Feeds

Chinese hackers 'slurped 50 MB of US gov email'

Windows source code tapped, say WikiLeaked docs

5 things you didn’t know about cloud backup

The Chinese government may have used its access to Microsoft source code to develop attacks that exploited weaknesses in the Windows operating system, according to a US diplomatic memo recently published by Wikileaks.

The June 29, 2009 diplomatic cable claims that a Chinese security firm with close ties to the People's Republic of China, got access to the Windows source under a 2003 agreement designed to help companies improve the security of the Microsoft operating system. Topsec allegedly worked with a government organization known as CNITSEC, short for the China Information Technology Security Center, which actively worked with “private sector” hackers to develop exploits.

“Additionally, CNITSEC enterprises has recruited Chinese hackers in support of nationally-funded 'network attack scientific research projects,'” the cable stated. “From June 2002 to March 2003, TOPSEC employed a known Chinese hacker, Lin Yong (a.k.a. Lion and owner of the Honker Union of CHINA), as senior security service engineer to manage security service and training.”

The memo continues:

“While links between top Chinese companies and the PRC are not uncommon, it illustrates the PRC's use of its 'private sector' in support of governmental information warfare objectives, especially in its ability to gather, process, and exploit information. As evidenced with TOPSEC, there is a strong possibility the PRC is harvesting the talents of its private sector in order to bolster offensive and defensive computer network operations capabilities.”

Topsec Chairman, He Weidong, allegedly told a Chinese news outlet that half of his company's start-up capital came from that country's government. Topsec started out in 1995 with funding of just $4,400, and by 2002, had earnings about $440 million. It is now China's largest provider of information security products and services, according to the cable.

“Interestingly, shareholders did not receive bonuses, as all earnings went for future investment,” the memo stated. “Weidong also stated a bank loan was never used.”

It's one of a handful of documents published in the past week that outlines US diplomatic concerns about Chinese-sponsored hacking against foreign-based companies and governments.

According to a separate cable, attackers with ties to the Chinese government and military compromised US computer systems in early 2008 to get access to sensitive government communications. The collective operated under the moniker of BC, short by Byzantine Candor.

“During this time period, the actors exfiltrated at least 50 megabytes of e-mail messages and attached documents, as well as a complete list of usernames and passwords from an unspecified USG agency,” the memo stated. “Additionally, multiple files were transferred to the compromised ISP system from other BC-associated systems that have been previously identified collecting e-mail messages from additional victims.”

The same November 3, 2008 memo outlines another BC attack that actively infiltrated at least one US government agency after compromising “multiple systems located at a US Internet service provider (ISP).” Chines hackers also sent a booby-trapped Microsoft Word file to Canadian government officials in October 2008. BC actors have been carrying out social engineering attacks against US government organizations date back since 2002.

“BC intruders have relied on techniques including exploiting Windows system vulnerabilities and stealing login credentials to gain access to hundreds of USG and cleared defense contractor systems over the years,” it continues. “In the US, the majority of the systems BC actors have targeted belong to the US Army, but targets also include other DoD services as well as DoS, Department of Energy, additional USG entities, and commercial systems and networks.” ®

Update

Microsoft provided the following comment:

"Microsoft's Government Security Program (GSP) is a global initiative that enables governments to increase their assurance in system security by providing a managed review of Microsoft source code, as well as offering prescriptive security guidance and technical training. Review of source code by participants in the Government Security Program is provided in a managed and audited environment requiring authentication and security measures."

Next gen security for virtualised datacentres

More from The Register

next story
Microsoft: We plan to CLEAN UP this here Windows Store town
Paid-for apps that provide free downloads? Really
Snowden on NSA's MonsterMind TERROR: It may trigger cyberwar
Plus: Syria's internet going down? That was a US cock-up
Who needs hackers? 'Password1' opens a third of all biz doors
GPU-powered pen test yields more bad news about defences and passwords
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Hear ye, young cyber warriors of the realm: GCHQ wants you
Get involved, get a job and then never discuss work ever again
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
Microsoft cries UNINSTALL in the wake of Blue Screens of Death™
Cache crash causes contained choloric calamity
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.