#Chinesemilitarygroup #linkedtohacks of #USandEuropeansatellitecompanies A #USsecuritycompanyclaims that a #hackergroup #basedinPeoplesLiberationArmyoffices was #responsiblefortheattacks Share 22 Email Tom Brewster theguardian, Tuesday 10 June 2014 13.41 BST Jump to comments (26) The alleged workplace of the Chinese hacker group. The alleged workplace of the Chinese hacker group. Photograph: Crowdstrike A Chinese hacker group thought to be based in People’s Liberation Army offices was responsible for attacks on US and European satellite companies, a security company has claimed. The report comes just weeks after the US filed charges against five members of a cyber division thought to be working out of the same military organisation, known as Unit 61398, for alleged breaches of six US organisations. The attacks, detailed on Monday, are said to be the work of Unit 61486, and primarily sought to steal trade secrets of private and public bodies operating in the satellite, aerospace and communication industries, according to US firm Crowdstrike. Two separate sources familiar with the activities of the group, which is known as Putter Panda and has been operating since at least 2009, told the Guardian it had attacked companies within the UK. It’s also believed Units 61486 and 61398, the latter also known as APT1, are closely linked. “We do track hundreds of threat actors and this group [Unit 61486] would be covered in our attribution – they are very close to APT1,” said Jason Steer, director of technology strategy at FireEye. Putter Panda hackers sent emails to targets, attempting to lure them into clicking on attachments that promised information on upcoming conferences, the Crowdstrike researchers said. When the attachments were opened, bespoke malware known as remote access trojans would be surreptitiously downloaded on recipients’ systems by exploiting vulnerabilities in Adobe Reader and Microsoft Office. Crowdstrike went as far as to name Chen Ping, aka cpyy, as one of the main operators within Unit 61486, as he was named as the registrant of the internet domains used to manage the attacks. The company said it was not sure if that was cpyy’s real name. Yet his operational security may not have been up to snuff, as researchers found various clues that linked him to the PLA. These included personal pictures posted across his internet accounts, including an “office” file that included images linked to PLA facilities in Shanghai, as well as what appeared to be photos from his dormitory room showing two PLA army officer peak hats. The domains he was thought to have registered were linked to an address corresponding to the physical location of the Shanghai headquarters of Unit 61486, in the Zhabei district of Shanghai, the researchers said. Another person was linked to the group, known as httpchen, who had claimed to be attending the School of Information Security Engineering at Shanghai Jiao Tong University, a “recruiting ground for the PLA to find personnel for its cyber intelligence gathering units”, the Crowdstrike report read. Unit 61486 is part of the PLA’s General Staff Department (GSD) Third Department, the primary intelligence collection and analysis group within China, Crowdstrike said, and supports China’s space surveillance network. Such specific attribution could be incorrect. Security expert Jeffrey Carr said in a blog post the Crowdstrike attribution was not based on sufficient evidence, whilst Steer said it was “very hard to be able to state with 100% confidence that any group or individual is behind an attack just because of the ease at which it is able to make yourself look like someone else on the internet”. Aviv Raff, CTO of security firm Seculert, which has been tracking the attacks since 2012, said he had also uncovered links to China, but could not prove they emanated from the PLA. A separate report on Tuesday from security company FireEye suggests Chinese hackers are also using social media in their targeted attacks on critical infrastructure providers. It detailed a case involving an unnamed energy company and a fake persona called Emily, a purported job applicant, which was used to contact an employee over social media in an attempt to gather information from the firm. The resume sent by Emily via email also included malware, which would install a backdoor on target computers to allow the hackers access. The attacks have been linked to a group called Clandestine Fox, which FireEye believes is based out of China. Some sectors of the security industry and within government are calling on the US and others to apply more pressure on China to curb its digital espionage activity, which the Asian superpower denies ever carrying out. “We believe that organisations, be they governments or corporations, global or domestic, must keep up the pressure and hold China accountable until lasting change is achieved,” the CrowdStrike report read. “Through widespread espionage campaigns, Chinese threat actors are targeting companies and governments in every part of the globe.” The Chinese Embassy in London had not responded to a request for comment at the time of publication. The Chinese government has previously declared the US charges against its officials “ridiculous” and demanded that it rescind the indictments. • How to protect yourself from phishing theguardian/technology/2014/jun/10/chinese-military-group-hacks-us-european-satellite-companies?guni=Keyword:alternate-grid%20main-3%20Top%20stories:Pickable%20with%20editable%20override:Position1
Posted on: Tue, 10 Jun 2014 20:42:04 +0000
Trending Topics
Recently Viewed Topics
© 2015