Thursday May 23, 2019
Home Lead Story Chinese Hacki...

Chinese Hacking Group Targets US Universities in Search of Military Secrets: Reports

The hackers use spear phishing, meaning that they pose as partner universities to the target

0
//
hackers, china military, hacking group
A building alleged to house a Chinese military-led hacking group is shown in Shanghai in a file photo. RFA

Hackers based in China have targeted at least 27 universities in the United States in search of maritime military secrets, security research firm iDefense has found as part of ongoing research.

According to a threat report by iDefense, the security research arm of Accenture, Chinese hacking groups have targeted 27 U.S. universities, and the number may rise as their research continues.

The hackers use spear phishing, meaning that they pose as partner universities to the target.

If the e-mails are opened, they unleash malware that allows hackers based in China to access stored research, iDefense reported.

The Massachusetts Institute of Technology (MIT) was among the targets, which also included the University of Washington, it said.

The Wall Street Journal reported that Penn State and Duke University were also targeted.

All of the targets had researchers working on submarine technology or related fields, including oceanography.

hackers, china military, hacking group
The hackers use spear phishing, meaning that they pose as partner universities to the target. Pixabay

iDefense said the hackers are likely affiliated with a group known as MUDCARP, and also referred to as TEMP.PERISCOPE, Periscope and Leviathan.

“Collection requirements appear to include several very specific submarine technologies produced by multiple cleared defence contractors (and their respective supply chains),” iDefense’s report said.

“Any technology or program that involves the delivery or launching of a payload from a submerged submarine, or undersea autonomous vehicles, is of high interest to MUDCARP,” it said.

State backing

The report comes after a March 4 report by FireEye, where researchers looking into the activities of MUDCARP, which it names APT40 (advanced persistent threat) were fairly confident that it had Chinese state backing.

It said the group targets organizations operating in Southeast Asia, especially relating to recent elections there, or linked to the South China Sea disputes and other actors who could affect the Chinese Communist Party’s Belt and Road infrastructure development plan, the FireEye report said.

“APT40 uses a variety of malware and tools to establish a foothold, many of which are either publicly available or used by other threat groups,” it said. “APT40 will often target VPN and remote desktop credentials to establish a foothold in a targeted environment.”

 

hackers, hacking group, military
If the e-mails are opened, they unleash malware that allows hackers based in China to access stored research, iDefense reported. Pixabay

Once the foothold is established, APT40 “uses a mix of custom and publicly available … tools to escalate privileges,” it said, including online dumps of leaked user data.

Naval development

Chieh Chung, a research fellow at the National Policy Foundation on the democratic island of Taiwan, said China’s People’s Liberation Army (PLA) has been putting huge resources into to developing its navy in recent years.

“[Information about] the Yellow Sea, the East China Sea, and the hydrological environment associated with the South China Sea are very important for maritime operations, especially for submarines,” Chieh told RFA.

“If [they] use such methods to collect data stored in other countries over a long period of time, they will succeed in filling the gaps in their own data pretty quickly,” he said.

“Much of this information, especially seabed topography, seawater salinity changes, and so on, are deemed classified by many countries.”

Chieh said it wouldn’t always be obvious to victims that they are being “phished,” because e-mails could be sent by researchers in the same field, while attachments could be articles or reports on hydrology.

“They may even pretend to be a sender with whom [the target] has a real-life connection, and trick them into opening the e-mail that way,” he said.

hackers, hacking group, military
iDefense said the hackers are likely affiliated with a group known as MUDCARP, and also referred to as TEMP.PERISCOPE, Periscope and Leviathan. Pixabay

Habits, awareness

Lin Ying-yu of Taiwan’s Chungcheng University said the key to preventing cyberattacks still resides with people, rather than defensive software.

“The focus is on users’ habits and awareness of information security,” Lin said. “All students and employees need to know that this threat exists.”

He said cyber attacks originating in China have shown a resurgence in recent years after a relatively quiet period.

Chinese rights activist and tech expert Pu Fei said the only effective way to prevent such attacks is through “air gaps”: physical barriers between classified material and the internet.

ALSO READ: “They Don’t Make Prayerful Offerings When They Harvest,” Story Of The Native American Church

“There is no such thing as a firewall that is 100 percent effective,” Pu said. “I still think that the best method is to cut computers that need top-level security off physically.”

“They shouldn’t be connected to the internet, or to any internal network,” he said. “That is a pretty safe way to go.” (RFA)

Next Story

US Lawmakers Seek Probe to Control the Spread of Hacking Tools Sold Globally

The bill is expected to be voted on by the full appropriations committee in the coming weeks before going onto the full House

0
hacking
A man takes part in a hacking contest during the Def Con hacker convention in Las Vegas, Nevada, on July 29, 2017. VOA

U.S. lawmakers are pushing legislation that would force the State Department to report what it is doing to control the spread of U.S. hacking tools around the world.

A bill passed in a House of Representatives’ appropriations subcommittee on Tuesday said Congress is “concerned” about the State Department’s ability to supervise U.S. companies that sell offensive cybersecurity products and know-how to other countries.

The proposed legislation, released on Wednesday, would direct the State Department to report to Congress how it decides whether to approve the sale of cyber capabilities abroad and to disclose any action it has taken to punish companies for violating its policies in the past year.

National security experts have grown increasingly concerned about the proliferation of U.S. hacking tools and technology.

hacking
National security experts have grown increasingly concerned about the proliferation of U.S. hacking tools and technology. Pixabay

The legislation follows a Reuters report in January which showed a U.S. defense contractor provided staff to a United Arab Emirates hacking unit called Project Raven. The UAE program utilized former U.S. intelligence operatives to target militants, human rights activists and journalists.

State Department officials granted permission to the U.S. contractor, Maryland-based CyberPoint International, to assist an Emirate intelligence agency in surveillance operations, but it is unclear how much they knew about its activities in the UAE.

Under U.S. law, companies selling cyber offensive products or services to foreign governments must first obtain permission from the State Department.The new measure was added to a State Department spending bill by Dutch Ruppersberger, a Democrat from Maryland and member of the House Appropriations Committee.

Ruppersberger said in an emailed statement he had been “particularly troubled by recent media reports” about the State Department’s approval process for the sale of cyberweapons and services.

CyberPoint’s Chief Executive Officer Karl Gumtow did not respond to a request for comment. He previously told Reuters that to his knowledge, CyberPoint employees never conducted hacking operations and always complied with U.S. laws.

hacking
Rep. Dutch Ruppersberger, D-Md. questions U.S. Ambassador to the UN Nikki Haley as she testifies on Capitol Hill in Washington, Tuesday, June 27, 2017. VOA

The State Department has declined to comment on CyberPoint, but said in an emailed statement on Wednesday that it is “firmly committed to the robust and smart regulation of defense articles and services export” and before granting export licenses it weighs “political, military, economic, human rights, and arms control considerations.”

ALSO READ: Huawei Warns Ban on 5G Technology would Harm American Workers

Robert Chesney, a national security law professor at the University of Texas, said the Reuters report raised an alarm over how Washington supervises the export of U.S. cyber capabilities.

“The Project Raven (story) perfectly well documents that there is reason to be concerned and it is Congress’ job to get to the bottom of it,” he said. The bill is expected to be voted on by the full appropriations committee in the coming weeks before going onto the full House. (VOA)