Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

Feds Cite Chinese Cyber Army Capability

U.S. government report blames China and Russia for cyber theft of U.S. economic secrets, but one expert questions China's actual hacking capabilities.

10 Massive Security Breaches
(click image for larger view)
Slideshow: 10 Massive Security Breaches
The U.S. government continues to point the cyber-attack finger at China and Russia, but at least one academic is questioning the actual capabilities of China's cyber army.

The most recent U.S. government accusations came on Thursday, with the release of a report to Congress from the top U.S. counterintelligence agency. The report's title, "Foreign Spies Stealing U.S. Economic Secrets in Cyberspace," left little doubt as to its findings. All that was left was to identify the foreign governments in question.

"Chinese actors are the world's most active and persistent perpetrators of economic espionage," according to the report, released by the Office of the National Counterintelligence Executive. And, "Russia's intelligence services are conducting a range of activities to collect economic information and technology from U.S. targets."

[ How much of a threat are the Chinese? Chinese Military Blamed For Hacking U.S. Satellites. ]

"Trade secrets developed over thousands of working hours by our brightest minds are stolen in a split second and transferred to our competitors," said national counterintelligence executive Robert "Bear" Bryant, at a press briefing that detailed the report's findings, reported The Washington Post.

While the annual counterintelligence report has been released since 1995, this is the first year that a report has emphasized "foreign collectors" exploits. According to news reports, administration officials said that was because of the severity of the problem.

Part of the issue, of course, is that nearly all business-critical information today gets stored digitally, which makes for a larger online attack target than ever before. Unlike the old days of espionage, online attackers also face few personal risks when they try to procure digital data. "Cyberspace makes it possible for foreign collectors to gather enormous quantities of information quickly and with little risk, whether via remote exploitation of victims' computer networks, downloads of data to external media devices, or email messages transmitting sensitive information," according to the report.

But China and Russia aren't the only countries being blamed. In fact, U.S. allies are also gunning for sensitive data, sometimes using social engineering attacks to get it. "Some U.S. allies and partners use their broad access to U.S. institutions to acquire sensitive U.S. economic and technology information, primarily through aggressive elicitation and other human intelligence tactics. Some of these states have advanced cyber capabilities," said the report.

But how bad is the actual threat? In the wake of reports such as this one, observers sometimes accuse the government of inflating cyber threats, in part due to agencies positioning themselves to be the future guardians of the nation's cyber defenses, in light of the potential for massive, related appropriations from Congress.

If China has unleashed a massive intelligence-gathering campaign against the United States and its close allies, however, what can be done about it? For starters, leading government and private sector CIOs have called on the government to improve its threat intelligence information-sharing efforts with the private sector, to help businesses more easily spot advanced persistent threats that can target just a handful of computers at a small number of companies, yet succeed.

Information aside, some of the blame for China's success at spying may go to U.S. businesses simply not being serious enough about information security. Indeed, one study of China's cyber warfare and online exploitation capabilities finds that the country's attacks are hardly state of the art.

"China is condemned to inferiority in [information warfare] capabilities for probably several decades," according to "China's Cyber Warfare Capabilities," published in the most recent issue of Security Challenges.

The report's author, Desmond Ball, is a professor in the Strategic and Defense Studies Center at the Australian National University, and has long studied China's cyber warfare and espionage capabilities. He's found that without exception, Chinese attackers rely on rudimentary viruses and Trojan applications that would pale in comparison to the best botnet toolkits available on the black market.

"They have evinced little proficiency with more sophisticated hacking techniques," said Ball in this report, referring to China. "The viruses and Trojan Horses they have used have been fairly easy to detect and remove before any damage has been done or data stolen.

"There is no evidence that China's cyber-warriors can penetrate highly secure networks or covertly steal or falsify critical data," he said. "They would be unable to systematically cripple selected command and control, air defense and intelligence networks and databases of advanced adversaries, or to conduct deception operations by secretly manipulating the data in these networks."

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
SirPubert
50%
50%
SirPubert,
User Rank: Apprentice
11/4/2011 | 5:43:47 AM
re: Feds Cite Chinese Cyber Army Capability
State sponsored hacking should incur sanctions. The greatest gift we have in our country are our programmers. The world at large has no right to sensitive information and it should be protected with physical operants.
Bprince
50%
50%
Bprince,
User Rank: Ninja
11/3/2011 | 8:47:47 PM
re: Feds Cite Chinese Cyber Army Capability
Ball's assessment certainly seems to fly in the face of conventional wisdom. Either way, I think it should be noted that hacks do not necessarily need to be extremely complex to work.
Brian Prince, InformationWeek/Dark Reading Comment Moderator
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/6/2020
Introducing 'Secure Access Service Edge'
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  7/3/2020
Russian Cyber Gang 'Cosmic Lynx' Focuses on Email Fraud
Kelly Sheridan, Staff Editor, Dark Reading,  7/7/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5604
PUBLISHED: 2020-07-09
Android App 'Mercari' (Japan version) prior to version 3.52.0 allows arbitrary method execution of a Java object by a remoto attacker via a Man-In-The-Middle attack by using Java Reflection API of JavaScript code on WebView.
CVE-2020-5974
PUBLISHED: 2020-07-08
NVIDIA JetPack SDK, version 4.2 and 4.3, contains a vulnerability in its installation scripts in which permissions are incorrectly set on certain directories, which can lead to escalation of privileges.
CVE-2020-15072
PUBLISHED: 2020-07-08
An issue was discovered in phpList through 3.5.4. An error-based SQL Injection vulnerability exists via the Import Administrators section.
CVE-2020-15073
PUBLISHED: 2020-07-08
An issue was discovered in phpList through 3.5.4. An XSS vulnerability occurs within the Import Administrators section via upload of an edited text document. This also affects the Subscriber Lists section.
CVE-2020-2034
PUBLISHED: 2020-07-08
An OS Command Injection vulnerability in the PAN-OS GlobalProtect portal allows an unauthenticated network based attacker to execute arbitrary OS commands with root privileges. An attacker requires some knowledge of the firewall to exploit this issue. This issue can not be exploited if GlobalProtect...