12:37 PM

Leaked Cables Indicate Chinese Military Hackers Attacked U.S.

U.S. authorities have reportedly traced the "Byzantine Hades" spear-phishing attacks to specific Chinese military groups.

According to secret government cables, the Chinese military has been launching massive numbers of spear-phishing attacks against U.S. government agencies and companies. In the cables, U.S. government officials assert that these China-driven attacks, which they've dubbed "Byzantine Hades," have been occurring since at least 2002.

"The attacks coming out of China are not only continuing, they are accelerating," Alan Paller, director of research at the SANS Institute, told Reuters, which has obtained a new batch of cables--from WikiLeaks, via a third party--that it said provide even more evidence that China is behind many of these attacks. An April 2009 cable, it said, "even pinpoints the attacks to a specific unit of China's People's Liberation Army," based on tracing the website from which the attacks originated. The site was registered to the exact postal code where one of the Chinese army's electronic espionage units is headquartered, in the city of Chengdu.

According to secret U.S. government cables from 2008, released in December 2010 by WikiLeaks, government agencies have been targeted with social engineering attacks--spear phishing--since late 2002 by "Byzantine Candor," which is the government's code name for a subset of Byzantine Hades.

"Intruders have relied on techniques including exploiting Windows system vulnerabilities and stealing login credentials to gain access to hundreds of [U.S. government] and cleared defense contractor systems over the years," according to the 2008 cables. "The intruders then install malware such as customized keystroke-logging software and command-and-control utilities onto the compromised systems and exfiltrate massive amounts of sensitive data from the networks."

These Chinese attacks have reportedly stolen terabytes of data, including government login IDs, passwords, as well as blueprints for sensitive military systems, such as the quiet electric drive used by U.S. submarines to help evade detection.

The volume of attacks is such that "we have given up on the idea we can keep our networks pristine," Stewart Baker, a former senior cyber-security official at the U.S. Department of Homeland Security and National Security Agency, told Reuters.

The cables, new and old, provide more evidence that Chinese hackers--perhaps government-backed--have been launching large numbers of attacks against U.S. government agencies and businesses. The most notable of those attacks was arguably Operation Aurora, which targeted Google and some 33 other companies.

Google was compromised via targeted phishing attacks--aka spear phishing--that employ fake but personalized emails to trick people into visiting malicious websites or executing email attachments, which then attempt to exploit known vulnerabilities on the user's computer, giving attackers full control over it, and its contents.

Security experts say that the majority of attacks emanating from China still employ spear-phishing. As evidenced by the recent hacks of Epsilon and EMC's RSA--neither attack has been linked to China--spear-phishing attacks remain quite effective and difficult to block.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Current Issue
E-Commerce Security: What Every Enterprise Needs to Know
The mainstream use of EMV smartcards in the US has experts predicting an increase in online fraud. Organizations will need to look at new tools and processes for building better breach detection and response capabilities.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio