Feeds

Chinese hackers 'slurped 50 MB of US gov email'

Windows source code tapped, say WikiLeaked docs

Next gen security for virtualised datacentres

The Chinese government may have used its access to Microsoft source code to develop attacks that exploited weaknesses in the Windows operating system, according to a US diplomatic memo recently published by Wikileaks.

The June 29, 2009 diplomatic cable claims that a Chinese security firm with close ties to the People's Republic of China, got access to the Windows source under a 2003 agreement designed to help companies improve the security of the Microsoft operating system. Topsec allegedly worked with a government organization known as CNITSEC, short for the China Information Technology Security Center, which actively worked with “private sector” hackers to develop exploits.

“Additionally, CNITSEC enterprises has recruited Chinese hackers in support of nationally-funded 'network attack scientific research projects,'” the cable stated. “From June 2002 to March 2003, TOPSEC employed a known Chinese hacker, Lin Yong (a.k.a. Lion and owner of the Honker Union of CHINA), as senior security service engineer to manage security service and training.”

The memo continues:

“While links between top Chinese companies and the PRC are not uncommon, it illustrates the PRC's use of its 'private sector' in support of governmental information warfare objectives, especially in its ability to gather, process, and exploit information. As evidenced with TOPSEC, there is a strong possibility the PRC is harvesting the talents of its private sector in order to bolster offensive and defensive computer network operations capabilities.”

Topsec Chairman, He Weidong, allegedly told a Chinese news outlet that half of his company's start-up capital came from that country's government. Topsec started out in 1995 with funding of just $4,400, and by 2002, had earnings about $440 million. It is now China's largest provider of information security products and services, according to the cable.

“Interestingly, shareholders did not receive bonuses, as all earnings went for future investment,” the memo stated. “Weidong also stated a bank loan was never used.”

It's one of a handful of documents published in the past week that outlines US diplomatic concerns about Chinese-sponsored hacking against foreign-based companies and governments.

According to a separate cable, attackers with ties to the Chinese government and military compromised US computer systems in early 2008 to get access to sensitive government communications. The collective operated under the moniker of BC, short by Byzantine Candor.

“During this time period, the actors exfiltrated at least 50 megabytes of e-mail messages and attached documents, as well as a complete list of usernames and passwords from an unspecified USG agency,” the memo stated. “Additionally, multiple files were transferred to the compromised ISP system from other BC-associated systems that have been previously identified collecting e-mail messages from additional victims.”

The same November 3, 2008 memo outlines another BC attack that actively infiltrated at least one US government agency after compromising “multiple systems located at a US Internet service provider (ISP).” Chines hackers also sent a booby-trapped Microsoft Word file to Canadian government officials in October 2008. BC actors have been carrying out social engineering attacks against US government organizations date back since 2002.

“BC intruders have relied on techniques including exploiting Windows system vulnerabilities and stealing login credentials to gain access to hundreds of USG and cleared defense contractor systems over the years,” it continues. “In the US, the majority of the systems BC actors have targeted belong to the US Army, but targets also include other DoD services as well as DoS, Department of Energy, additional USG entities, and commercial systems and networks.” ®

Update

Microsoft provided the following comment:

"Microsoft's Government Security Program (GSP) is a global initiative that enables governments to increase their assurance in system security by providing a managed review of Microsoft source code, as well as offering prescriptive security guidance and technical training. Review of source code by participants in the Government Security Program is provided in a managed and audited environment requiring authentication and security measures."

The essential guide to IT transformation

More from The Register

next story
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
KER-CHING! CryptoWall ransomware scam rakes in $1 MEEELLION
Anatomy of the net's most destructive ransomware threat
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
prev story

Whitepapers

Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Backing up distributed data
Eliminating the redundant use of bandwidth and storage capacity and application consolidation in the modern data center.
The essential guide to IT transformation
ServiceNow discusses three IT transformations that can help CIOs automate IT services to transform IT and the enterprise
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.