Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

Feds Cite Chinese Cyber Army Capability

U.S. government report blames China and Russia for cyber theft of U.S. economic secrets, but one expert questions China's actual hacking capabilities.

10 Massive Security Breaches
(click image for larger view)
Slideshow: 10 Massive Security Breaches
The U.S. government continues to point the cyber-attack finger at China and Russia, but at least one academic is questioning the actual capabilities of China's cyber army.

The most recent U.S. government accusations came on Thursday, with the release of a report to Congress from the top U.S. counterintelligence agency. The report's title, "Foreign Spies Stealing U.S. Economic Secrets in Cyberspace," left little doubt as to its findings. All that was left was to identify the foreign governments in question.

"Chinese actors are the world's most active and persistent perpetrators of economic espionage," according to the report, released by the Office of the National Counterintelligence Executive. And, "Russia's intelligence services are conducting a range of activities to collect economic information and technology from U.S. targets."

[ How much of a threat are the Chinese? Chinese Military Blamed For Hacking U.S. Satellites. ]

"Trade secrets developed over thousands of working hours by our brightest minds are stolen in a split second and transferred to our competitors," said national counterintelligence executive Robert "Bear" Bryant, at a press briefing that detailed the report's findings, reported The Washington Post.

While the annual counterintelligence report has been released since 1995, this is the first year that a report has emphasized "foreign collectors" exploits. According to news reports, administration officials said that was because of the severity of the problem.

Part of the issue, of course, is that nearly all business-critical information today gets stored digitally, which makes for a larger online attack target than ever before. Unlike the old days of espionage, online attackers also face few personal risks when they try to procure digital data. "Cyberspace makes it possible for foreign collectors to gather enormous quantities of information quickly and with little risk, whether via remote exploitation of victims' computer networks, downloads of data to external media devices, or email messages transmitting sensitive information," according to the report.

But China and Russia aren't the only countries being blamed. In fact, U.S. allies are also gunning for sensitive data, sometimes using social engineering attacks to get it. "Some U.S. allies and partners use their broad access to U.S. institutions to acquire sensitive U.S. economic and technology information, primarily through aggressive elicitation and other human intelligence tactics. Some of these states have advanced cyber capabilities," said the report.

But how bad is the actual threat? In the wake of reports such as this one, observers sometimes accuse the government of inflating cyber threats, in part due to agencies positioning themselves to be the future guardians of the nation's cyber defenses, in light of the potential for massive, related appropriations from Congress.

If China has unleashed a massive intelligence-gathering campaign against the United States and its close allies, however, what can be done about it? For starters, leading government and private sector CIOs have called on the government to improve its threat intelligence information-sharing efforts with the private sector, to help businesses more easily spot advanced persistent threats that can target just a handful of computers at a small number of companies, yet succeed.

Information aside, some of the blame for China's success at spying may go to U.S. businesses simply not being serious enough about information security. Indeed, one study of China's cyber warfare and online exploitation capabilities finds that the country's attacks are hardly state of the art.

"China is condemned to inferiority in [information warfare] capabilities for probably several decades," according to "China's Cyber Warfare Capabilities," published in the most recent issue of Security Challenges.

The report's author, Desmond Ball, is a professor in the Strategic and Defense Studies Center at the Australian National University, and has long studied China's cyber warfare and espionage capabilities. He's found that without exception, Chinese attackers rely on rudimentary viruses and Trojan applications that would pale in comparison to the best botnet toolkits available on the black market.

"They have evinced little proficiency with more sophisticated hacking techniques," said Ball in this report, referring to China. "The viruses and Trojan Horses they have used have been fairly easy to detect and remove before any damage has been done or data stolen.

"There is no evidence that China's cyber-warriors can penetrate highly secure networks or covertly steal or falsify critical data," he said. "They would be unable to systematically cripple selected command and control, air defense and intelligence networks and databases of advanced adversaries, or to conduct deception operations by secretly manipulating the data in these networks."

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
SirPubert
50%
50%
SirPubert,
User Rank: Apprentice
11/4/2011 | 5:43:47 AM
re: Feds Cite Chinese Cyber Army Capability
State sponsored hacking should incur sanctions. The greatest gift we have in our country are our programmers. The world at large has no right to sensitive information and it should be protected with physical operants.
Bprince
50%
50%
Bprince,
User Rank: Ninja
11/3/2011 | 8:47:47 PM
re: Feds Cite Chinese Cyber Army Capability
Ball's assessment certainly seems to fly in the face of conventional wisdom. Either way, I think it should be noted that hacks do not necessarily need to be extremely complex to work.
Brian Prince, InformationWeek/Dark Reading Comment Moderator
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Our Endpoint Protection system is a little outdated... 
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19729
PUBLISHED: 2019-12-11
An issue was discovered in the BSON ObjectID (aka bson-objectid) package 1.3.0 for Node.js. ObjectID() allows an attacker to generate a malformed objectid by inserting an additional property to the user-input, because bson-objectid will return early if it detects _bsontype==ObjectID in the user-inpu...
CVE-2019-19373
PUBLISHED: 2019-12-11
An issue was discovered in Squiz Matrix CMS 5.5.0 prior to 5.5.0.3, 5.5.1 prior to 5.5.1.8, 5.5.2 prior to 5.5.2.4, and 5.5.3 prior to 5.5.3.3 where a user can trigger arbitrary unserialization of a PHP object from a packages/cms/page_templates/page_remote_content/page_remote_content.inc POST parame...
CVE-2019-19374
PUBLISHED: 2019-12-11
An issue was discovered in core/assets/form/form_question_types/form_question_type_file_upload/form_question_type_file_upload.inc in Squiz Matrix CMS 5.5.0 prior to 5.5.0.3, 5.5.1 prior to 5.5.1.8, 5.5.2 prior to 5.5.2.4, and 5.5.3 prior to 5.5.3.3 where a user can delete arbitrary files from the se...
CVE-2014-7257
PUBLISHED: 2019-12-11
SQL injection vulnerability in DBD::PgPP 0.05 and earlier
CVE-2013-4303
PUBLISHED: 2019-12-11
includes/libs/IEUrlExtension.php in the MediaWiki API in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 does not properly detect extensions when there are an even number of "." (period) characters in a string, which allows remote attackers to conduct cross-s...