Attacks/Breaches
4/19/2011
12:37 PM
50%
50%

Leaked Cables Indicate Chinese Military Hackers Attacked U.S.

U.S. authorities have reportedly traced the "Byzantine Hades" spear-phishing attacks to specific Chinese military groups.

According to secret government cables, the Chinese military has been launching massive numbers of spear-phishing attacks against U.S. government agencies and companies. In the cables, U.S. government officials assert that these China-driven attacks, which they've dubbed "Byzantine Hades," have been occurring since at least 2002.

"The attacks coming out of China are not only continuing, they are accelerating," Alan Paller, director of research at the SANS Institute, told Reuters, which has obtained a new batch of cables--from WikiLeaks, via a third party--that it said provide even more evidence that China is behind many of these attacks. An April 2009 cable, it said, "even pinpoints the attacks to a specific unit of China's People's Liberation Army," based on tracing the website from which the attacks originated. The site was registered to the exact postal code where one of the Chinese army's electronic espionage units is headquartered, in the city of Chengdu.

According to secret U.S. government cables from 2008, released in December 2010 by WikiLeaks, government agencies have been targeted with social engineering attacks--spear phishing--since late 2002 by "Byzantine Candor," which is the government's code name for a subset of Byzantine Hades.

"Intruders have relied on techniques including exploiting Windows system vulnerabilities and stealing login credentials to gain access to hundreds of [U.S. government] and cleared defense contractor systems over the years," according to the 2008 cables. "The intruders then install malware such as customized keystroke-logging software and command-and-control utilities onto the compromised systems and exfiltrate massive amounts of sensitive data from the networks."

These Chinese attacks have reportedly stolen terabytes of data, including government login IDs, passwords, as well as blueprints for sensitive military systems, such as the quiet electric drive used by U.S. submarines to help evade detection.

The volume of attacks is such that "we have given up on the idea we can keep our networks pristine," Stewart Baker, a former senior cyber-security official at the U.S. Department of Homeland Security and National Security Agency, told Reuters.

The cables, new and old, provide more evidence that Chinese hackers--perhaps government-backed--have been launching large numbers of attacks against U.S. government agencies and businesses. The most notable of those attacks was arguably Operation Aurora, which targeted Google and some 33 other companies.

Google was compromised via targeted phishing attacks--aka spear phishing--that employ fake but personalized emails to trick people into visiting malicious websites or executing email attachments, which then attempt to exploit known vulnerabilities on the user's computer, giving attackers full control over it, and its contents.

Security experts say that the majority of attacks emanating from China still employ spear-phishing. As evidenced by the recent hacks of Epsilon and EMC's RSA--neither attack has been linked to China--spear-phishing attacks remain quite effective and difficult to block.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-5084
Published: 2015-08-02
The Siemens SIMATIC WinCC Sm@rtClient and Sm@rtClient Lite applications before 01.00.01.00 for Android do not properly store passwords, which allows physically approximate attackers to obtain sensitive information via unspecified vectors.

CVE-2015-5352
Published: 2015-08-02
The x11_open_helper function in channels.c in ssh in OpenSSH before 6.9, when ForwardX11Trusted mode is not used, lacks a check of the refusal deadline for X connections, which makes it easier for remote attackers to bypass intended access restrictions via a connection outside of the permitted time ...

CVE-2015-5537
Published: 2015-08-02
The SSL layer of the HTTPS service in Siemens RuggedCom ROS before 4.2.0 and ROX II does not properly implement CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a different vulnerability than CVE-2014-3566.

CVE-2015-5600
Published: 2015-08-02
The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processing of keyboard-interactive devices within a single connection, which makes it easier for remote attackers to conduct brute-force attacks or cause a denial of service (CPU consumptio...

CVE-2015-1009
Published: 2015-07-31
Schneider Electric InduSoft Web Studio before 7.1.3.5 Patch 5 and Wonderware InTouch Machine Edition through 7.1 SP3 Patch 4 use cleartext for project-window password storage, which allows local users to obtain sensitive information by reading a file.

Dark Reading Radio
Archived Dark Reading Radio
What’s the future of the venerable firewall? We’ve invited two security industry leaders to make their case: Join us and bring your questions and opinions!