Vulnerabilities / Threats
11/28/2010
07:44 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

China Directed Google Attack, Leaked Cable Says

A trove of diplomatic communications released by Wikileaks includes the claim that Chinese officials oversaw the cyber attack on Google.

Wikileaks on Sunday released hundreds of thousands of U.S. State Department documents online and to news organizations, presenting a range of potentially embarrassing revelations about back channel diplomacy between the U.S., allies, and other countries.

The documents, not all of which were immediately accessible to the public due to the cyber attack on Wikileaks, reveal discussions on a range of sensitive matters around the world, including worries about nuclear proliferation in Iran and North Korea.

The cables also reveal that China's Politburo "directed the intrusion into Google's computer systems," according to the New York Times, which was provided with copies of the documents.

A Chinese contact reportedly confirmed to U.S. embassy officials in Beijing the involvement of China's government in the cyber attack on Google's network that occurred late last year and was disclosed in January, 2010. The officially sanctioned cyber attack involved government operatives, private security contractors, and Internet criminals recruited by the Chinese government, the New York Times said.

Security companies said as much back in January. A report issued by iDefense, a computer security company owned by Verisign, claimed that 33 other companies were targeted in the cyber attack and that those responsible were working either directly for, or on behalf of, official intelligence entities of the People's Republic of China.

Such claims however have always proven problematic because finding the IP address of a computer through which an attack was conducted doesn't definitively reveal who controlled that computer or directed those responsible. And indeed, Chinese officials have repeatedly denied any involvement in the attack on Google and other companies.

Google declined to comment.

In a press briefing on Nov. 24, Philip J. Crowley, Assistant Secretary of Public Affairs at the State Department, said the cables are classified and denounced Wikileaks' decision to release of the documents.

"We decry what has happened," said Crowley. "These revelations are harmful to the United States and our interests. They are going to create tension in our relationships between our diplomats and our friends around the world. We wish that this would not happen. But we are, obviously, prepared for the possibility that it will."

U.S. Secretary of State Hillary Clinton has reportedly been reaching out to leaders in various countries to prepare them for the release of the diplomatic cables.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8142
Published: 2014-12-20
Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.36, 5.5.x before 5.5.20, and 5.6.x before 5.6.4 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate keys w...

CVE-2013-4440
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 generates weak non-tty passwords, which makes it easier for context-dependent attackers to guess the password via a brute-force attack.

CVE-2013-4442
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 uses weak pseudo generated numbers when /dev/urandom is unavailable, which makes it easier for context-dependent attackers to guess the numbers.

CVE-2013-7401
Published: 2014-12-19
The parse_request function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service (crash) via a URI without a " " or "?" character in an ICAP request, as demonstrated by use of the OPTIONS method.

CVE-2014-2026
Published: 2014-12-19
Cross-site scripting (XSS) vulnerability in the search functionality in United Planet Intrexx Professional before 5.2 Online Update 0905 and 6.x before 6.0 Online Update 10 allows remote attackers to inject arbitrary web script or HTML via the request parameter.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.