



China-based hacking of 760 companies an 'undeclared cyber cold war'


Michael Riley and John Walcott

Hacking is cheaper than product development, say experts.

Dozens of Fortune 100 companies had their computers compromised in a cyber espionage attack apparently linked to a Chinese national.

Dozens of Fortune 100 companies had their computers compromised in a cyber espionage attack apparently linked to a Chinese national. Photo: Peter Riches

Google and Intel were logical targets for China-based hackers, given the solid-gold intellectual property data stored in their computers. An attack by cyber spies on iBahn, a provider of internet services to hotels, takes some explaining.

iBahn provides broadband business and entertainment access to guests of Marriott International and other hotel chains, including multinational companies that hold meetings on site. Breaking into iBahn's networks, according to a senior US intelligence official familiar with the matter, may have let hackers see millions of confidential emails, even encrypted ones, as executives from Dubai to New York reported back on everything from new product development to merger negotiations.

More worrisome, hackers might have used iBahn's system as a launching pad into corporate networks that are connected to it, using traveling employees to create a backdoor to company secrets, said Nick Percoco, head of Trustwave's SpiderLabs, a security firm.

The hackers' interest in companies as small as Salt Lake City-based iBahn illustrates the breadth of China's spying against firms in the US and elsewhere. The networks of at least 760 companies, research universities, internet service providers and government agencies were hit over the last decade by the same elite group of China-based cyber spies.

The companies, including firms such as Research in Motion (RIM) and Boston Scientific, range from some of the largest corporations to niche innovators in sectors like aerospace, semiconductors, pharmaceuticals and biotechnology, according to intelligence data obtained by Bloomberg News.

'Stealing everything'

"They are stealing everything that isn't bolted down, and it's getting exponentially worse," said Representative Mike Rogers, a Michigan Republican who is chairman of the US Permanent Select Committee on Intelligence.

China has made industrial espionage an integral part of its economic policy, stealing company secrets to help it leapfrog over US and other foreign competitors to further its goal of becoming the world's largest economy, US intelligence officials have concluded in a report released last month.

"What has been happening over the course of the last five years is that China - let's call it for what it is - has been hacking its way into every corporation it can find listed in Dun & Bradstreet," said Richard Clarke, former special adviser on cybersecurity to US President George W. Bush, at an October conference on network security.

"Every corporation in the US, every corporation in Asia, every corporation in Germany. And using a vacuum cleaner to suck data out in terabytes and petabytes. I don't think you can overstate the damage to this country that has already been done."

Foreign governments

In contrast, US cyberspies go after foreign governments and foreign military and terrorist groups, Clarke said.

"We are going after things to defend ourselves against future attacks," he said.

Such accusations intensified when a November 3 report by 14 US intelligence agencies fingered China as the No.1 hacker threat to US firms. While the Obama administration took the unprecedented step of outing China by name, the White House, US intelligence agencies and members of Congress are struggling to assess how much damage is being done during such attacks and what to do to stop them beyond public rebuke.

For now, the administration is concentrating on raising awareness among company executives and seeking a commitment to improve security against such attacks. Rogers has a bill pending in the House that would permit the government to share secret information that would help companies spot hacker intrusions, such as signatures of malicious Chinese software.

Consistently denied responsibility

China has consistently denied it has any responsibility for hacking that originated from servers on its soil. Geng Shuang, a spokesman for the Chinese embassy in Washington, didn't respond to several e-mails and phone calls requesting comment. Wang Baodong, another Chinese government spokesman in Washington, also didn't respond to requests for comment.

Based on what is known of attacks from China, Russia and other countries, a declassified estimate of the value of the blueprints, chemical formulas and other material stolen from US corporate computers in the last year reached almost $500 billion, said Rogers, a former agent for the Federal Bureau of Investigation.

Stolen information

US officials are grappling with how stolen information is being used, said Scott Borg, an economist and director of the US Cyber Consequences Unit, a non-profit research institute. Calculating the damage depends on hard-to-know variables, such as how effectively and quickly thieves can integrate stolen data into competing products, the senior intelligence official said.

While a precise dollar figure for damage is elusive, the overall magnitude of the attacks is not, Borg said.

"We're talking about stealing entire industries," he said. "This may be the biggest transfer of wealth in a short period of time that the world has ever seen."

The public evidence against China now being rolled out by the Obama administration, Rogers and others in Congress has been collected by the intelligence community over several years. Many of the details remain classified.

The hackers who attacked iBahn are among the most skilled of at least 17 China-based spying operations the US intelligence community has identified, according to a private security official briefed on the matter who asked not to be identified because of the subject's sensitivity.

Massive espionage ring

The hackers are part of a massive espionage ring codenamed Byzantine Foothold by US investigators, according to a person familiar with efforts to track the group. They specialise in infiltrating networks using phishing e-mails laden with spyware, often passing on the task of exfiltrating data to others.

Segmented tasking among various groups and sophisticated support infrastructure are among the tactics intelligence officials have revealed to Congress to show the hacking is centrally coordinated, the person said. US investigators estimate Byzantine Foothold is made up of anywhere from several dozen hackers to more than one hundred, said the person, who declined to be identified because the matter is secret.

"The guys who get in first tend to be the best. If you can't get in, the rest of the guys can't do any work," said Richard Bejtlich, chief security officer for Mandiant Corp., an Alexandria, Virginia-based security firm that specialises in cyber espionage. "We've seen some real skill problems with the people who are getting the data out. I guess they figure if they haven't been caught by that point, they'll have as many chances as they need to remove the data."

Secretive companies

US and other companies have been secretive about the details of their computer security. When Google announced in 2010 that China-based hackers had raided its networks, it was a rare example of a US company publicly revealing a cyber burglary aimed at its intellectual property - in this case, its source code.

Mountain View, California-based Google, the world's largest search-engine firm, said at the time that at least 34 other major companies were victims of the same attack. However, only two - Intel and Adobe Systems - stepped forward, and they provided few specifics.

Google vastly underestimated the scope of the spying. Intelligence documents obtained by Bloomberg News show that China-based hackers have hunted technology and information across dozens of economic sectors and in some of the most obscure corners of the economy, beginning in 2001 and accelerating over the last three years. Many of the victims have been hacked more than once.

Byzantine foothold

One victim of Byzantine Foothold, Associated Computer Systems, a division of Xerox, provides back-office services such as accounting and human resources for thousands of multinational firms and government agencies in more than 100 countries. According to its website, ACS's expertise includes digitising and storing documents, a potential treasure-trove of information on the firm's corporate clients, including carmakers and computer companies.

Other targets of the group include large companies such as Hewlett-Packard, Volkswagen and Yahoo. Smaller firms in strategic sectors were also hit, such as iBahn and Innovative Solutions & Support, which manufactures flight-information computers; as were Massachusetts Institute of Technology, the Italian Academic and Research Network and the California State University Network.

An informal working group of private-sector cybersecurity experts and government investigators identified the victims by tracing information sent from hacked company networks to spy group-operated command-and-control servers, according to a person familiar with the process. In some cases, the targets aren't aware they were hacked.

People's Liberation Army

Such tracing is sometimes possible because of sloppiness and mistakes made by the spies, said another senior intelligence official who asked not to be named because the matter is classified. In one instance, a ranking officer in China's People's Liberation Army, or PLA, employed the same server used in cyberspying operations to communicate with his mistress, the intelligence official said.

Many of the cyber attacks have been linked to specific China-related events, a pattern noted by secret diplomatic cables published by WikiLeaks, the anti-secrecy website. During the five-year period beginning in 2006, a second group of China-based hackers ransacked the networks of at least 71 companies, government entities, think-tanks and non-profit groups, said McAfee, which analysed information from servers used in the attacks.

'Operation Shady Rat'

Details of those intrusions were originally published in an August report by the cyber security firm dubbed "Operation Shady Rat." The report didn't name the country where the hackers were based or identify the private-sector victims. The report's principal author, Dmitri Alperovitch, who now heads his own firm, Asymmetric Cyber Operations, confirmed the country was China.

In one of the earliest attacks on a company, cyberspies hacked into the computer networks of POSCO, the South Korean steel giant, in July 2006, Alperovitch said. The intrusion took place the same month that the steelmaker, the third largest in the world, initiated a takeover of a large steel mill in eastern China, according to the US-based Epoch Times, founded by supporters of the dissident Falun Gong spiritual sect, which first noted a link between the two events.

Earthquakes and satellites

Two years later, Chinese rescue workers were using satellite communications equipment made by the Danish technology firm Thrane & Thrane following a major earthquake in Sichuan province. China Daily, the quasi-official newspaper, had praised the Danish equipment's performance. Alperovitch said the Danish firm was hacked by the Shady Rat crew three months later.

"With fans like those, who needs enemies?" he said.

John Alexandersen, a spokesman for the Lundtofte, Denmark-based Thrane & Thrane, said although he couldn't "rule out" that hackers breached their networks, no confidential data was taken.

The approval of China's most recent five-year economic plan provides another possible link between Chinese government policy and cyber-espionage. The plan, approved by the National People's Congress in March, identifies seven priority industries that mirror the most prominent targets of China-based cyberspies, according to the two senior US intelligence officials who have knowledge of the victims.

KPMG International, the auditing firm, said the five-year plan's priorities include clean energy; biotechnology; advanced semiconductors; information technology; high-end manufacturing, such as aerospace and telecom equipment; and biotechnology, including drugs and medical devices.

Same shopping ist

In many cases, the iBahn hackers appear to be working off the same shopping list, according to intelligence documents.

In the biotechnology sector, their victims include Boston Scientific, the medical device maker, as well as Abbott Laboratories and Wyeth, the drug maker that is now part of Pfizer.

The hackers also rifled networks of the Parkland Computer centre in Rockville, Maryland, according to documents provided to Bloomberg News by a person involved in government tracking of the cyberspies, who declined to be identified because the matter isn't public.

Parkland is the computing centre for the Food and Drug Administration, which has access to drug trial information, chemical formulas and other data for almost every important drug sold in the US

Manufacturing sector

In the manufacturing sector, San Jose, California-based Cypress Semiconductor, which makes advanced chips for telecommunications equipment, was a victim, as were Aerospace, which provides scientific research on national security-related space programs, and Environmental Systems Research Institute, a Redlands, California-based company that develops mapping software.

In China, those industries are developing rapidly. Chinese companies were involved in 10 of the 13 global technology initial public offerings in the third quarter of 2011, according to PricewaterhouseCoopers, the global auditing firm. The Chinese firms specialised in information technology, semiconductors and clean energy, like solar power, the PwC report said.

Driving China's spike in cyberspying is the reality that hacking is cheaper than product development, especially given China's vast pool of hackers, said a fourth US intelligence official. That pool includes members of its militia, who hack on commission, the official said. They target computing, high technology and pharmaceutical companies whose products take lots of time and money to develop, the official said.

Byzantine Hades

US counterintelligence authorities have been tracking China's cyberspies for years under the classified codename Byzantine Hades, which a March 27, 2009, secret US State Department cable published by WikiLeaks calls "a group of associated computer network intrusions with an apparent nexus to China."

Byzantine Foothold, Byzantine Candor and Byzantine Anchor represent subsets, or various groups, of the overall Chinese cyber espionage threat, the person familiar with the secret tracking effort said.

Among the victims of Byzantine Foothold are internet service providers in more than a dozen countries, including Canada, Switzerland, Bangladesh, Venezuela and Russia. The ISPs are used as platforms to hack other victims and disguise spying activity.

An October 30, 2008, State Department cable described China-based hackers accessing several computer networks of a commercial internet provider in the US. They used the company's systems to extract "at least 50 megabytes of email messages and attached documents, as well as a complete list of usernames and passwords from an unspecified" US government agency, according to the cable.

PLA's Third Department

The cable stated that the hackers were based in Shanghai and linked to the PLA's Third Department, a unit of the Chinese military that, according to a 2009 report by the US-China Economic and Security Review Commission, is responsible for cyber operations.

"Some notion that this isn't nation-state driven is just false," said Rogers, the US House intelligence committee chairman.

Fifteen of the companies and universities identified as hit by the iBahn hackers and contacted by Bloomberg News either declined to comment, said they had no knowledge of the attack, or didn't respond to requests for comment

Erik Fallis, a spokesman for the California State University Network, said that following an investigation, "no evidence was found to suggest that this event compromised CSU assets."

Obama administration officials seeking to forge a robust policy and diplomatic response are facing few good options, said Clarke, the former White House cyber security official.

UN Security Council

China, a member of the UN Security Council, has the power to veto multilateral initiatives aimed at the country that pass through that body.

Sanctions on Chinese goods in sectors that have been heavily targeted by cyberspies - green energy, semiconductors and pharmaceuticals - would be a problematic solution, probably sparking a trade war, said James Lewis, a cyber security expert at the centre for Strategic and International Studies in Washington.

US government officials considering whether major corporate networks should be protected as a national security asset face opposition even from some victims protective of the internet's laissez-fair culture, said Richard Falkenrath, a senior fellow for counterterrorism and national security studies at the Council on Foreign Relations.

"The situation we are in now is the consequence of three decades of hands-off approach by government in the development of the internet," Falkenrath said.

Lack the leverage

For now, administration officials have correctly assessed that they lack the leverage to compel China to change its alleged criminal behavior, he said.

"The Cold War is a pretty good analogy," Falkenrath said. "There was never any serious effort to change the internal character of Soviet state."

At a minimum, the November intelligence agency report does throw down a marker in that conflict, said Estonian defence Minister Mart Laar. Estonia, which suffered a massive cyber attack in 2007 it said originated from Russia - is pushing for a NATO cyber defence alliance.

"I remember how the Cold War was changed, and you could for the first time feel the Soviet defeat coming when Ronald Reagan called the Evil Empire evil," Laar said.


twitter  Follow IT Pro on Twitter


  • The question shouldn't be why are people/countries hacking companies, but why aren't the companies using security systems that prevents these hacks, or proucedures to limit the damage?

    Sometimes it's not even a case of companies being hacked, sometimes it's just because companies don't use decent security companies - as evidenced by Telstra's recent debacle.

    Other times it's just a case of companies cutting corners to save money and hiring off-shore programmers who don't have a clue about what they're doing, or worse, who know exactly what they're doing when they put the security flaws in place so they can get in at a later date.

    Date and time
    December 16, 2011, 8:47AM
    • It'd be interesting to know how prelevant western hacking of Chinese assets are. I'd imagine that Chinese security is far worse than Western.

      Good article though.

      Date and time
      December 16, 2011, 9:30AM
      • Eh, what's new. Living in China the last 7 years, I rarely see a Chinese made product that doesn't seem to be a clone of a western brand or technology. This doesn't stop the top luxury brands being foreign and Chinese products having a low reputation.
        However, I agree with Cryber Scare, if a company wants to be at the top of it's industry it should employ the best IT security team. Hacking, which I am sure is rampant all over the world, not just out of China, is not going to go away anytime soon so companies need to start including antihacking measures into their corporate stategy.

        Date and time
        December 16, 2011, 9:36AM
        • [Ed] Twice in the last month I have been offered Lacoste, Tommy Hilfiger and Quicksilver clothing at 1/5 of the store price. The liars peddling this garbage tell you they are a factory outlet for these companies. What is the Chinese govt. doing about it? Nothing! Despite claining to have 1 million officials policing it. Yeah! Right.

          Date and time
          December 16, 2011, 9:37AM
          • The US is still the top dog in IT technology and its hold over the media in propaganda dissemination is unchallenged. Combine the two and you have a campaign against China as the culprit and the US the victim. The US are wont to plant false flags.

            Date and time
            December 16, 2011, 10:16AM
            • Lobster, and the Chinese are wont to paint themselves as victims when? like always... "everyone picks on china!" is a common cry over there... Well, these days do they wonder why they are not trusted and hated so much?

              The dalai lamer
              Date and time
              December 16, 2011, 10:45AM
              Comments are now closed
              Featured advertisers