Hackers who appear to be based in China have conducted a "coordinated,
covert and targeted" campaign of cyber espionage against major Western
energy firms, according to a report expected to be issued Thursday by
cybersecurity firm McAfee Inc.
Law-enforcement agencies said they are investigating the incidents,
which McAfee said have been going on at least since late 2009 but may
have started as early as 2007. The company said the attacks, which
they dubbed "Night Dragon," were still occurring.
McAfee said the hackers targeted five multinational firms, but
wouldn't identify the companies by name because some of them are
clients. McAfee said it was sharing the findings "to protect those not
yet impacted and to repair those who have been." Asked if they were
victims of the hacking, BP PLC and ExxonMobil Inc., among other large
oil companies, declined to comment. Chevron Corp. said it wasn't aware
of any successful hacks into the company's data systems by Night
Dragon.
Sensitive Internal Documents Taken
According to McAfee, the cyberattacks successfully took gigabytes of
highly sensitive internal documents, including proprietary information
about oil- and gas-field operations, project financing and bidding
documents. And that pattern of espionage, the company said, should
raise fresh alarms in the corporate world about information theft.
"While Night Dragon attacks focused specifically on the energy sector,
the tools and techniques of this kind can be highly successful when
targeting any industry," the report states.
McAfee and its competitors have an incentive for publicizing threats
like Night Dragon because they are in the business of selling
cybersecurity services. The company has informed the FBI of its
report, which said it was investigating the attacks and took the
matter seriously.
U.S. intelligence agencies have warned in recent years that China is
developing sophisticated cyber warfare strategies which could be used
to attack governments and key industries. China, the second-largest
economy after the U.S., is keenly interested in competing for energy
resources around the world to fuel domestic growth.
"It's important to get this out in public discussion, so companies can
identify that kind of threat," said Ron Plesco, CEO of the National
Cyber Forensic Training Alliance Foundation, a group that tracks
cybercrime threats. "And sharing information adds toward the ultimate
goal of mitigation."
The Night Dragon attacks used hacking tools that exploited Microsoft
Corp. operating systems and remote administration tools to copy and
extract information, according to McAfee. It appears to have been
designed purely for spying. "We saw no evidence of sabotage
activities" in these attacks, said Dmitri Alperovitch, vice president
of threat research at McAfee.
Trail Leads Back to China
Mr. Alperovitch said researchers were able to trace data taken from
those companies back to Chinese Internet addresses in Beijing. The
hacking tools used were mainly of Chinese origin, he said and the
hackers didn't take steps to cover their tracks.
"These individuals almost seemed like company worker bees," he said.
"They operated on a strict weekdays, nine-to-five Beijing time-zone
schedule."
Through forensic research, McAfee identified one individual who
appeared to provide the external servers used by the hackers. McAfee
identified this individual as Song Zhiyue, based in Heze City,
Shandong Province, China. It is unclear to what extent Mr. Song might
have been aware of the espionage. McAfee believes many actors
participated in these attacks.
Mr. Alperovitch said it was unclear if the attacks were done with any
official sanction. "The facts point to Chinese hacker activity that is
organized, so [it is] potentially directed either by the private
sector or the public sector. But it's impossible for me to know for
sure which one," he said.
Wang Baodong, a spokesman for the Chinese embassy in Washington, said
he had no knowledge of the report, but added that past allegations
about Chinese hacking had been raised unfairly. "China has very strict
laws against hacking activities, and China is also a victim of such
activity," he said.
A 2010 Defense Department report to Congress on Chinese military
capabilities said computer systems around the world, including U.S.
government networks, had been the target of intrusions that appear to
originate from China. The report added that it was unclear if those
intrusions were done at the behest of the Chinese military of elements
of the Chinese government.
Early last year, Google Inc. took the unusual step of complaining
publicly about sophisticated cyberattacks that it claimed had
originated in China. McAfee investigated those attacks, which it
dubbed Operation Aurora. Leaked U.S. diplomatic cables collected by
the WikiLeaks website included allegations that the attacks were
ordered by top Chinese leaders.
No comments:
Post a Comment