How Chinas Hacking Entered a Reckless New Phase
The country’s hackers have gotten far more aggressive since 2015, when the Ministry of State Security largely took over the country’s cyberespionage.For years, China seemed to operate at the quieter end of the state-sponsored-hacking spectrum. While Russia and North Korea carried out hack-and-leak operations, launched massively disruptive cyberattacks, and blurred the line between cybercriminals and intelligence agencies, China quietly focused on more traditionalâ€"if prolificâ€"espionage and intellectual property theft. But a collective message today from dozens of countries calls out a shift in China's online behaviorâ€"and how its primary cyber intelligence agency's trail of chaos increasingly rivals that of the Kim Regime or the Kremlin.
On Monday, the White House joined the UK government, the EU, NATO, and governments from Japan to Norway in announcements that spotlighted a string of Chinese hacking operations, and the US Department of Justice separately indicted four Chinese hackers, three of whom are believed to be officers of China's Ministry of State Security. The White House statement casts blame specifically on the MSS for a mass-hacking campaign that used a vulnerability in Microsoft's Exchange Server software to compromise thousands of organizations around the world. It also rebukes the ministry for partnering with contract organizations that engaged in for-profit cybercrime, turning a blind eye to or even condoning extracurricular activities like infecting victims with ransomware, using victim machines for cryptocurrency mining, and financial theft. "The PRC’s unwillingness to address criminal activity by contract hackers harms governments, businesses, and critical infrastructure operators through billions of dollars in lost intellectual property, proprietary information, ransom payments, and mitigation efforts," the statement reads.
That long list of digital sins represents a significant shift in Chinese hackers' modus operandi, much of which China watchers say can be traced back to the country's 2015 reorganization of its cyber operations. That's when it transferred much of the control from the People's Liberation Army to the MSS, a state security service that has over time become more aggressive both in its hacking ambitions and in its willingness to outsource to criminals.
"They go bigger. The number of hacks went down, but the scale went up," says Adam Segal, director of the Digital and Cyberspace Policy Program at the Council on Foreign Relations, who has long focused on China's hacking activities. That's in no small part because the nongovernment hackers that the MSS works with don't necessarily obey the norms of state-sponsored hacking. "There does seem to be kind of greater tolerance of irresponsibility," Segal says.
The MSS has always preferred using intermediaries, front companies, and contractors over its own hands-on operations, says Priscilla Moriuchi, a nonresident fellow at Harvard's Belfer Center for Science and International Affairs. "This model in both HUMINT and cyber operations allows the MSS to maintain plausible deniability and create networks of recruited individuals and organizations that can bear the brunt of the blame when caught," says Moriuchi, using the term “HUMINT†to mean the human, non-cyber side of spying operations. "These organizations can be quickly burned and new ones established as necessary."
While those contractors offer the Chinese government a layer of deniability and efficiency, though, they also lead to less control of operators, and less assurance that the hackers won't use their privileges to enrich themselves on the sideâ€"or the MSS officers who dole out the contracts. "In light of this model, it is not surprising to me at all that MSS-attributed cyber operations groups are also conducting cybercrime," Moriuchi adds.
The White House statement as a whole points to a broad, messy, and in some cases unrelated collection of Chinese hacking activities. A separate indictment names four MSS-affiliated hackers, three of whom were MSS officers, all accused of a broad range of intrusions targeting industries around the world from health care to aviation.
"The Chinese track closely what the Russians do on coercive activity, and they're copying them."
James Lewis, CSIS
But more unusual than the data theft outlined in that indictment was the mass-hacking called out in Monday's announcement, in which a group known as Hafniumâ€"now linked by the White House to China's MSSâ€"broke into no fewer than 30,000 Exchange Servers around the world. The hackers also left behind so-called web shells, allowing them to regain access to those servers at will but also introducing the risk that other hackers might discover those backdoors and exploit them for their own purposes. That element of the hacking campaign was "untargeted, reckless, and extremely dangerous," wrote Dmitri Alperovitch, former CrowdStrike CTO and founder of Silverado Policy Accelerator, along with researcher Ian Ward, in a March blog post. At least one ransomware group appeared to try to piggyback off of Hafnium's campaign soon after it was exposed.
There's no clear evidence that the MSS' Hafnium hackers themselves deployed ransomware or cryptocurrency mining software on any of those tens of thousands of networks, according to Ben Read, director of cyberespionage analysis at the incident-response and threat-intelligence firm Mandiant. Instead, the White House's criticism of China's government for blurring cybercrime and cyberspying seems to be related to other, years-long hacking campaigns that more clearly crossed that line. In September of last year, for instance, the DOJ indicted five Chinese men who worked for an MSS contractor known as Chengdu 404 Network Technologyâ€"known in the cybersecurity industry by the name Barium before they were identifiedâ€"all of whom stand accused of hacking dozens of companies around the world in a collection of operations that seemed to liberally mix espionage with for-profit cybercrime.
As in the Hafnium Microsoft hack, the Barium hackers used a broad and indiscriminate hacking technique to carry out those intrusions, breaching software providers to carry out repeated software supply-chain attacks that hid malicious code in otherwise legitimate software, such as the IT management tool NetSarang, the hard-drive cleaning tool CCleaner, and laptop maker Asus. While in some cases those hackers focused on highly targeted spying, in others they stole millions of dollars worth of virtual currency or deployed ransomware to paralyze victims networks, like at two Taiwanese oil companies in 2018.
In its increasingly large-scale hacking techniques, its hybrid of spying and cybercrime, and its use of "coercive" hacking, China's operations increasingly resemble those of Russia, says James Lewis, director of the Strategic Technologies Program at the Center for Strategic and International Studies. MSS targeting of Taiwan, for instance, mirrors Russia's similarly disruptive cyberattacks in Ukraine. "The Russians lead the way, and Chinese trail them," Lewis says. "The Chinese track closely what the Russians do on coercive activity, and they're copying them."
While Monday's statements draw new attention to the MSS' lack of control over its contractors, they seem unlikely to curtail China's efforts. "They'll deny it and lie through their teeth," says Jamie MacColl, a cybersecurity research analyst at the UK's Royal United Services Institute for Defence and Security Studies. "That's the great thing about using contractors. It's still easy for them to deny the connection." The same lack of hands-on control that has contributed to the recklessness of the MSS' hackers-for-hire, in other words, also helps the MSS to shrug off the scorn of the world's governmentsâ€"and makes China far less likely to rein them in.
More Great WIRED Stories
0 Response to "How Chinas Hacking Entered a Reckless New Phase"
Post a Comment