Source: DTN News - - This article compiled by Roger Smith from reliable sources By NATHAN HODGE And ADAM ENTOUS - The Wall Street Journal
Law-enforcement agencies said they are investigating the incidents, which McAfee said have been going on at least since late 2009 but may have started as early as 2007. The company said the attacks, which they dubbed "Night Dragon," were still occurring.
McAfee said the hackers targeted five multinational firms, but wouldn't identify the companies by name because some of them are clients. McAfee said it was sharing the findings "to protect those not yet impacted and to repair those who have been." Asked if they were victims of the hacking, BP PLC and ExxonMobil Inc., among other large oil companies, declined to comment. Chevron Corp. said it wasn't aware of any successful hacks into the company's data systems by Night Dragon.
Sensitive Internal Documents Taken
According to McAfee, the cyberattacks successfully took gigabytes of highly sensitive internal documents, including proprietary information about oil- and gas-field operations, project financing and bidding documents. And that pattern of espionage, the company said, should raise fresh alarms in the corporate world about information theft.
"While Night Dragon attacks focused specifically on the energy sector, the tools and techniques of this kind can be highly successful when targeting any industry," the report states.
McAfee and its competitors have an incentive for publicizing threats like Night Dragon because they are in the business of selling cybersecurity services. The company has informed the FBI of its report, which said it was investigating the attacks and took the matter seriously.
U.S. intelligence agencies have warned in recent years that China is developing sophisticated cyber warfare strategies which could be used to attack governments and key industries. China, the second-largest economy after the U.S., is keenly interested in competing for energy resources around the world to fuel domestic growth.
"It's important to get this out in public discussion, so companies can identify that kind of threat," said Ron Plesco, CEO of the National Cyber Forensic Training Alliance Foundation, a group that tracks cybercrime threats. "And sharing information adds toward the ultimate goal of mitigation."
The Night Dragon attacks used hacking tools that exploited Microsoft Corp. operating systems and remote administration tools to copy and extract information, according to McAfee. It appears to have been designed purely for spying. "We saw no evidence of sabotage activities" in these attacks, said Dmitri Alperovitch, vice president of threat research at McAfee.
Trail Leads Back to China
Mr. Alperovitch said researchers were able to trace data taken from those companies back to Chinese Internet addresses in Beijing. The hacking tools used were mainly of Chinese origin, he said and the hackers didn't take steps to cover their tracks.
"These individuals almost seemed like company worker bees," he said. "They operated on a strict weekdays, nine-to-five Beijing time-zone schedule."
Through forensic research, McAfee identified one individual who appeared to provide the external servers used by the hackers. McAfee identified this individual as Song Zhiyue, based in Heze City, Shandong Province, China. It is unclear to what extent Mr. Song might have been aware of the espionage. McAfee believes many actors participated in these attacks.
Mr. Alperovitch said it was unclear if the attacks were done with any official sanction. "The facts point to Chinese hacker activity that is organized, so [it is] potentially directed either by the private sector or the public sector. But it's impossible for me to know for sure which one," he said.
Wang Baodong, a spokesman for the Chinese embassy in Washington, said he had no knowledge of the report, but added that past allegations about Chinese hacking had been raised unfairly. "China has very strict laws against hacking activities, and China is also a victim of such activity," he said.
A 2010 Defense Department report to Congress on Chinese military capabilities said computer systems around the world, including U.S. government networks, had been the target of intrusions that appear to originate from China. The report added that it was unclear if those intrusions were done at the behest of the Chinese military of elements of the Chinese government.
Early last year, Google Inc. took the unusual step of complaining publicly about sophisticated cyberattacks that it claimed had originated in China. McAfee investigated those attacks, which it dubbed Operation Aurora. Leaked U.S. diplomatic cables collected by the WikiLeaks website included allegations that the attacks were ordered by top Chinese leaders.
DTN NEWS ON TWITTER (30 SUBJECTS)
The allegation stems from a report published by a group of U.S. and Canadian computer security researchers who monitored a spying operation, observing the trails of the hackers as they pilfered classified and restricted documents from India's Defense Ministry.
Among the systems believed to have been hacked is the Shakti, the newly introduced artillery combat and control system of the Indian army, and the Iron Dome, the country's mobile missile defense system, local media reported.
According to the report, researchers based at the Munk School of Global Affairs at the University of Toronto managed to provide a detailed account of the spying operation called Shadow Network, documenting not only what material had been hacked but accessing confidential documents, also, about India's relations in West Africa, Russia and the Middle East.
While the identity and designs of the intruders have yet to be determined, the researchers traced the spy operation to computer servers in Chengdu, western China.
The findings of the report have sparked concern within the ranks of the government in India, which said earlier this week that it was investigating the allegations.
"This is a serious issue and we are looking into it," Sitansu Kar, a spokesman for the ministry, was quoted as saying in Business Week report.
The allegations follow a move by Google Inc. to redirect users of its Chinese Web site to Hong Kong "to avoid the nation's censorship laws after the U.S. company said it had detected cyberattacks from mainland on human-rights activists," Business Week reported.
At the time, the case underscored mounting concerns over the growing trend of cyber espionage. Ahead of the report's publication, India stopped short of acknowledging that government networks had been attacked by China, saying that "no one attempt had been successful."
Chinese officials have since then rebuffed any allegation of involvement.
"The Chinese government considers hacking a cancer to the whole of society," said Ye Lao, a state official in Western China.
The Dalai Lama's office was also part of the research.
"From what we are seeing, the people attacking our computers have a very systematic approach to reading our private communications," said Tenzin Takhla, the exiled Tibetan leader's secretary.
"What the experts have told us is that they these are coming out of China, and that makes sense."
