Cold War 2.0 - Cyberhacking

Or to put it another way, all the other countries know what China is doing, but none have the gumption (or clear conscience) to call them up on this, or to pursue collective remediation.  We're all economically co-dependent, therefore we are morally co-dependent at the same time...

Google Inc. (GOOG) and Intel Corp. (INTC) werelogical targets for China-based hackers, given the solid-goldintellectual property data stored in their computers. An attackby cyber spies on iBahn, a provider of Internet services tohotels, takes some explaining.

iBahn provides broadband business and entertainment accessto guests of Marriott International Inc. and other hotel chains,including multinational companies that hold meetings on site.Breaking into iBahn’s networks, according to a senior U.S.intelligence official familiar with the matter, may have lethackers see millions of confidential e-mails, even encryptedones, as executives from Dubai to New York reported back oneverything from new product development to merger negotiations.

More worrisome, hackers might have used iBahn’s system as alaunching pad into corporate networks that are connected to it,using traveling employees to create a backdoor to companysecrets, said Nick Percoco, head of Trustwave Corp.’sSpiderLabs, a security firm.

The hackers’ interest in companies as small as Salt LakeCity-based iBahn illustrates the breadth of China’s spyingagainst firms in the U.S. and elsewhere. The networks of atleast 760 companies, research universities, Internet serviceproviders and government agencies were hit over the last decadeby the same elite group of China-based cyber spies. Thecompanies, including firms such as Research in Motion Ltd. (RIM) andBoston Scientific Corp., range from some of the largestcorporations to niche innovators in sectors like aerospace,semiconductors, pharmaceuticals and biotechnology, according tointelligence data obtained by Bloomberg News.

‘Stealing Everything’

“They are stealing everything that isn’t bolted down, andit’s getting exponentially worse,” said Representative Mike Rogers, a Michigan Republican who is chairman of the PermanentSelect Committee on Intelligence.

China has made industrial espionage an integral part of itseconomic policy, stealing company secrets to help it leapfrogover U.S. and other foreign competitors to further its goal ofbecoming the world’s largest economy, U.S. intelligenceofficials have concluded in a report released last month.

“What has been happening over the course of the last fiveyears is that China -- let’s call it for what it is -- has beenhacking its way into every corporation it can find listed in Dun& Bradstreet,” said Richard Clarke, former special adviser oncybersecurity to U.S. President George W. Bush, at an Octoberconference on network security. “Every corporation in the U.S.,every corporation in Asia, every corporation in Germany. Andusing a vacuum cleaner to suck data out in terabytes andpetabytes. I don’t think you can overstate the damage to thiscountry that has already been done.”

Foreign Governments

In contrast, U.S. cyberspies go after foreign governmentsand foreign military and terrorist groups, Clarke said.

“We are going after things to defend ourselves againstfuture attacks,” he said.

Such accusations intensified when a Nov. 3 report by 14U.S. intelligence agencies fingered China as the No. 1 hackerthreat to U.S. firms. While the Obama administration took theunprecedented step of outing China by name, the White House,U.S. intelligence agencies and members of Congress arestruggling to assess how much damage is being done during suchattacks and what to do to stop them beyond public rebuke.

For now, the administration is concentrating on raisingawareness among company executives and seeking a commitment toimprove security against such attacks. Rogers has a bill pendingin the House that would permit the government to share secretinformation that would help companies spot hacker intrusions,such as signatures of malicious Chinese software.

Consistently Denied Responsibility

China has consistently denied it has any responsibility forhacking that originated from servers on its soil. Geng Shuang, aspokesman for the Chinese embassy in Washington, didn’t respondto several e-mails and phone calls requesting comment. Wang Baodong, another Chinese government spokesman in Washington,also didn’t respond to requests for comment.

Based on what is known of attacks from China, Russia andother countries, a declassified estimate of the value of theblueprints, chemical formulas and other material stolen fromU.S. corporate computers in the last year reached almost $500billion, said Rogers, a former agent for the Federal Bureau ofInvestigation.

Stolen Information

U.S. officials are grappling with how stolen information isbeing used, said Scott Borg, an economist and director of theU.S. Cyber Consequences Unit, a non-profit research institute.Calculating the damage depends on hard-to-know variables, suchas how effectively and quickly thieves can integrate stolen datainto competing products, the senior intelligence official said.

While a precise dollar figure for damage is elusive, theoverall magnitude of the attacks is not, Borg said.

“We’re talking about stealing entire industries,” hesaid. “This may be the biggest transfer of wealth in a shortperiod of time that the world has ever seen.”

The public evidence against China now being rolled out bythe Obama administration, Rogers and others in Congress has beencollected by the intelligence community over several years. Manyof the details remain classified.

The hackers who attacked iBahn are among the most skilledof at least 17 China-based spying operations the U.S.intelligence community has identified, according to a privatesecurity official briefed on the matter who asked not to beidentified because of the subject’s sensitivity.

Massive Espionage Ring

The hackers are part of a massive espionage ring codenamedByzantine Foothold by U.S. investigators, according to a personfamiliar with efforts to track the group. They specialize ininfiltrating networks using phishing e-mails laden with spyware,often passing on the task of exfiltrating data to others.

Segmented tasking among various groups and sophisticatedsupport infrastructure are among the tactics intelligenceofficials have revealed to Congress to show the hacking iscentrally coordinated, the person said. U.S. investigatorsestimate Byzantine Foothold is made up of anywhere from severaldozen hackers to more than one hundred, said the person, whodeclined to be identified because the matter is secret.

“The guys who get in first tend to be the best. If youcan’t get in, the rest of the guys can’t do any work,” saidRichard Bejtlich, chief security officer for Mandiant Corp., anAlexandria, Virginia-based security firm that specializes incyber espionage. “We’ve seen some real skill problems with thepeople who are getting the data out. I guess they figure if theyhaven’t been caught by that point, they’ll have as many chancesas they need to remove the data.”

Secretive Companies

U.S. and other companies have been secretive about thedetails of their computer security. When Google announced in2010 that China-based hackers had raided its networks, it was arare example of a U.S. company publicly revealing acyberburglary aimed at its intellectual property -- in thiscase, its source code.

Mountain View, California-based Google, the world’s largestsearch-engine firm, said at the time that at least 34 othermajor companies were victims of the same attack. However, onlytwo -- Intel and Adobe Systems Inc. (ADBE) -- stepped forward, and theyprovided few specifics.

Google vastly underestimated the scope of the spying.Intelligence documents obtained by Bloomberg News show thatChina-based hackers have hunted technology and informationacross dozens of economic sectors and in some of the mostobscure corners of the economy, beginning in 2001 andaccelerating over the last three years. Many of the victims havebeen hacked more than once.

Byzantine Foothold

One victim of Byzantine Foothold, Associated ComputerSystems, a division of Xerox Corp. (XRX), provides back-officeservices such as accounting and human resources for thousands ofmultinational firms and government agencies in more than 100countries. According to its website, ACS’s expertise includesdigitizing and storing documents, a potential treasure-trove ofinformation on the firm’s corporate clients, including carmakersand computer companies.

Other targets of the group include large companies such asHewlett-Packard Co. (HPQ), Volkswagen AG (VOW) and Yahoo! Inc. (YHOO) Smaller firmsin strategic sectors were also hit, such as iBahn and InnovativeSolutions & Support Inc. (ISSC), which manufactures flight-informationcomputers; as were Massachusetts Institute of Technology, theItalian Academic and Research Network and the California StateUniversity Network.

An informal working group of private-sector cybersecurityexperts and government investigators identified the victims bytracing information sent from hacked company networks to spygroup-operated command-and-control servers, according to aperson familiar with the process. In some cases, the targetsaren’t aware they were hacked.

People’s Liberation Army

Such tracing is sometimes possible because of sloppinessand mistakes made by the spies, said another senior intelligenceofficial who asked not to be named because the matter isclassified. In one instance, a ranking officer in China’sPeople’s Liberation Army, or PLA, employed the same server usedin cyberspying operations to communicate with his mistress, theintelligence official said.

Many of the cyberattacks have been linked to specificChina-related events, a pattern noted by secret diplomaticcables published by WikiLeaks, the anti-secrecy website. Duringthe five-year period beginning in 2006, a second group of China-based hackers ransacked the networks of at least 71 companies,government entities, think-tanks and non-profit groups, saidMcAfee Inc. (MFE), which analyzed information from servers used in theattacks.

‘Operation Shady Rat’

Details of those intrusions were originally published in anAugust report by the cybersecurity firm dubbed “Operation ShadyRat.” The report didn’t name the country where the hackers werebased or identify the private-sector victims. The report’sprincipal author, Dmitri Alperovitch, who now heads his ownfirm, Asymmetric Cyber Operations, confirmed the country wasChina.

In one of the earliest attacks on a company, cyberspieshacked into the computer networks of POSCO, the South Koreansteel giant, in July 2006, Alperovitch said. The intrusion tookplace the same month that the steelmaker, the third largest inthe world, initiated a takeover of a large steel mill in easternChina, according to the U.S.-based Epoch Times, founded bysupporters of the dissident Falun Gong spiritual sect, whichfirst noted a link between the two events.

Earthquakes and Satellites

Two years later, Chinese rescue workers were usingsatellite communications equipment made by the Danish technologyfirm Thrane & Thrane AS (THRAN) following a major earthquake in Sichuanprovince. China Daily, the quasi-official newspaper, had praisedthe Danish equipment’s performance. Alperovitch said the Danishfirm was hacked by the Shady Rat crew three months later.

“With fans like those, who needs enemies?” he said.

John Alexandersen, a spokesman for the Lundtofte, Denmark-based Thrane & Thrane, said although he couldn’t “rule out”that hackers breached their networks, no confidential data wastaken. POSCO (005490) said hackers didn’t access critical networks orintellectual property.

The approval of China’s most recent five-year economic planprovides another possible link between Chinese government policyand cyber-espionage. The plan, approved by the National People’sCongress in March, identifies seven priority industries thatmirror the most prominent targets of China-based cyberspies,according to the two senior U.S. intelligence officials who haveknowledge of the victims.

KPMG International, the auditing firm, said the five-yearplan’s priorities include clean energy; biotechnology; advancedsemiconductors; information technology; high-end manufacturing,such as aerospace and telecom equipment; and biotechnology,including drugs and medical devices.

Same Shopping List

In many cases, the iBahn hackers appear to be working offthe same shopping list, according to intelligence documents.

In the biotechnology sector, their victims include BostonScientific, (BSX) the medical device maker, as well as AbbottLaboratories (ABT) and Wyeth, the drug maker that is now part ofPfizer Inc. (PFE)

The hackers also rifled networks of the Parkland ComputerCenter in Rockville, Maryland, according to documents providedto Bloomberg News by a person involved in government tracking ofthe cyberspies, who declined to be identified because the matterisn’t public. Parkland is the computing center for the Food andDrug Administration, which has access to drug trial information,chemical formulas and other data for almost every important drugsold in the U.S.

Manufacturing Sector

In the manufacturing sector, San Jose, California-basedCypress Semiconductor Corp. (CY), which makes advanced chips fortelecommunications equipment, was a victim, as were AerospaceCorp., which provides scientific research on national security-related space programs, and Environmental Systems ResearchInstitute, a Redlands, California-based company that developsmapping software.

In China, those industries are developing rapidly. Chinesecompanies were involved in 10 of the 13 global technologyinitial public offerings in the third quarter of 2011, accordingto PricewaterhouseCoopers LLP, the global auditing firm. TheChinese firms specialized in information technology,semiconductors and clean energy, like solar power, the PwCreport said.

Driving China’s spike in cyberspying is the reality thathacking is cheaper than product development, especially givenChina’s vast pool of hackers, said a fourth U.S. intelligenceofficial. That pool includes members of its militia, who hack oncommission, the official said. They target computing, hightechnology and pharmaceutical companies whose products take lotsof time and money to develop, the official said.

Byzantine Hades

U.S. counterintelligence authorities have been trackingChina’s cyberspies for years under the classified codenameByzantine Hades, which a March 27, 2009, secret State Departmentcable published by WikiLeaks calls “a group of associatedcomputer network intrusions with an apparent nexus to China.”

Byzantine Foothold, Byzantine Candor and Byzantine Anchorrepresent subsets, or various groups, of the overall Chinesecyber espionage threat, the person familiar with the secrettracking effort said.

Among the victims of Byzantine Foothold are Internetservice providers in more than a dozen countries, includingCanada, Switzerland, Bangladesh, Venezuela and Russia. The ISPsare used as platforms to hack other victims and disguise spyingactivity.

An Oct. 30, 2008, State Department cable described China-based hackers accessing several computer networks of acommercial Internet provider in the U.S. They used the company’ssystems to extract “at least 50 megabytes of e-mail messages andattached documents, as well as a complete list of usernames andpasswords from an unspecified” U.S. government agency, accordingto the cable.

PLA’s Third Department

The cable stated that the hackers were based in Shanghaiand linked to the PLA’s Third Department, a unit of the Chinesemilitary that, according to a 2009 report by the U.S.-ChinaEconomic and Security Review Commission, is responsible forcyber operations.

“Some notion that this isn’t nation-state driven is justfalse,” said Rogers, the House intelligence committee chairman.

Fifteen of the companies and universities identified as hitby the iBahn hackers and contacted by Bloomberg News eitherdeclined to comment, said they had no knowledge of the attack,or didn’t respond to requests for comment. Erik Fallis, aspokesman for the California State University Network, said thatfollowing an investigation, “no evidence was found to suggestthat this event compromised CSU assets.”

Obama administration officials seeking to forge a robustpolicy and diplomatic response are facing few good options, saidClarke, the former White House cyber security official.

UN Security Council

China, a member of the UN Security Council, has the powerto veto multilateral initiatives aimed at the country that passthrough that body.

Sanctions on Chinese goods in sectors that have beenheavily targeted by cyberspies -- green energy, semiconductorsand pharmaceuticals -- would be a problematic solution, probablysparking a trade war, said James Lewis, a cyber security expertat the Center for Strategic and International Studies inWashington.

U.S. government officials considering whether majorcorporate networks should be protected as a national securityasset face opposition even from some victims protective of theInternet’s laissez-fair culture, said Richard Falkenrath, asenior fellow for counterterrorism and national security studiesat the Council on Foreign Relations.

“The situation we are in now is the consequence of threedecades of hands-off approach by government in the developmentof the Internet,” Falkenrath said.

Lack the Leverage

For now, administration officials have correctly assessedthat they lack the leverage to compel China to change itsalleged criminal behavior, he said.

“The Cold War is a pretty good analogy,” Falkenrath said.“There was never any serious effort to change the internalcharacter of Soviet state.”

At a minimum, the November intelligence agency report doesthrow down a marker in that conflict, said Estonian DefenseMinister Mart Laar. Estonia, which suffered a massive cyberattack in 2007 it said originated from Russia -- is pushing fora NATO cyber defense alliance.

“I remember how the Cold War was changed, and you couldfor the first time feel the Soviet defeat coming when Ronald Reagan called the Evil Empire evil,” Laar said.

To contact the reporters on this story:Michael Riley in Washingtonat michaelriley@bloomberg.net;John Walcott in Washingtonat jwalcott9@bloomberg.net.

To contact the editor responsible for this story:Michael Hytha at mhytha@bloomberg.net.