The breach was deft, even artful. It began, according to Chinas National Computer Virus Emergency Response Centre (NCVERC), with a man-in-the-middle attack earlier this year on the networks of Northwestern Polytechnical University (NWPU) in Xian. A type of breach that allows hackers to intercept electronic communications mid-transit, the attackers then used a total of 40 zero-day exploits and viruses to strengthen and advance their position within the institutions network. By the time they were discovered, the groups access to the universitys systems was near-total and even extended to a national telecommunications firm.
This attack was one of five that NCVERC has attributed in recent months to the US National Security Agency (NSA). I want to stress that what the US has done has seriously jeopardized the security of Chinas critical infrastructure, and institutional and personal information, said Mao Ning, a spokesperson from the countrys foreign ministry, who went on to urge the relevant US authorities to stop organising such breaches. Even so, its the kind of conduct that the Chinese government has publicly stated it has come to expect from the worlds leading superpower, with another government spokesperson excoriating the US as truly the hacking empire of the world.
Such highly charged accusations made against the US are nothing new and, indeed, there is a rich seam of claims dating back to the Snowden revelations of the NSA making a mockery of Chinese cybersecurity by hacking civilian computers while maintaining a sophisticated network of informants. There is also, admittedly, a whiff of plausibility in some of the new claims: NWPU has, in the past, been described by the US Justice Department as an institution thats heavily involved in military research and works closely with the Peoples Liberation Army. Even so, the new reports have been viewed with suspicion by cybersecurity experts. Indeed, a common thread between all of these reports is the use of threat intelligence and technical details designed to mimic the ways in which Western cybersecurity companies produce evidence and attribution of state-sponsored cyberattacks.
In April for example, another spokesperson for Chinas Foreign Affairs Ministry responded to a question from Global Times a state-funded media outlet about a report from NCVERC on alleged US cyberattacks on allied countries. The report points out that if existing international internet backbone network(s) and critical information infrastructure contain software or hardware provided by US companies, it is highly likely that various types of backdoor(s) could be installed, making them targets of US government cyberattacks, said Wang Wenbin.
His statement was strikingly similar to the way in which the US has previously warned about the risks in allowing Chinese telecommunications giant Huawei to work on critical national infrastructure around the world. Theres likely a cynical motive behind such attributions, argues Robert Spalding, CEO of Sempre and a former US Air Force Brigadier General. The CCP wants to lay the foundation for saying that the US is guilty of what they blame China for, he says.
The timing of these reports release is also crucial to understanding Chinas intentions, argues Chih-yun Huang, a cyber threat intelligence analyst at Team T5, a Taiwanese cybersecurity firm. On 30 August, the American cybersecurity company Proofpoint released a study on recent cyberattacks on the Australian government and wind turbine fleets in the South China Sea, with the trail leading to a group called TA423/Red Ladon. According to Proofpoint researchers and the US Department of Justice, the group is a China-based, espionage-motivated threat actor targeting a variety of organisations in response to political events in the Asia-Pacific region, with a focus on the South China Sea.
Several weeks later, Global Times published an exclusive detailing how the NSA allegedly conducted its cyberattack on NWPU, which aimed at infiltrating and controlling core equipment in Chinas infrastructure and stealing private data of Chinese people with sensitive identities. Huang believes the timing of the story is suspicious, and likely a tit-for-tat accusation.Indeed, other industry experts have pointed out a pattern where Chinese cybersecurity companies publish reports on US cyberattacks, followed by exclusive stories run by Global Times, indicating a coordinated campaign between the state, private sector and the media.
Other cybersecurity experts have also argued that these reports are a patchwork effort at best, mentioning malware that has existed in the public domain for over five years. For her part, Huang notes that many of the reports issued by NCVERC omit crucial information like IP addresses and other indicators of compromise. In that sense, these reports are not credible because we cant confirm whether its true or not, she says.
However, focusing on the technical credibility of these reports misses the broader point about Chinas efforts to push out detailed threat intelligence on alleged American offensive hacking operations. The interesting thing is that you wont be able to find an English version of these reports, says Huang. Its probably part of wider anti-US propaganda efforts intended to stir the emotions of the domestic population of China, or even the wider Chinese diaspora.
But Huang also believes that what she has seen in the last few months is just the beginning, and that propaganda efforts to portray Chinese cybersecurity as vulnerable to attack from Western powers will likely become more sophisticated in the future as US-China relations continue to deteriorate. They will find new ways to make it more persuasive, she says the best lies, after all, contain elements of truth. China might find ways to make these reports more legitimate by providing more technical details, for example.
While publishing cyber threat intelligence reports about American hacking adventures represents a new front in US-China relations, such methods fall squarely within the long-held tradition of accusing the West of double standards.
There have been multiple times when the US accuses China of human rights violations of Uyghurs and you would see China retaliating with the USs poor human rights record, for example, says Huang. As long as the Western cybersecurity industry continues to keep a close eye on Chinas activities, I think China will continue to fight back through propaganda whenever they feel attacked.
Read more here:
What is the NSA actually doing in China? - Tech Monitor
- WikiLeaks' Julian Assange: NSA critics got lucky because agency had no PR strategy - April 26th, 2014 [April 26th, 2014]
- National Speakers Association New Jersey Chapter NSA - April 26th, 2014 [April 26th, 2014]
- National Security Agency - Wikipedia, the free encyclopedia - April 26th, 2014 [April 26th, 2014]
- NSA - Satu Hari Di Bulan Juni (TULUS) (COVER) - Video - April 26th, 2014 [April 26th, 2014]
- Hong Kong: Protesters blow whistles for NSA whistle blower - Video - April 26th, 2014 [April 26th, 2014]
- An Inside Look at the NSA With Whistleblower William Binney (Part 2 of 2) - Video - April 26th, 2014 [April 26th, 2014]
- UK: China will offer fig leaves to US exposed by NSA leaker - Assange - Video - April 26th, 2014 [April 26th, 2014]
- NSA ~ (Autodidactism) Whistleblowing - Video - April 27th, 2014 [April 27th, 2014]
- Dropping #NSA Knowledge Like a Clumsy Librarian - Video - April 27th, 2014 [April 27th, 2014]
- Full Show: Disband The NSA or; Corruption in the Capitol FO SHIZZLE {aTV002} - Video - April 27th, 2014 [April 27th, 2014]
- NSA DOCUMENTARY SIX YEARS BEFORE SNOWDEN - Video - April 27th, 2014 [April 27th, 2014]
- ShmooCon 2014: The NSA: Capabilities and Countermeasures - Video - April 27th, 2014 [April 27th, 2014]
- NSA Knew Of Heartbleed Bug, Refused To Protect Americans - Video - April 27th, 2014 [April 27th, 2014]
- Former NSA Head To Become Columnist For Conservative Paper To Discuss Intelligence - Video - April 27th, 2014 [April 27th, 2014]
- An Inside Look at the NSA With Whistleblower William Binney (Part 1 of 2) - Video - April 27th, 2014 [April 27th, 2014]
- Keynote Address by Shri Shivshankar Menon, NSA at International Seminar on Kautilya - Video - April 27th, 2014 [April 27th, 2014]
- NSA Wiretapping: A 4th Amendment Violation?: Blake Norvell at TEDxSMU - Video - April 27th, 2014 [April 27th, 2014]
- Hang with Rand: Email Privacy, NSA Spying, and Defending Our Civil Liberties - Video - April 27th, 2014 [April 27th, 2014]
- NSA Surveillance and What To Do About It - Bruce Schneier - Video - April 27th, 2014 [April 27th, 2014]
- READER SUBMITTED: NSA CT April 2014 Meeting - April 28th, 2014 [April 28th, 2014]
- MVI 1847 Obama's NSA Denies FOIA About MH 370! - Video - April 28th, 2014 [April 28th, 2014]
- George Galloway's Sputnik: Ewen MacAskill on Guardian / Edward Snowden NSA leaks (26Apr14) - Video - April 28th, 2014 [April 28th, 2014]
- CIA & NSA DIRECTED ENERGY WEAPON ATTACK ON WHISTLE BLOWER - Video - April 28th, 2014 [April 28th, 2014]
- Book TV - 2014 San Antonio Book Festival: Panel on the NSA, Big Brother, and Democracy - Video - April 28th, 2014 [April 28th, 2014]
- NSA Throwdown: John Oliver v. 60 Minutes - April 29th, 2014 [April 29th, 2014]
- NSA will sit on security vulnerabilities because of terrorism - April 29th, 2014 [April 29th, 2014]
- New water records show NSA Utah Data Center likely behind schedule - April 29th, 2014 [April 29th, 2014]
- MVI 1871 NSA Might Be OnTo Me! - Video - April 29th, 2014 [April 29th, 2014]
- ZyXEL NSA 325 v2 Hands On - Deutsch / German notebooksbilliger.de - Video - April 29th, 2014 [April 29th, 2014]
- German opposition says US should destroy Merkel's NSA file - Video - April 29th, 2014 [April 29th, 2014]
- Germany: NSA spying "unacceptable" says SPD - Video - April 29th, 2014 [April 29th, 2014]
- NSA Surveillance 2 - Video - April 29th, 2014 [April 29th, 2014]
- NSA Surveillance Panel 1 - Video - April 29th, 2014 [April 29th, 2014]
- Chalk Talk How Snowden Breached NSA Security - Video - April 29th, 2014 [April 29th, 2014]
- NSA reveals some cyber security flaws are left secret - April 30th, 2014 [April 30th, 2014]
- NSA data center uses less water than expected - April 30th, 2014 [April 30th, 2014]
- April 2014 Breaking News Do you use Google or Yahoo? NSA Intercepts Google And Yahoo Traffic - Video - April 30th, 2014 [April 30th, 2014]
- Supreme Court could weigh in on NSA case, justice says - May 1st, 2014 [May 1st, 2014]
- New NSA chief: Agency has lost trust - May 1st, 2014 [May 1st, 2014]
- NSA on Heartbleed: 'We're not legally allowed to lie to you' - May 1st, 2014 [May 1st, 2014]
- What's The NSA Doing Now? Training More Cyberwarriors - May 1st, 2014 [May 1st, 2014]
- Anonymous NSA - Video - May 1st, 2014 [May 1st, 2014]
- Cutting off H2O to the NSA - Video - May 1st, 2014 [May 1st, 2014]
- Brazil: Greenwald slams US media, shares tips to avoid NSA - Video - May 1st, 2014 [May 1st, 2014]
- NSA IS TRYINGG 2 KILL ME FAMS - Video - May 1st, 2014 [May 1st, 2014]
- What was more popular on Twitter, NSA, NRA or NBA..today? - Video - May 1st, 2014 [May 1st, 2014]
- CIS111: NSA Uncovered - Video - May 1st, 2014 [May 1st, 2014]
- Views from the Street on NSA Activities and Liberty (6/6) - Video - May 1st, 2014 [May 1st, 2014]
- Views from the Street on NSA Activities and Liberty (4/6) - Video - May 1st, 2014 [May 1st, 2014]
- Views from the Street on NSA Activities and Liberty (3/6) - Video - May 1st, 2014 [May 1st, 2014]
- Views from the Street on NSA Activities and Liberty (2/6) - Video - May 1st, 2014 [May 1st, 2014]
- Views from the Street on NSA Activities and Liberty (1/6) - Video - May 1st, 2014 [May 1st, 2014]
- Germany: NSA may have accidentally outed secret base - Video - May 1st, 2014 [May 1st, 2014]
- ZyXEL NSA 325 v2 Installations-Wizard - Deutsch / German notebooksbilliger.de - Video - May 1st, 2014 [May 1st, 2014]
- Tech firms to increase alerts about police requests for data -- report - May 2nd, 2014 [May 2nd, 2014]
- German Chancellor Angela Merkel visits US, after the NSA eavesdropping scandal - Video - May 2nd, 2014 [May 2nd, 2014]
- NSA spies on more US citizens than Russians Snowden - May 3rd, 2014 [May 3rd, 2014]
- THE NEXT NSA?Police under scrutiny for using spying technology - May 3rd, 2014 [May 3rd, 2014]
- Ukraine and NSA will test Merkel - Video - May 3rd, 2014 [May 3rd, 2014]
- The Latest Attacks On NSA Whistleblower Edward Snowden - Kevin Gosztola Discusses - Video - May 3rd, 2014 [May 3rd, 2014]
- Still Report #246 - NSA Classifies MH370 Material - Video - May 4th, 2014 [May 4th, 2014]
- Code Talker Induction into NSA Hall of Honor - Video - May 4th, 2014 [May 4th, 2014]
- NSA ( National Security Agency ) refusal to release documents on UFO's - Video - May 4th, 2014 [May 4th, 2014]
- Obama & NSA Refuse FOIA Request on Malaysia Flight deemed classified - Video - May 4th, 2014 [May 4th, 2014]
- Kafkawinstons World`s Channel Terminated NSA is replacing Channel`s with Sockpuppet Channel`s - Video - May 4th, 2014 [May 4th, 2014]
- NSA Volunteer Justin Hall at the NSA Comedy Tour February 2014 - Video - May 4th, 2014 [May 4th, 2014]
- Barack Obama on NSA Surveillance I'd Be Concerned Too If I Wasn't in Government - Video - May 4th, 2014 [May 4th, 2014]
- GBPPR Vision #26: Overview of the NSA's TAWDRYYARD Radar Retro-Reflector - Video - May 4th, 2014 [May 4th, 2014]
- NSA proof phone Case - Video - May 5th, 2014 [May 5th, 2014]
- 2014 NSA 2014 Million Dollar Publisher's Lab - Video - May 5th, 2014 [May 5th, 2014]
- Gen. Michael Hayden - the Former Director of NSA and the CIA - Video - May 5th, 2014 [May 5th, 2014]
- REVEALED: Here's The Solution To That Encoded NSA Puzzle Tweet - May 5th, 2014 [May 5th, 2014]
- Michael Hayden's Unwitting Case Against Secret Surveillance - May 5th, 2014 [May 5th, 2014]
- NSA's Encrypted Tweet: We're Hiring Code Breakers - May 5th, 2014 [May 5th, 2014]
- Russ Tice: Life as a NSA Whistleblower - Video - May 5th, 2014 [May 5th, 2014]
- What Is Going on at NSA These Days - Video - May 5th, 2014 [May 5th, 2014]
- What is the Role of the NSA? AFF Dallas Debates - Video - May 5th, 2014 [May 5th, 2014]
- Edward Snowden said CIA , and NSA had 52. 6 Billion for black budget - Video - May 5th, 2014 [May 5th, 2014]
- NSA looks to appeal to young cryptographers through coded ads - May 6th, 2014 [May 6th, 2014]
- Code Cracked: Mysterious NSA Tweet Is Decrypted in Seconds - May 6th, 2014 [May 6th, 2014]