US and China accuse each other of cyber warfare
Published time: February 19, 2013 19:23
Edited time: February 20, 2013 15:57
Reuters / Andrew Wong
US security experts claim a 12-story office building
outside of Shanghai is the headquarters of a hacking unit in China
established to attack international computer networks. Beijing has
rejected the allegations, calling the reports “unreliable”.
According to
a report published Tuesday morning by a
Northern Virginia-based information security company, an elusive
squadron of Chinese cyberwarriors operating under the name Unit
61398 has engaged in countless battles with governments and
entities around the globe for years under the umbrella of the
People’s Liberation Army.
The group is accused of infiltrating the computers of some of
the biggest businesses and agencies in the US, both public and
private alike, and is assumed to still be at large.
Alexandria, Virginia’s Mandiant says they’ve been investigating
PLA Unit 61398 for years now and has watched them compromise 141
companies across 20 major industries, infecting the computers at
places like Coca-Cola and the Canadian arm of Telvent with
malicious codes used to pilfer servers for privileged information
and wreak havoc. In their report, the security experts say that
they are all but certain that those attacks have originated out of
an inconspicuous white office building on the outskirts of Shanghai
that has been provided with a special fiber optic communications
infrastructure from Chinese telecom providers in the name of
national defense — but China maintains the claim that they have not
engaged in any illegal hacks.
Unit 61398 Center Building. Image taken from Mandiant’s report.
Mandiant founder Kevin Mandia begs to differ, and tells
The
New
York Times that either those attacks are being waged by
Unit 61398 out of the building in question,
“or the people
who run the most-controlled, most-monitored Internet networks in
the world are clueless about thousands of people generating attacks
from this one neighborhood.”
“It’s where more than 90 percent of the attacks we followed
come from,” says Mr. Mandia, who adds that the unit
is
"chartered with hiring people that can speak English,
and be able to exploit networks, and know computer
security.”
“We thought that was an interesting combination, and that
unit just so happens to be located in the same region of Shanghai
where we're tracking over 90 percent of the connections coming
from,” he tells the Times. Additionally, his company
discovered that two sets of I.P. addresses used in the attacks
being studied were registered in the same neighborhood as the
building assumed to be used by Unit 61398.
“The totality of the evidence” leads to the
company to conclude that the building described by the Times to be
in a run-down neighborhood on the outskirts of Shanghai is the
originating point of the attacks.
Unit 61398 Center Building. Image taken from Mandiant’s report.
Details of an advanced cyberwar against the US by way of China
has been hinted at by members of the Obama administration since the
president began his first term in office in 2009, although
publically little information about the actual threat posed by Far
East hackers has been officially divulged. Through documents
obtained by the website WikiLeaks, however, information has emerged
that only begins to discuss the intensity of the threat. US State
Department diplomatic cables released in 2010 by WikiLeaks and
attributed to accused whistleblower Bradley Manning discus
sophisticated cyberattacks against the US waged by a Chinese unit
given the codename “Byzantine Candor,” or BC. The Times reports
that that moniker for Unit 61398 — formally, the Second Bureau of
the People’s Liberation Army’s General Staff Department’s Third
Department — was dropped by American officials following the highly
publicized disclosure of the hundreds of thousands of sensitive
State Department documents.
In
one
cable from November 2008, a State Department official
writes
, “hackers based in Shanghai and linked to the PRC’s
People’s Liberation Army (PLA) Third Department have been using
these compromised systems as part of the larger BC attack
infrastructure to facilitate computer network exploitation (CNE) of
U.S. and foreign information systems.”
“A October 23 DoD cable states Shanghai-based hackers
associated with BC activity and linked to the PLA have successfully
targeted multiple U.S. entities,” the memo
continues.
“In the US, the majority of the systems BC
actors have targeted belong to the U.S. Army, but targets also
include other DoD services as well as DoS, Department of Energy,
additional USG entities and commercial systems and
networks.”
But despite the State Department cables spawning an
insurmountable number of media articles and remarks, the publishing
of the Mandiant report presents an American audience for the first
time with detailed claims about intrusions and attacks waged
against countries around the globe with undoubtedly damaging
repercussions. It also comes on the heels of a renewed call for
federal cybersecurity legislation in the United States, which could
now be sooner than ever thanks to the latest revelations regarding
Unit 61398.
Geographic location of those targeted. Image taken from Mandiant’s report.
On Wednesday last week, Rep. Mike Rogers (R-Mich.) and Sen.
Dutch Ruppersberger (D-Calif.) reintroduced the Cyber Intelligence
Sharing and Protection Act (
CISPA), a
bill that was touted as being a solution to America’s mysterious
cyberwar woes when first brought up last year but was eventually
stalled before it could reach a vote in the Senate. On the eve of
the reintroduction, Rep. Rogers wrote an
op-ed for
The Detroit News in which he says,
“Every morning in
China, thousands of highly-trained computer engineers wake up with
one mission: Steal American intellectual property that the Chinese
can in turn use to compete against us in the international
market.” During a formal unveiling of the rekindled
CISPA, Sen. Ruppersberger claimed that the US loses around $300
billion in trade secrets annually because of foreign
cyberattacks.
Now to address the latest news from Mandiant, the White House is
reportedly in discussion with the Chinese to snuff any possible
cyberwar before it escalates. According to Foreign Policy, a senior
White House official says on condition of anonymity that the Obama
administration is speaking with Chinese government
officials
"at the highest levels" about the
attacks.
"The United States has substantial and growing concerns
about the threats to US economic and national security posed by
cyber intrusions, including the theft of commercial
information," the source says.
Unit 61398’s position within the People's Liberation Army. Image taken from Mandiant's report.
Additionally, Foreign Policy says Rep. Rogers told them in a
candid interview just last week that America is in need of
having
“direct talks with China,” with cyber
espionage being top priority for the bilateral
discussions.
"This is a problem of epic proportions here
and they need to be called on the carpet. There has been absolutely
no consequences for what they have been able to steal and repurpose
to date,” he told them.
For now, though, the Chinese are refuting the claims made by
Mandiant and the US government. Mandiant says the cybercrimes in
question
“are based primarily in China and that the
Chinese Government is aware of them,” but Hong Lei, a
spokesman for China’s foreign ministry, said on Tuesday that his
country disavowed hacking while discrediting the report.
“Groundless criticism is irresponsible and unprofessional,
and it will not help to solve the problem," he said of
the Mandiant analysis.
"Hacking attacks are transnational and anonymous.
Determining their origins are extremely difficult. We don't know
how the evidence in this so-called report can be
tenable," Lei added.
China's Defense Ministry on Wednesday issued a statement arguing
the report’s accusations are scientifically flawed and not
reliable.
"The report, in only relying on linking IP address to reach a
conclusion the hacking attacks originated from China, lacks
technical proof," the statement said.
"Everyone
knows that the use of usurped IP addresses to carry out hacking
attacks happens on an almost daily basis."
The ministry also suggested that gathering information is
not
“online spying”.
Screenshot taken from www.mod.gov.cn
Speaking to the Times, officials at the Chinese embassy in
Washington have also dismissed the allegations while noting the
epidemic of international hacks originating in the
US.
"They describe China itself as a victim of computer
hacking, and point out, accurately, that there are many hacking
groups inside the United States," the Times' report
reads.
Just last month, the Chinese Defense Ministry issued a statement
saying
“it is unprofessional and groundless to accuse the
Chinese military of launching cyber attacks without any conclusive
evidence.” And while Mandiat’s report include a good
number of information that suggests attacks on US entities are
coming from the rumored Unit 61398 headquarters, at the same time
they still lack cold hard proof.
The same could be said about the United States’ own attacks,
though, after testimonies offered to The New York Times last year
linked both the George W. Bush and Obama administrations to a
program nicknamed ‘Olympic Games’ that was put together with
Israeli allies to wage a covert cyberwar on Iranian nuclear
facilities. The White House has yet to formally admit to the
allegations, but former administration officials attributed attacks
on Iran to the US. Meanwhile, Iranian hackers are being blamed for
recent assaults on the US banking industry.
"We are in a cyberwar [but] most Americans don’t know
it,” Sen. Rogers said during last week’s CISPA
unveiling.
Discussing the need for cybersecurity legislation during the
event, Rogers urged Congress to approve the bill he co-authored
with Rep. Ruppersberger before a cyberattack of epic proportions
prompts Washington to act urgently and perhaps without oversight.
The senator warned of what an assault on the US infrastructure
conducted by cybercriminals could mean and said,
"We don’t
do anything well after a significant emotional event."
Should there be a cyberattack on America on par with the
September 11, 2001 tragedy, Rep. Ruppersberger said
Congress
“will get all the bills passed we want.”
Should Mandiant’s assumptions prove correct, though, it would
pin the blame on China for a number of high-profile hacks. Among
the entities that the security experts say were targeted by Chinese
hackers are defense contractors Lockheed Martin; the National
Geospatial-Intelligence Agency; lobbyists the National Electrical
Manufacturers Association; Coca-Cola; the Chertoff Group and
Telvent. According to the Times, computers at Telvent are used to
design software
“that gives oil and gas pipeline companies
and power grid operators remote access to valves, switches and
security systems” in Canada. Coincidently, last month
China's state-owned CNOOC spent $15 billion to buy-out Canadian oil
and gas company Nexen Inc. in China's largest-ever foreign
takeover.
