Jun 08 2011

In cyberspy vs cyberspy, China has the edge

Category: cyber securityDISC @ 12:11 pm
USA-China

Image via Wikipedia

By Brian Grow and Mark Hosenb

WASHINGTON: As America and China grow more economically and financially intertwined, the two nations have also stepped up spying on each other. Today, most of that is done electronically, with computers rather than listening devices in chandeliers or human moles in tuxedos.And at the moment, many experts believe China may have gained the upper hand.

Though it is difficult to ascertain the true extent of America`s own capabilities and activities in this arena, a series of secret diplomatic cables as well as interviews with experts suggest that when it comes to cyber-espionage, China has leaped ahead of the United States.

According to US investigators, China has stolen terabytes of sensitive data — from usernames and passwords for State Department computers to designs for multi-billion dollar weapons systems. And Chinese hackers show no signs of letting up.

“The attacks coming out of China are not only continuing, they are accelerating,” says Alan Paller, director of research at information-security training group SANS Institute in Washington, DC.

Secret US State Department cables, obtained by WikiLeaks and made available to Reuters by a third party, trace systems breaches — colourfully code-named “Byzantine Hades” by US investigators — to the Chinese military. An April 2009 cable even pinpoints the attacks to a specific unit of China`s People`s Liberation Army.

Privately, US officials have long suspected that the Chinese government and in particular the military was behind the cyber-attacks. What was never disclosed publicly, until now, was evidence.

US efforts to halt Byzantine Hades hacks are ongoing, according to four sources familiar with investigations. In the April 2009 cable, officials in the State Department`s Cyber Threat Analysis Division noted that several Chinese-registered websites were “involved in Byzantine Hades intrusion activity in 2006.”

The sites were registered in the city of Chengdu, the capital of Sichuan Province in central China, according to the cable. A person named Chen Xingpeng set up the sites using the “precise” postal code in Chengdu used by the People`s Liberation Army Chengdu Province First Technical Reconnaissance Bureau (TRB), an electronic espionage unit of the Chinese military. “Much of the intrusion activity traced to Chengdu is similar in tactics, techniques and procedures to (Byzantine Hades) activity attributed to other” electronic spying units of the People`s Liberation Army, the cable says.

Reconnaissance bureaus are part of the People`s Liberation Army`s Third Department, which oversees China`s electronic eavesdropping, according to an October 2009 report by the US-China Economic and Security Commission, a panel created by Congress to monitor potential national security issues related to US-China relations.

Staffed with linguists and technicians, the Third Department monitors communications systems in China and abroad. At least six Technical Reconnaissance Bureaus, including the Chengdu unit, “are likely focused on defence or exploitation of foreign networks,” the commission report states.—Reuters

Cyber War: The Next Threat to National Security and What to Do About It

Tags: Chengdu, china, People's Liberation Army, SANS Institute, Sichuan, Sino-American relations, United States, WikiLeaks


Dec 06 2010

U.S. looks to protect computer networks as rogues hack away

Category: cyber securityDISC @ 10:16 am

By Lolita Baldor

WASHINGTON — It will take several more years for the government to fully install high-tech systems to block computer intrusions, a drawn-out timeline that enables criminals to become more adept at stealing sensitive data, experts say.

As the Department of Homeland Security moves methodically to pare down and secure the approximately 2,400 network connections used every day by millions of federal workers around the world, experts suggest that technology already may be passing them by.

The department that’s responsible for securing government systems other than military sites is slowly moving all the government’s Internet and e-mail traffic into secure networks that eventually will be guarded by intrusion detection and prevention programs. The networks are known as Einstein 2 and Einstein 3.

Progress has been slow, however. Officials are trying to complete complex contracts with network vendors, work out technology issues and address privacy concerns involving how the monitoring will affect employees and public citizens.

The WikiLeaks release of more than a quarter-million sensitive diplomatic documents underscores the massive challenge ahead, as Homeland Security labors to build protections for all of the other, potentially more vulnerable U.S. agencies.

“This is a continuing arms race and we’re still way behind,” said Stewart Baker, former Homeland Security undersecretary for policy.

The WikiLeaks breach affected the government’s classified military network and was as much a personnel gap as a technological failure.

Officials believe the sensitive documents were stolen from secure Pentagon computer networks by an Army intelligence analyst who downloaded them onto a CD.

The changes sought by Homeland Security on the government’s non-military computers would be wider and more systemic than the immediate improvements ordered recently by the Departments of Defense and State as a result of the WikiLeaks releases.

Those changes included improving the monitoring of computer usage and making it harder to move material onto a portable computer flash drive or CD.

Tags: DHS, Einstein 1, Einstein 2, IDP, IDS, Intrusion Detection and Prevention, WikiLeaks