22 ms·

Chinese Army Unit Is Seen as Tied to Hacking Against U.S.

198 points by gcv 14y ago

WestCoastJustin 14y ago
Here is a direct link to the 76 page report: http://intelreport.mandiant.com/Mandiant_APT1_Report.pdf http://intelreport.mandiant.com/Mandiant_APT1_Report.pdf
- count 14y ago
  Does the report detail how the IP space is tracked to a physical neighborhood? That's....sort of critically important here.
  - count 14y ago
    It says the IPs were determined to geo-locate to the Pudong New Area in Shanghai, and jumped from there straight to the PLA Unit that happens to be in Shanghai. No big leap, Pudong only has 5 million inhabitants, roughly the size of the Washington DC Metro area.
    - contingencies 14y ago
      Shanghai is defined by a river. The old town to the west, the new town to the east. Pudong literally means ("east of the river"). Pudong is metaphorically as well as physically fully half of Shanghai.
  - cscurmudgeon 14y ago
    From the article "Mandiant discovered that two sets of I.P. addresses used in the attacks were registered in the same neighborhood as Unit 61398’s building. “It’s where more than 90 percent of the attacks we followed come from,” said Mr. Mandia. The only other possibility, the report concludes with a touch of sarcasm, is that “a secret, resourced organization full of mainland Chinese speakers with direct access to Shanghai-based telecommunications infrastructure is engaged in a multiyear enterprise-scale computer espionage campaign right outside of Unit 61398’s gates.”"
- nikcub 14y ago
  Mandiant also released a video which is a screen capture of an alleged Chinese hacker ('doda') at work: http://www.youtube.com/watch?v=6p7FqSav6Ho http://www.youtube.com/watch?v=6p7FqSav6Ho edit: One quick conclusion. it looks like their teams are segmented - you have the guys like Doda who are doing the grunt work of sending out the emails and extracting information. These guys get discovered. Who isn't being discovered are the tools and exploit writers, a much more interesting target to uncover. Doda doesn't seem to be a terribly sophisticated hacker, he looks like an ordinary computer user that has been trained to use the tools. Using emails with sequential ID's in them and opening your own computer up to being owned suggests further that he isn't very sophisticated.
xfs 14y ago
I would like to quote a past comment http://www.reddit.com/r/netsec/comments/m0i93/_/c2x87tb http://www.reddit.com/r/netsec/comments/m0i93/_/c2x87tb - the volume of attack coming from Chinese IP addresses but are essentially non-Chinese in origin is substantial. The windows xp piracy rate ends up in a very low uptake of windows update, leaving quite possibly the largest population of vulnerable hosts in the world. Attacks end up being false-flag even if not intended - Attacks that are genuinely Chinese in origin tend towards being citizen initiatives. Imagine if you lived in a jurisdiction where instead of being treated like Garry McKinnon for attacking American infrastructure, just nobody gives a fuck. The reverse also applies, but has a limit that Chinese is not widely understood by American 'hackers'. Any Chinese skiddie can cause an international incident by trying out their tools on an American company. Universities that run courses in infosec, of which some are military, are commonly accused origin IPs for attacks. The likelihood is that complacence, rather than official sponsorship or policy is the prime driver behind this phenomenon. - Instead of trying to build out \cough\\ cybercommands, Government sponsored CTF tournaments identify and reward talent, without bringing it on-board the National Security apparatus. Talent is left out in the community on the understanding it can be found if needed. - The 'Chinese Government' is nowhere near as cohesive and controlling as is depicted in Western sources. Government sponsored economic espionage activities that are out of proportion to American efforts against the rest of the world will originate at the provincial level. Chinese industry is very regional, with whole provinces specializing in specific industries, hence the benefits of economic espionage is highly regional in nature too. It is not in the central government's interests to sustain the Chinese hacker folklore, nor would it be within their ability to rein in any provincial government involvement.
- amalag 14y ago
  Yes a government response to this sort of guerrila warfare against unnamed attackers will be interesting. They cannot just create strong penalties as the attackers are beyond their jurisdiction. Punishing China for anything within their IP space is also a non-starter, something the authors do not mention.
- cscurmudgeon 14y ago
  This is a very recent report. Your comment is more than a year old. Are you asserting that nothing has changed? Edit: From the report in the article "Our research and observations indicate that the Communist Party of China (CPC,中国共产党) is tasking the Chinese People’s Liberation Army (PLA,中国人民解放军) to commit systematic cyber espionage and data theft against organizations around the world " They have a whole section devoted to backing this up.
jkat 14y ago
Does the US risk being seen as a dog with a loud bark but no bite here? If you're going to make pronouncements that hacking will be considered an act of war (1), don't you kinda paint yourself into a corner when you get hacked? (1) http://www.guardian.co.uk/world/2011/may/31/washington-moves-to-classify-cyber-attacks http://www.guardian.co.uk/world/2011/may/31/washington-moves...
- mtgx 14y ago
  I don't know why they (Obama and his advisers) ever thought that was a good idea. Whoever was planning to hack US never took that seriously anyway, and now that they've seen they won't actually do it, they can take them even less seriously. I guess they couldn't just say "you hack us, we hack you back". Or more realistically: "We hack you first in secret. Then you hack us back in secret. And then we have an excuse to go public to get the public's support to hack you back, and get more funding and bills passed for whatever other secret operations we want to do next". Case in point: Iran.
- xyzzy123 14y ago
  OK, so the link you provided is a gross simplification of current thinking. Government officials have been quite clear that CNE[1] is NOT generally considered an act of war, rather, it's part of the usual intelligence operations expected during peacetime. It's CNA (e.g. operations designed specifically to disrupt or destroy civilian or military targets) which is "on the table" for act-of-war status, particularly if there is kinetic effect. An example would be if something like Stuxnet were deployed against the U.S. power grid. The idea is that it doesn't matter whether a power plant was disabled via a bomb or a backdoor. Both the intent and the outcome are the same. So the declaration of policy you linked to is really a clarification rather than a "change of course". The lines are blurry when it comes to CNE and critical infrastructure. The problem you have is that if, say, 3 competing agencies are all vying for control of the same powerplant for CNE reasons (e.g. not trying to cause damage), the plant might nonetheless get taken out by accident. I'm not sure anyone is clear on what to do in that kind of a situation. [1] We can divide "cyber" operations into the following categories (straight from wikipedia): * Computer Network Attack (CNA): Includes actions taken via computer networks to disrupt, deny, degrade, or destroy the information within computers and computer networks and/or the computers/networks themselves. * Computer Network Defense (CND): Includes actions taken via computer networks to protect, monitor, analyze, detect and respond to network attacks, intrusions, disruptions or other unauthorized actions that would compromise or cripple defense information systems and networks. Joint Pub 6.0 further outlines Computer Network Defense as an aspect of NetOps * Computer Network Exploitation (CNE): Includes enabling actions and intelligence collection via computer networks that exploit data gathered from target or enemy information systems or networks.
contingencies 14y ago
I've been in China on and off for ~7 of the last 10-11 years. During that time I was once asked to write an online forum / comment scanning system by an employer in Shanghai that could trace keyword usage. It was supposed to be for marketing purposes but I didn't trust that claim. Needless to say I didn't write the system. No idea who the employer was, or whether it's related. I've also met some people that have worked on the public security bureau's CCTV systems, and others who work in Beijing/Tianjin with government for computer security projects. I think the western military-industrial and government security industry wants to daemonize China as justification for spending. Realistically, at the global geostrategic level, China is already beating them at their own game, ie. pure capitalism behind a facade of diplomacy and social concern. Personally I would posit that the major area of conflict right now between China and the US is probably Burma, not some random server providing a pitifully limited window in to the vast bureaucratic engines of US governance.
- cscurmudgeon 14y ago
  Do you really think they are just trying to demonize China given that there have been attacks to control critical infrastructure?
  - greghinch 14y ago
    Considering the degree that defense spending props up the US economy, yes.
    - cscurmudgeon 14y ago
      That does not show anything. A motive perhaps, but nothing more. On the other hand, we have stark evidence of China being nefarious right in front of us.
      - greghinch 14y ago
        Eh, most of what they are doing is corporate espionage with the intent of copying and cost cutting. If your business is susceptible to being undercut on price alone, your days are numbered regardless.
joe_the_user 14y ago
I would assume that the most effective counter-strategy would be something like a poisoned honey-pot approach: Make a large scale effort to start feeding fake information to intruders and see what happens. You probably couldn't do something like this but it's interesting to think about: http://en.wikipedia.org/wiki/Siberian_pipeline_sabotage http://en.wikipedia.org/wiki/Siberian_pipeline_sabotage
- walshemj 14y ago
  This is what allegedly happend with concodrski (the Russian version of concord) blueprints with design flaws where leaked to the russians.
  - stcredzero 14y ago
    What about AAMRAM-ski and Raptor-ski? (I just like the sound.)
martian 14y ago
"Mandiant discovered several cases in which attackers logged into their Facebook and Twitter accounts to get around China’s firewall that blocks ordinary citizen’s access, making it easier to track down their real identities." Amazing.
- nikcub 14y ago
  could you explain this further? I re-read this line a few times but didn't understand. How would logging into their FB and Twitter accounts get them around the Great Firewall?
  - pygatea 14y ago
    I assumed that this meant the attackers logged into their own social network accounts while they were "inside" (i.e. using) compromised machines in the target locations.
    - nikcub 14y ago
      That makes sense, thanks. I didn't think they would be silly enough to do that.
  - deleted 14y ago
    [deleted]
  - deleted 14y ago
    [deleted]
Metapony 14y ago
Great, now these Chinese hackers will be more careful in the future and harder to track.
thomasjames 14y ago
Time for some technically literate people in Washington and some patriotic hackers.
hooande 14y ago
I believe that Chinese hackers are the scariest thing in the world today. I think that the threat from cyber warfare might be slightly overblown (though the next pearl harbor will most likely be a cyber attack). The real threat is the fact that no digital information can be kept secret anymore. If Chinese hackers want what's on a given hard disk, there's no way to stop them. People absolutely freak out when they suspect the US government of spying on a citizen. But chinese hackers, state sponsored or not, seem to be able to roam with impunity. Several US companies have had their ip stolen and their businesses ruined. Companies have lost as much as a billion dollars in ip in a single night. [1] There are so many of them with such diversity of skills that almost no one is safe. I'm not trying to rattle sabers here, just pointing out that the world is facing a threat to privacy and secrecy that is greater than we have ever known. Chinese hackers have more power than the CIA, KGB and Gestapo combined, and nothing short of WWIII can slow them down. [1] http://www.nytimes.com/2012/04/03/opinion/how-china-steals-our-secrets.html http://www.nytimes.com/2012/04/03/opinion/how-china-steals-o...
- unimpressive 14y ago
  >I believe that Chinese hackers are the scariest thing in the world today. I'm much more worried about nuclear weapons, Authoritarianism, and biological warfare.
  - lostlogin 14y ago
    The Chinese government?
    - unimpressive 14y ago
      I'm not exceptionally worried about China's nukes. They understand MAD. I'm more worried about the middle east. Authoritarianism is more worrying if it's in the country I'm standing on. My main fear with biological warfare is non-state actors. As it becomes possible to do more with less, the chances of fundamentalists and other malicious parties using biological agents for terrorism or worse go up.
OGinparadise 14y ago
By DAVID E. SANGER, DAVID BARBOZA and NICOLE PERLROTH I hope you have no dirty laundry in your e-mail accounts, the Chinese military is probably reading them right now. Lit it or not, what the Chinese are doing is pretty smart, let' face it. Countries launch (ed) wars to get what they want, the Chinese get it the easy way.
jinbakei 14y ago
NY Times is just making bullshit...
- berntb 14y ago
  >> NY Times is just making bullshit... 50 cent army? :-)
omartinez 14y ago
Timing of this news is interesting, for the lack of a better word in describing it. This article is published the same week as CISPA comes back. The news on Chinese cyber attacks to the US can help give a boost in public support to these laws, giving them valid reasoning to give away our online privacy.
sampsonjs 14y ago
"In vague to non-existent evidence, Gray Lady hacks see absolute proof of what their government handlers want you to believe". Word must have come down from the White House to start pushing the "Cold War with China" kick.
blablabla123 14y ago
I wonder if the New York Times and other high profile News papers could be more easy on such allegations. This only improves the Cold War atmosphere some political analysts predict since years. It is also naive to assume that there is a G8 nation without a cyber warfare unit in the Army. Or to assume that other nations don't do covert operations. FUD has finally arrived in the mainstream.

198 points by gcv 14y ago

Here is a direct link to the 76 page report: http://intelreport.mandiant.com/Mandiant_APT1_Report.pdf http://intelreport.mandiant.com/Mandiant_APT1_Report.pdf

count 14y ago
Does the report detail how the IP space is tracked to a physical neighborhood? That's....sort of critically important here.
- count 14y ago
  It says the IPs were determined to geo-locate to the Pudong New Area in Shanghai, and jumped from there straight to the PLA Unit that happens to be in Shanghai. No big leap, Pudong only has 5 million inhabitants, roughly the size of the Washington DC Metro area.
  - contingencies 14y ago
    Shanghai is defined by a river. The old town to the west, the new town to the east. Pudong literally means ("east of the river"). Pudong is metaphorically as well as physically fully half of Shanghai.
- cscurmudgeon 14y ago
  From the article "Mandiant discovered that two sets of I.P. addresses used in the attacks were registered in the same neighborhood as Unit 61398’s building. “It’s where more than 90 percent of the attacks we followed come from,” said Mr. Mandia. The only other possibility, the report concludes with a touch of sarcasm, is that “a secret, resourced organization full of mainland Chinese speakers with direct access to Shanghai-based telecommunications infrastructure is engaged in a multiyear enterprise-scale computer espionage campaign right outside of Unit 61398’s gates.”"
nikcub 14y ago
Mandiant also released a video which is a screen capture of an alleged Chinese hacker ('doda') at work: http://www.youtube.com/watch?v=6p7FqSav6Ho http://www.youtube.com/watch?v=6p7FqSav6Ho edit: One quick conclusion. it looks like their teams are segmented - you have the guys like Doda who are doing the grunt work of sending out the emails and extracting information. These guys get discovered. Who isn't being discovered are the tools and exploit writers, a much more interesting target to uncover. Doda doesn't seem to be a terribly sophisticated hacker, he looks like an ordinary computer user that has been trained to use the tools. Using emails with sequential ID's in them and opening your own computer up to being owned suggests further that he isn't very sophisticated.

xfs 14y ago

I would like to quote a past comment http://www.reddit.com/r/netsec/comments/m0i93/_/c2x87tb http://www.reddit.com/r/netsec/comments/m0i93/_/c2x87tb - the volume of attack coming from Chinese IP addresses but are essentially non-Chinese in origin is substantial. The windows xp piracy rate ends up in a very low uptake of windows update, leaving quite possibly the largest population of vulnerable hosts in the world. Attacks end up being false-flag even if not intended - Attacks that are genuinely Chinese in origin tend towards being citizen initiatives. Imagine if you lived in a jurisdiction where instead of being treated like Garry McKinnon for attacking American infrastructure, just nobody gives a fuck. The reverse also applies, but has a limit that Chinese is not widely understood by American 'hackers'. Any Chinese skiddie can cause an international incident by trying out their tools on an American company. Universities that run courses in infosec, of which some are military, are commonly accused origin IPs for attacks. The likelihood is that complacence, rather than official sponsorship or policy is the prime driver behind this phenomenon. - Instead of trying to build out \cough\\ cybercommands, Government sponsored CTF tournaments identify and reward talent, without bringing it on-board the National Security apparatus. Talent is left out in the community on the understanding it can be found if needed. - The 'Chinese Government' is nowhere near as cohesive and controlling as is depicted in Western sources. Government sponsored economic espionage activities that are out of proportion to American efforts against the rest of the world will originate at the provincial level. Chinese industry is very regional, with whole provinces specializing in specific industries, hence the benefits of economic espionage is highly regional in nature too. It is not in the central government's interests to sustain the Chinese hacker folklore, nor would it be within their ability to rein in any provincial government involvement.

amalag 14y ago
Yes a government response to this sort of guerrila warfare against unnamed attackers will be interesting. They cannot just create strong penalties as the attackers are beyond their jurisdiction. Punishing China for anything within their IP space is also a non-starter, something the authors do not mention.
cscurmudgeon 14y ago
This is a very recent report. Your comment is more than a year old. Are you asserting that nothing has changed? Edit: From the report in the article "Our research and observations indicate that the Communist Party of China (CPC,中国共产党) is tasking the Chinese People’s Liberation Army (PLA,中国人民解放军) to commit systematic cyber espionage and data theft against organizations around the world " They have a whole section devoted to backing this up.

jkat 14y ago

Does the US risk being seen as a dog with a loud bark but no bite here? If you're going to make pronouncements that hacking will be considered an act of war (1), don't you kinda paint yourself into a corner when you get hacked? (1) http://www.guardian.co.uk/world/2011/may/31/washington-moves-to-classify-cyber-attacks http://www.guardian.co.uk/world/2011/may/31/washington-moves...

mtgx 14y ago
I don't know why they (Obama and his advisers) ever thought that was a good idea. Whoever was planning to hack US never took that seriously anyway, and now that they've seen they won't actually do it, they can take them even less seriously. I guess they couldn't just say "you hack us, we hack you back". Or more realistically: "We hack you first in secret. Then you hack us back in secret. And then we have an excuse to go public to get the public's support to hack you back, and get more funding and bills passed for whatever other secret operations we want to do next". Case in point: Iran.
xyzzy123 14y ago
OK, so the link you provided is a gross simplification of current thinking. Government officials have been quite clear that CNE[1] is NOT generally considered an act of war, rather, it's part of the usual intelligence operations expected during peacetime. It's CNA (e.g. operations designed specifically to disrupt or destroy civilian or military targets) which is "on the table" for act-of-war status, particularly if there is kinetic effect. An example would be if something like Stuxnet were deployed against the U.S. power grid. The idea is that it doesn't matter whether a power plant was disabled via a bomb or a backdoor. Both the intent and the outcome are the same. So the declaration of policy you linked to is really a clarification rather than a "change of course". The lines are blurry when it comes to CNE and critical infrastructure. The problem you have is that if, say, 3 competing agencies are all vying for control of the same powerplant for CNE reasons (e.g. not trying to cause damage), the plant might nonetheless get taken out by accident. I'm not sure anyone is clear on what to do in that kind of a situation. [1] We can divide "cyber" operations into the following categories (straight from wikipedia): * Computer Network Attack (CNA): Includes actions taken via computer networks to disrupt, deny, degrade, or destroy the information within computers and computer networks and/or the computers/networks themselves. * Computer Network Defense (CND): Includes actions taken via computer networks to protect, monitor, analyze, detect and respond to network attacks, intrusions, disruptions or other unauthorized actions that would compromise or cripple defense information systems and networks. Joint Pub 6.0 further outlines Computer Network Defense as an aspect of NetOps * Computer Network Exploitation (CNE): Includes enabling actions and intelligence collection via computer networks that exploit data gathered from target or enemy information systems or networks.

contingencies 14y ago

I've been in China on and off for ~7 of the last 10-11 years. During that time I was once asked to write an online forum / comment scanning system by an employer in Shanghai that could trace keyword usage. It was supposed to be for marketing purposes but I didn't trust that claim. Needless to say I didn't write the system. No idea who the employer was, or whether it's related. I've also met some people that have worked on the public security bureau's CCTV systems, and others who work in Beijing/Tianjin with government for computer security projects. I think the western military-industrial and government security industry wants to daemonize China as justification for spending. Realistically, at the global geostrategic level, China is already beating them at their own game, ie. pure capitalism behind a facade of diplomacy and social concern. Personally I would posit that the major area of conflict right now between China and the US is probably Burma, not some random server providing a pitifully limited window in to the vast bureaucratic engines of US governance.

cscurmudgeon 14y ago
Do you really think they are just trying to demonize China given that there have been attacks to control critical infrastructure?
- greghinch 14y ago
  Considering the degree that defense spending props up the US economy, yes.
  - cscurmudgeon 14y ago
    That does not show anything. A motive perhaps, but nothing more. On the other hand, we have stark evidence of China being nefarious right in front of us.
    - greghinch 14y ago
      Eh, most of what they are doing is corporate espionage with the intent of copying and cost cutting. If your business is susceptible to being undercut on price alone, your days are numbered regardless.

joe_the_user 14y ago

I would assume that the most effective counter-strategy would be something like a poisoned honey-pot approach: Make a large scale effort to start feeding fake information to intruders and see what happens. You probably couldn't do something like this but it's interesting to think about: http://en.wikipedia.org/wiki/Siberian_pipeline_sabotage http://en.wikipedia.org/wiki/Siberian_pipeline_sabotage

walshemj 14y ago
This is what allegedly happend with concodrski (the Russian version of concord) blueprints with design flaws where leaked to the russians.
- stcredzero 14y ago
  What about AAMRAM-ski and Raptor-ski? (I just like the sound.)

martian 14y ago

"Mandiant discovered several cases in which attackers logged into their Facebook and Twitter accounts to get around China’s firewall that blocks ordinary citizen’s access, making it easier to track down their real identities." Amazing.

nikcub 14y ago
could you explain this further? I re-read this line a few times but didn't understand. How would logging into their FB and Twitter accounts get them around the Great Firewall?
- pygatea 14y ago
  I assumed that this meant the attackers logged into their own social network accounts while they were "inside" (i.e. using) compromised machines in the target locations.
  - nikcub 14y ago
    That makes sense, thanks. I didn't think they would be silly enough to do that.
- deleted 14y ago
  [deleted]
- deleted 14y ago
  [deleted]

Metapony 14y ago

Great, now these Chinese hackers will be more careful in the future and harder to track.

thomasjames 14y ago

Time for some technically literate people in Washington and some patriotic hackers.

hooande 14y ago

I believe that Chinese hackers are the scariest thing in the world today. I think that the threat from cyber warfare might be slightly overblown (though the next pearl harbor will most likely be a cyber attack). The real threat is the fact that no digital information can be kept secret anymore. If Chinese hackers want what's on a given hard disk, there's no way to stop them. People absolutely freak out when they suspect the US government of spying on a citizen. But chinese hackers, state sponsored or not, seem to be able to roam with impunity. Several US companies have had their ip stolen and their businesses ruined. Companies have lost as much as a billion dollars in ip in a single night. [1] There are so many of them with such diversity of skills that almost no one is safe. I'm not trying to rattle sabers here, just pointing out that the world is facing a threat to privacy and secrecy that is greater than we have ever known. Chinese hackers have more power than the CIA, KGB and Gestapo combined, and nothing short of WWIII can slow them down. [1] http://www.nytimes.com/2012/04/03/opinion/how-china-steals-our-secrets.html http://www.nytimes.com/2012/04/03/opinion/how-china-steals-o...

unimpressive 14y ago
>I believe that Chinese hackers are the scariest thing in the world today. I'm much more worried about nuclear weapons, Authoritarianism, and biological warfare.
- lostlogin 14y ago
  The Chinese government?
  - unimpressive 14y ago
    I'm not exceptionally worried about China's nukes. They understand MAD. I'm more worried about the middle east. Authoritarianism is more worrying if it's in the country I'm standing on. My main fear with biological warfare is non-state actors. As it becomes possible to do more with less, the chances of fundamentalists and other malicious parties using biological agents for terrorism or worse go up.

OGinparadise 14y ago

By DAVID E. SANGER, DAVID BARBOZA and NICOLE PERLROTH I hope you have no dirty laundry in your e-mail accounts, the Chinese military is probably reading them right now. Lit it or not, what the Chinese are doing is pretty smart, let' face it. Countries launch (ed) wars to get what they want, the Chinese get it the easy way.

jinbakei 14y ago

NY Times is just making bullshit...

berntb 14y ago
>> NY Times is just making bullshit... 50 cent army? :-)

omartinez 14y ago

Timing of this news is interesting, for the lack of a better word in describing it. This article is published the same week as CISPA comes back. The news on Chinese cyber attacks to the US can help give a boost in public support to these laws, giving them valid reasoning to give away our online privacy.

sampsonjs 14y ago

"In vague to non-existent evidence, Gray Lady hacks see absolute proof of what their government handlers want you to believe". Word must have come down from the White House to start pushing the "Cold War with China" kick.

blablabla123 14y ago

I wonder if the New York Times and other high profile News papers could be more easy on such allegations. This only improves the Cold War atmosphere some political analysts predict since years. It is also naive to assume that there is a G8 nation without a cyber warfare unit in the Army. Or to assume that other nations don't do covert operations. FUD has finally arrived in the mainstream.