www.reuters.com/article/2011/08/03/us-cyberattacks-qa-idUSTRE7720IS20110803
Massive hacking trail uncovered: McAfee 8:08pm EDT US Department of Homeland Security analysts work at the National Cybersecurity & Communications Integration Center (NCCIC) located just outside Washington in Arlington, Virginia on September 24, 2010. REUTERS/Hyungwon Kang US Department of Homeland Security analysts work at the National Cybersecurity & Communications Integration Center (NCCIC) located just outside Washington in Arlington, Virginia on September 24, 2010.
Jim Finkle BOSTON | Wed Aug 3, 2011 12:11am EDT BOSTON (Reuters) - Hackers breached the computer networks of 72 organizations around the world over a five-year period, in the biggest hacking campaign discovered to date, security firm McAfee said on Wednesday. Here are questions and answers on the attacks, dubbed "Operation Shady RAT" by McAfee, which was bought by Intel Corp earlier this year: Q Who are the victims? A They include: - Governments of Canada, India, South Korea, Taiwan, United States and Vietnam. McAfee declined to identify many of the victims by name. A McAfee found evidence of security breaches dating back to mid-2006, but said the hacking might have begun well before that. Some of the attacks lasted just a month, others stretched to as many as 28 months. The hackers sent so-called spear-phishing emails, which are tainted with malicious software, to specific people at the targeted organizations. When the unsuspecting individual clicks on an infected link, it allows intruders to jump on to the machine and use it to infiltrate the computer network. A McAfee investigators have done their best to guess what was likely stolen, based on interviews with a number of victims. McAfee Vice President of Threat Research Dmitri Alperovitch said the attacker sought data that would give it military, diplomatic and economic advantage. "If you look at an industry and think about what is most valuable in terms of intellectual property, that is what they were going after," Alperovitch said. As examples, he cited email archives, negotiation documents and schematics for electronics. A McAfee's Alperovitch said he believes that a nation state was behind the attacks, but he declined to identify it. He said the attacker is the same country that was behind other security breaches that McAfee has previously investigated. Jim Lewis, an expert in cyber attacks with the Center for Strategic and International Studies, was briefed by McAfee. Lewis said the presence of Taiwan and the International Olympic Committee in the victims list suggest China is most likely the perpetrator of the attack. A "This is the biggest transfer of wealth in terms of intellectual property in history," Alperovitch said. "The scale at which this is occurring is really, really frightening." "Companies and government agencies are getting raped and pillaged every day. They are losing economic advantage and national secrets to unscrupulous competitors," he said. A While investigating some attacks against defense contractors, McAfee researchers found a "command and control" server in 2009 used to manage the campaign. In March of this year, they returned to that computer and found logs that revealed all of the attacks. McAfee is typically unable to discuss its investigations because of non-disclosure agreements. The company was able to discuss Operation Shady RAT because it was not bound by any confidentiality agreements in this case. A RAT stands for "remote access tool," a type of software that hackers and security professionals often use to access computer networks from afar.
commentFrame We welcome comments that advance the story through relevant opinion, anecdotes, links and data. If you see a comment that you believe is irrelevant or inappropriate, you can flag it to our editors by using the report abuse links. Views expressed in the comments do not represent those of Reuters.
wmcmyers wrote: The West has been placating China for too long. If there is credible evidence that China is behind this program of espionage, it should face severe consequences. This might include the seizure of Chinese assets in the United States and elsewhere in the West; travel limitation on the officials responsible, or similar penalties. The one thing we cannot do is just ignore this behavior. If we do, it will continue, with unpredictable consequences. If China continues to behave in such war-like ways, it should face war-like consequences.
|
http://csua.com/feed/