The year of the Hack.
Vanity Fair recently had a pair of thorough exclusives regarding what are to date the most severe, costly and intrusive cyber-attacks in history. Some of these hacks were conducted by the anarchist groups Anonymous and LulzSec, but the really disturbing facet of the articles regard the Chinese government allegedly orchestrating highly sophisticated and successful security breaches against Western c0mpanies and non-governmental organizations (NGOs).
An investigation by the software company McAfee, called Operation Shady Rat, “has been stealing valuable intellectual property (including government secrets, e-mail archives, legal contracts, negotiation plans for business activities, and design schematics) from more than 70 public- and private-sector organizations in 14 countries. The list of victims, which ranges from national governments to global corporations to tiny nonprofits, demonstrates with unprecedented clarity the universal scope of cyber-espionage and the vulnerability of organizations in almost every category imaginable.”
The evolution of Shady rat ’s activity provides more circumstantial evidence of Chinese involvement in the hacks. The operation targeted a broad range of public- and private-sector organizations in almost every country in Southeast Asia—but none in China. And most of Shady rat ’s targets are known to be of interest to the People’s Republic. In 2006, or perhaps earlier, the intrusions began by targeting eight organizations, including South Korean steel and construction companies, a South Korean government agency, a U.S. Department of Energy laboratory, a U.S. real-estate company, international-trade organizations of Western and Asian nations, and the ASEAN Secretariat. (According to McAfee’s “Operation Shady rat ” white paper, “[t]hat last intrusion began in October [2006], a month prior to the organization’s annual summit in Singapore, and continued for another 10 months.”) In 2007, the activity ramped up to hit 29 organizations. In addition to those previously targeted, new victims included a technology company owned by the Vietnamese government, four U.S. defense contractors, a U.S. federal-government agency, U.S. state and county government organizations, a computer-network-security company—and the national Olympic committees of two countries in Asia and one in the West, as well as the I.O.C. The Olympic organizations, strikingly, were targeted in the months leading up to the 2008 Olympic Games in Beijing. Shady rat ’s activity continued to build in 2008, when it infiltrated the networks of 36 organizations, including the United Nations—and reached a crest of 38 organizations, including the World Anti-doping Agency, in 2009. Since then, the victim numbers have been dropping, but the activity continues. Shady rat ’s command-and-control server is still operating, and some organizations, including the World Anti-doping Agency, were still under attack as of last month. (As of Tuesday, according to a WADA spokesman, the group was unaware of any breach, but “WADA is investigating” McAfee’s discovery.) The longest compromise duration—“on and off for 28 months,” according to McAfee’s report—was one Asian country’s Olympic committee. Many others were compromised for two full years. Nine organizations were compromised for one month or less. All others were compromised for a minimum of one month, potentially allowing for complete access to all data on their servers.
… Alperovitch’s diagnosis of the problem raised by Shady rat is troubling: “It’s clear from this and other attacks we’ve been witnessing that there is an unprecedented transfer of wealth in the form of trade secrets and I.P., primarily from Western organizations and companies, falling off the truck and disappearing into massive electronic archives. What is happening to this data? Is this being accumulated in a giant, Indiana Jones–type warehouse? Or is it being used to create new products? If it’s the latter, we won’t know for a number of years. But if so, it’s not just a problem for these companies, but also for the governments of the countries where these companies are located, because they’re losing their economic advantage to competitors in other parts of the world overnight. That is a national-security problem, insofar as it leads to loss of jobs and lost economic growth. That’s a serious threat.”
The National Security Agency went into the private sector to create another group, dubbed Operation Starlight, to study these and other cyber attacks against the West, particularly the embarrassing compromise of the software/VPN security firm RSA. RSA’s specialty is providing sophisticated VPN software and tokens. Earlier this year, RSA’s SecurID token algorithms were compromised. Like McAfee, Starlight’s draft conclusion (the final report is in progress and could change) found an “organized, concerted campaign on behalf of China.”
So how bad is the threat? There are indications that the threat is worse than what has been reported thus far, because many companies do not wish to disclose to the public that they have been the victim of a security breach. A recent breach of Google’s servers, since labeled as Operation Aurora, for example, gave away intellectual property and company secrets that its owners no doubt worry will be used against them in the years ahead.
Google’s initial announcement of Operation Aurora stated that “at least twenty other large companies from a wide range of businesses—including the Internet, finance, technology, media and chemical sectors”—had been affected, and early news reports named Yahoo and Symantec as among the other victims. As the year wore on, the body count grew: Adobe, Juniper Networks, and Rackspace admitted that they’d been attacked, then Intel. Before long a cache of e-mails written by analysts at the security firm HBGary and its sister company HBGary Federal were made public, after the companies were caught in the crosshairs of the hacktivist group Anonymous, a loose coalition of individuals who perform coordinated cyber-attacks, sometimes with the stated goal of advancing Internet freedom. The e-mails revealed that Aurora or similar attacks had also hit Baker Hughes, ExxonMobil, Royal Dutch Shell, BP, Conoco Phillips, Marathon Oil, Lockheed, Northrop Grumman, Symantec, Juniper, Disney, Sony, Johnson & Johnson, General Electric, General Dynamics, the law firm King & Spalding, and DuPont. DuPont was hit so intensely that, one HBGary analyst wrote, “their hair is on fire.”
Not only did the HBGary e-mails provide new details about Aurora, they also described similar attacks that had been going on for much longer than the public knew. “Many of the leading defense contractors … all had … aurora-type attacks as far back as 2005,” one analyst wrote. “So a search engine makes a big media stink about one intrusion, and that leads to a bunch of hype? I think the discussion needs to be on why it’s taken 5+ years for the rest of the industry to catch on.”
…
Another security researcher who was on the front lines during Operation Aurora says, “Those of us who are hands-on-keyboard want this story to be told, because we feel like the top corporate managers—following the advice of their lawyers—are reflexively keeping breach information secret from other companies that are trying to defend themselves. In the big picture, a little bit of short-term embarrassment is worth it, to get the American people to understand that there’s a low-level Cold War going on.” Despite—and also because of—the extreme secrecy surrounding industrial cyber-espionage, this phenomenon is gradually effecting a fundamental re-arrangement of the relationship between state and corporate power.
Michael Hayden was the director of the N.S.A. and then the C.I.A. during the period when the problem of Chinese cyber-espionage developed. In a conversation with him about Operation Aurora, I asked what he believed to be the most significant fact about those intrusions.
He answered, “You see Google acting in some ways as nation-states used to act, exercising to the best of their ability some attributes traditionally associated with sovereign states. ‘We’re going to break relationship’—cease doing business there, you know. It’s something I dwell on a lot. The cyberworld is so new that the old structures, you know—state, non-state, public, private—they all break down … The last time we had such a powerful discontinuity is probably the European discovery of the Western Hemisphere. At that point, we had some big, multi-national corporations—East India Company and Hudson’s Bay—that acted as states. And I see elements of that with the big Microsofts and Googles of the world. Because of their size, they actually are making decisions that have the impact of the kinds of decisions made in the halls of government. Google is not a state. But what constitutes Google’s inherent right of self-defense in this new environment against this kind of attack? I’m not accusing anyone of doing anything wrong. These situations are just so different. What do we believe would be legitimate for Google to do in response to this? Now, I don’t have answers. I really don’t know, but it’s a really good question.”
While understandable, the hesitancy not to publicize these security breaches only harms the companies in the long run. That’s because most of the hacks are successful because the adversary – hacker – exploits the companies own resources — it’s employees. Using a technique called “spear-phishing,” hackers browse through social media websites in order to collect information about people who work at a particular firm. They then custom script targeted e-mails and utilities which an unsuspecting employee clicks upon, and inadvertently gives network access to the hacker. The first step in employee training and education is acknowledging that the is an Advanced Persistent Threat.
Comments off
