site was registered to the exact postal code where one of the Chinese army's electronic espionage units is headquartered, in the city of Chengdu.

According to secret U.S. government cables from 2008, released in December 2010 by WikiLeaks, government agencies have been targeted with social engineering attacks--spear phishing--since late 2002 by "Byzantine Candor," which is the government's code name for a subset of Byzantine Hades.

"Intruders have relied on techniques including exploiting Windows system vulnerabilities and stealing login credentials to gain access to hundreds of [U.S. government] and cleared defense contractor systems over the years," according to the 2008 cables. "The intruders then install malware such as customized keystroke-logging software and command-and-control utilities onto the compromised systems and exfiltrate massive amounts of sensitive data from the networks."

These Chinese attacks have reportedly stolen terabytes of data, including government login IDs, passwords, as well as blueprints for sensitive military systems, such as the quiet electric drive used by U.S. submarines to help evade detection.

The volume of attacks is such that "we have given up on the idea we can keep our networks pristine," Stewart Baker, a former senior cyber-security official at the U.S. Department of Homeland Security and National Security Agency, told Reuters.

The cables, new and old, provide more evidence that Chinese hackers--perhaps government-backed--have been launching large numbers of attacks against U.S. government agencies and businesses. The most notable of those attacks was arguably Operation Aurora, which targeted Google and some 33 other companies.

Google was compromised via targeted phishing attacks--aka spear phishing--that employ fake but personalized emails to trick people into visiting malicious websites or executing email attachments, which then attempt to exploit known vulnerabilities on the user's computer, giving attackers full control over it, and its contents.

Security experts say that the majority of attacks emanating from China still employ spear-phishing. As evidenced by the recent hacks of Epsilon and EMC's RSA--neither attack has been linked to China--spear-phishing attacks remain quite effective and difficult to block.

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
More Than Half of Users Reuse Passwords
Curtis Franklin Jr., Senior Editor at Dark Reading,  5/24/2018
Is Threat Intelligence Garbage?
Chris McDaniels, Chief Information Security Officer of Mosaic451,  5/23/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-11506
PUBLISHED: 2018-05-28
The sr_do_ioctl function in drivers/scsi/sr_ioctl.c in the Linux kernel through 4.16.12 allows local users to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact because sense buffers have different sizes at the CDROM layer and the SCSI layer.
CVE-2018-11507
PUBLISHED: 2018-05-28
An issue was discovered in Free Lossless Image Format (FLIF) 0.3. An attacker can trigger a long loop in image_load_pnm in image/image-pnm.cpp.
CVE-2018-11505
PUBLISHED: 2018-05-26
The Werewolf Online application 0.8.8 for Android allows attackers to discover the Firebase token by reading logcat output.
CVE-2018-6409
PUBLISHED: 2018-05-26
An issue was discovered in Appnitro MachForm before 4.2.3. The module in charge of serving stored files gets the path from the database. Modifying the name of the file to serve on the corresponding ap_form table leads to a path traversal vulnerability via the download.php q parameter.
CVE-2018-6410
PUBLISHED: 2018-05-26
An issue was discovered in Appnitro MachForm before 4.2.3. There is a download.php SQL injection via the q parameter.