Skip to content

Google attack part of widespread spying effort

U.S. firms face ongoing espionage from China

Computer World

By Robert McMillan with contribution from John Ribeiro and Jeremy Kirk

DG News Service – Google’s decision Tuesday to risk walking away from the world’s largest Internet market may have come as a shock, but security experts see it as the most public admission of a top IT problem for U.S. companies: ongoing corporate espionage originating from China.

It’s a problem that the U.S. lawmakers have complained about loudly. In the corporate world, online attacks that appear to come from China have been an ongoing problem for years, but big companies haven’t said much about this, eager to remain in the good graces of the world’s powerhouse economy.

Google, by implying that Beijing had sponsored the attack, has placed itself in the center of an international controversy, exposing what appears to be a state-sponsored corporate espionage campaign that compromised more than 30 technology, financial and media companies, most of them global Fortune 500 enterprises.

The U.S. government is taking the attack seriously. Late Tuesday, U.S. Secretary of State Hillary Clinton released a statement asking the Chinese government to explain itself, saying that Google’s allegations “raise very serious concerns and questions.”

“The ability to operate with confidence in cyberspace is critical in a modern society and economy,” she said.

The search-engine company first learned it had a security problem in mid-December, coincidentally just days after hosting a closed-door symposium on circumventing censorship. Soon the company’s security team realized that it was dealing with more than just a few hacked workstations.

“First, this attack was not just on Google. As part of our investigation we have discovered that at least twenty other large companies from a wide range of businesses — including the Internet, finance, technology, media and chemical sectors — have been similarly targeted,” wrote Google Chief Legal Officer David Drummond in a Tuesday blog posting. “Second, we have evidence to suggest that a primary goal of the attackers was accessing the Gmail accounts of Chinese human rights activists.”

Drummond said that the hackers never got into Gmail accounts via the Google hack, but they did manage to get some “account information (such as the date the account was created) and subject line.”

That’s because they apparently were able to access a system used to help Google comply with search warrants by providing data on Google users, said a source familiar with the situation, who spoke on condition of anonymity because he was not authorized to speak with the press. “Right before Christmas, it was, ‘Holy s***, this malware is accessing the internal intercept [systems],'” he said.

That, in turn led to a Christmas Eve meeting led by Google co-founder Larry Page to assess the situation. Three weeks later, the company had decided that things were serious enough that it would risk walking away from the largest market of Internet users in the world.

Drummond, in his blog post, said that — in part due to this incident — Google would no longer censor search results in China, a move that could cause its Web site to be blocked by the Chinese government.

Corporate IT workers have come to expect all sorts of Internet attacks from China in recent years, but because of the distributed nature of the Internet, it’s very hard to determine the true source of a cyber attack. For several hundred dollars, criminals from any country can buy so-called bulletproof hosting in China. These servers are guaranteed not to be taken down, even if they are linked to spam or other illegal online activity.

In this case, however, Google believes the attacks really were state sponsored, said Leslie Harris, president and CEO of the Center for Democracy and Technology. “They wouldn’t be taking an action suggesting that they cannot operate in China … if it was not related to the Chinese government,” she said.

Google’s security team eventually managed to gain access to a server that was used to control the hacked systems, and discovered that it was not the only company to be hit. In fact, 33 other companies had also been compromised, including Adobe Systems, according to several sources familiar with the situation.

On Jan. 2 Adobe learned of “a computer security incident involving a sophisticated, coordinated attack against corporate network systems managed by Adobe and other companies,” the company said in a blog post published just minutes after Google went public with its account of the hacking incident. An Adobe spokeswoman declined to comment on whether or not the Google and Adobe attacks were related.

Other companies that have been hit include “Internet, finance, technology, media and chemical sectors,” Drummond said.

On Tuesday Yahoo — another likely target — declined to say whether it had been hit, but the company did issue a brief statement in support of Google. These “kinds of attacks are deeply disturbing,” Yahoo said.

Microsoft said even less about the incident. “We have no indication that any of our mail properties have been compromised,” the company said via e-mail.

“We’ve never seen any attacks that were on this large of a scale and were this successful against private companies,” said Eli Jellenc, head of international threat intelligence with Verisign’s iDefense security unit.

IDefense was called in to help some of the victim companies that Google had uncovered. According to Jellenc, the hackers sent targeted e-mail messages to victims that contained a malicious attachment containing what’s known as a zero-day attack. These attacks are typically not detected by antivirus vendors because they exploit a previously unknown software bug.

“There is an attack exploiting a zero-day vulnerability in one of the major document types,” Jellenc said. “They infect whichever users they can, and leverage any contact information or any access information on the victim’s computer to misrepresent themselves as that victim.” The goal is to “infect someone with administrative access to the systems that hold the intellectual property that they’re trying to obtain,” he added.

Once they have the data they move it out of the corporate network.

The attacks followed the same game plan that security experts have seen in attacks on non-governmental organizations and the defense industry, where contractors and government agencies have been hit with similar targeted spying attacks for years now. Some of Verisign’s defense partners said that they’d seen some of the same IP addresses used in previous, “very similar attacks,” Jellenc said.

“Whomever is doing this, this isn’t their first attack,” he said. “These contractors also confirmed the China origin of the attacks.”

This type of attack was described in detail in an October Northrop Grumman report, (pdf) commissioned by the US-China Economic and Security Review Commission. Analysts concluded that “China is likely using its maturing computer network exploitation capability to support intelligence collection against the U.S. government and industry by conducting a long term, sophisticated computer network exploitation campaign.”

At least 10 to 20 terabytes of sensitive data had been taken from U.S. government networks as part of what the report’s authors called a “long term, persistent campaign to collect sensitive but unclassified information.”

For the past few years, China has been focused on moving its economy to the next level, said James Mulvenon, director of Defense Group Inc.’s Center for Intelligence Research and Analysis. China built its economy processing products for export, but it is not known for cutting-edge research and development. The country has been taking steps to spur innovation within its borders, pressuring multinational companies to build research labs in China and developing the talent to eventually replace these businesses with indigenous competitors.

Mulvenon doesn’t find it implausible that a nation such as China would spy on U.S. companies.

“If you’re having trouble [innovating] or if you want to prime the pump, the best way is to go out and steal cutting-edge IP,” he said. “It’s a plausible explanation for why they would go after Silicon Valley companies on such a broad scale because they’re really trying to jump start IT innovation in China.”

View the original article at Computer World

Related Posts with Thumbnails

Posted in Computing, Internet, Police & Crime.

Tagged with , , , .

0 Responses

Stay in touch with the conversation, subscribe to the RSS feed for comments on this post.

Some HTML is OK

or, reply to this post via trackback.

Support #altnews & keep Dark Politricks alive

Remember I told you over 5 years ago that they would be trying to shut down sites and YouTube channels that are not promoting the "Official" view. Well it's all happening now big time. Peoples Channels get no money from YouTube any more and Google is being fishy with their AdSense giving money for some clicks but not others. The time is here, it's not "Obama's Internet Cut Off Switch" it's "Trumps Sell Everyones Internet Dirty Laundry Garage Sale". This site must be on some list at GCHQ/NSA as my AdSense revenue which I rely on has gone down by a third. Either people are not helping out by visiting sponsors sanymore or I am being blackballed like many YouTube sites.

It's not just Google/YouTube defunding altenative chanels (mine was shut), but Facebook is also removing content, shutting pages, profiles and groups and removing funds from #altnews that way as well. I was recently kicked off FB and had a page "unpublished" with no reason given. If you don't know already all Facebooks Private Messages and Secret Groups are still analysed and checked for words related to drugs, sex, war etc against their own TOS. Personally I know there are undercover Irish police moving from group to group cloning peoples accounts and getting people booted. Worse than that I know some people in prison now for the content they had on their "secret private group". Use Telegrams secret chat mode to chat on, or if you prefer Wickr. If you really need to, buy a dumb phone with nothing for the NSA/GCHQ to hack into. Ensure it has no GPS tracking on it and that the battery can be removed. These are usually built for old people to get used to technology storing only a set of numbers to call. However they have no games, applications to install or other ways people can exploit the computer tracking device you carry round with you most of the day - your smart phone. If you are paranoid ensure that you can remove the battery when travelling around and do so to prevent GPS tracking or phone mast triangulation. Even with your phone in Flight mode or turned off, it can be turned on remotely and any features like front or back cameras, microphones and keylogging software can be installed to trace you.

So if your not supporting this site already which brings you news from the Left to the Right (really the same war mongering rubbish) then I could REALLY do with some..

Even if it's just £5 or tick the monthly subscription box and throw a few pound my way each month, it will be much appreciated. Read on to find out why.


Any support to keep this site would be appreciated. You could set up a monthly subscription for £2 like some people do or you could pay a one off donation as a gift.
I am not asking you to pay me for other people's articles, this is a clearing house as well as place to put my own views out into the world. I am asking for help to write more articles like my recent false flag gas attack to get WWIII started in Syria, and Trump away from Putin. Hopefully a few missiles won't mean a WikiLeaks release of that infamous video Trump apparently made in a Russian bedroom with Prostitutes. Also please note that this article was written just an hour after the papers came out, and I always come back and update them.

If you want to read JUST my own articles then use the top menu I have written hundreds of articles for this site and I host numerous amounts of material that has seen me the victim of hacks, DOS plus I have been kicked off multiple hosting companies, free blogging sites, and I have even had threats to cease and desist from the US armed forces. Therefore I have to pay for my own server which is NOT cheap. The more people who read these article on this site the more it costs me so some support would be much appreciated.

I have backups of removed reports shown, then taken down after pressure, that show collusion between nations and the media. I have the full redacted 28/29 pages from the 9.11 commission on the site which seems to have been forgotten about as we help Saudi Arabia bomb Yemeni kids hiding in the rubble with white phosphorus, an illegal weaapon. One that the Israeli's even used when they bombed the UN compound in Gaza during Operation Cast Lead. We complain about Syrian troops (US Controlled ISIS) using chemical weapons to kill "beautiful babies". I suppose all those babies we kill in Iraq, Yemen, Somalia and Syria are just not beautiful enough for Trumps beautiful baby ratio. Plus we kill about 100 times as many as ISIS or the Syrian army have managed by a factor of about 1000 to 1.

I also have a backup of the FOX News series that looked into Israeli connections to 9.11. Obviously FOX removed that as soon as AIPAC, ADL and the rest of the Hasbra brigade protested.

I also have a copy of the the original Liberal Democrats Freedom Bill which was quickly and quietly removed from their site once they enacted and replaced with some watered down rubbish instead once they got into power. No change to police tactics, protesting or our unfair extradition treaty with the USA but we did get a stop to being clamped on private land instead of the mny great ideas in the original.

So ANY support to keep this site running would be much appreciated! I don't have much money after leaving my job and it is a choice between shutting the server or selling the domain or paying a lot of money just so I can show this material.

Material like the FSB Bombings that put Putin in power or the Google no 1 spot when you search for protecting yourself from UK Police with "how to give a no comment interview". If you see any adverts that interest you then please visit them as it helps me without you even needing to give me any money. A few clicks per visit is all it takes to help keep the servers running and tag any tweets with alternative news from the mainstream with the #altnews hashtag I created to keep it alive!

However if you don't want to use the very obvious and cost free ways (to you) to help the site and keep me writing for it then please consider making a small donation. Especially if you have a few quid sitting in your PayPal account doing nothing useful. Why not do a monthly subscription for less money instead. Will you really notice £5 a month?