Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


04:29 PM
Connect Directly

APT Attackers Hit Japan's Biggest Defense Contractor

Targeted attack against Mitsubishi Heavy Industries demonstrates how APTs aren't just going after U.S. companies

Mitsubishi Heavy Industries became the latest high-profile target of cyberespionage -- driving home the reality that the advanced persistent threat (APT) isn't just a U.S. problem.

This isn't the first time a Japanese defense contractor has been hit by APT attackers -- it's just the first time such an attack has gone public, security experts say. News of the attack was first reported in the Japanese press and was then picked up by Reuters today.

According to a translated statement by Mitsubishi Heavy Industries, which builds submarines, missiles, and nuclear power components, the company first detected the intrusion in mid-August.

"We've found out that some system information such as IP addresses have been leaked and that's creepy enough," a spokesman for Mitsubishi Heavy is quoted as saying in a Reuters report. "We can't rule out small possibilities of further information leakage but so far crucial data about our products or technologies have been kept safe."

Some 80 machines were infected with malware at the firm's Tokyo headquarters and manufacturing and research and development facilities: Kobe Shipyard & Machinery Works, Nagasaki Shipyard & Machinery Works and Nagoya Guidance & Propulsion System Works were among the sites reported to have been infiltrated by attackers. Around eight different types of malware were detected on the various machines, the reports said.

Richard Bejtlich, chief security officer and vice president at Mandiant, says the Japanese have been working on an initiative to defend against APT-type attacks. "There's no doubt that Japan is worried about Chinese espionage … I understand that there's an initiative starting next year to help their industry resist those attacks," Bejtlich says.

While the attack on a high-profile industrial power in Japan isn't really a surprise, it confirms theories that these types of attacks are a global problem. "It's validation that this isn't simply a U.S. problem," Bejtlich says. "Hopefully, people [worldwide] will realize this isn't a manufactured threat, but it's a real problem and fairly widespread."

Mitsubishi Heavy Industries, meanwhile, said in a statement that network addresses might have been leaked and that it's still investigating the attack and the extent of the data exposure.

"I don't suppose we need another wake-up call, but this news leaves a disconcerting after-taste," says Will Irace, director of research for Fidelis. "There are some good technologies available to help advanced persistent defenders safeguard their enterprises. But it still feels like we're fighting blind because targeted companies are reluctant to come forward with details on how they were victimized."

Irace says he'd like victims to cooperate more closely to share information. "The deck is stacked against them: Strategy is going to be at least as important as technology if they're going to catch up," Irace says.

Mandiant's Bejtlich says while the Mitsubishi attack isn't likely to help spur more cooperation among victim organizations around the world, it could encourage some diplomatic cooperation. "At the diplomatic level, it makes a difference," he says. "It continues to point to the Chinese as doing something that is not considered to be responsible."

There's really no technical way to resolve the cyberespionage problem, he says, but it could be addressed at the national and diplomatic levels.

Meanwhile, details were scarce about how the attackers got in and how far they got. Adam Powers, chief technology officer for Lancope, says it appears Mitsubishi Heavy Industries relied too heavily on its perimeter security. "Many organizations place the bulk of their cyberdefense technology at the perimeter of the network. Unfortunately, once the attackers breach the perimeter defenses, it's easy to compromise additional unprotected resources behind the outer wall. Once the attackers have a persistent foothold within the network, detection and remediation can become very difficult," Powers says. "Given the scope of the attack on Mitsubishi Heavy Industries, it may be months before all of the breached resources are discovered."

Mitsubishi Heavy Industries had $3.4 billion in contracts with Japan's Ministry of Defence for the year as of March – one-fourth of the agency's spending for the year, according to Reuters. The company makes surface-to-air Patriot missiles and AIM-7 Sparrow air-to-air missiles, and manufactures wings for Boeing's 787 Dreamliner jet.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
How to Think Like a Hacker
Dr. Giovanni Vigna, Chief Technology Officer at Lastline,  10/10/2019
7 SMB Security Tips That Will Keep Your Company Safe
Steve Zurier, Contributing Writer,  10/11/2019
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2019-10-17
Comtech H8 Heights Remote Gateway 2.5.1 devices allow XSS and HTML injection via the Site Name (aka SiteName) field.
PUBLISHED: 2019-10-17
rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel through 5.3.6 lacks a certain upper-bound check, leading to a buffer overflow.
PUBLISHED: 2019-10-16
HongCMS 3.0.0 has XSS via the install/index.php servername parameter.
PUBLISHED: 2019-10-16
HongCMS 3.0.0 has XSS via the install/index.php dbname parameter.
PUBLISHED: 2019-10-16
HongCMS 3.0.0 has XSS via the install/index.php dbusername parameter.