Security experts have discovered the biggest series of cyberattacks to date, involving the infiltration of the networks of 72 organisations including the United Nations, governments and companies around the world.
Security company McAfee, which uncovered the intrusions, said it believed there was one “state actor” behind the attacks but declined to name it, though one security expert who has been briefed on the hacking said the evidence points to China.
The long list of victims in the five-year campaign include the governments of the United States, Taiwan, India, South Korea, Vietnam and Canada; the Association of Southeast Asian Nations; the International Olympic Committee (IOC); the World Anti-Doping Agency; and an array of companies, from defence contractors to high-tech enterprises.
In the case of the United Nations, the hackers broke into the computer system of its secretariat in Geneva in 2008, hid there for nearly two years, and quietly combed through reams of secret data, according to McAfee.
“Even we were surprised by the enormous diversity of the victim organisations and were taken aback by the audacity of the perpetrators,’ McAfee’s vice-president of threat research, Dmitri Alperovitch, wrote in a 14-page report released on Wednesday.
“What is happening to all this data ... is still largely an open question. However, if even a fraction of it is used to build better competing products or beat a competitor at a key negotiation (due to having stolen the other team’s playbook), the loss represents a massive economic threat.”
McAfee learned of the extent of the hacking campaign in March this year, when its researchers discovered logs of the attacks while reviewing the contents of a “command and control” server that they had discovered in 2009 as part of an investigation into security breaches at defence companies.
It dubbed the attacks “Operation Shady RAT” and said the earliest breaches date back to mid-2006, though there might have been other intrusions. (RAT stands for “remote access tool”, a type of software that hackers and security experts use to access computer networks from afar).
Some of the attacks lasted just a month, but the longest — on the Olympic Committee of an unidentified Asian nation — went on and off for 28 months, according to McAfee. “Companies and government agencies are getting raped and pillaged every day. They are losing economic advantage and national secrets to unscrupulous competitors,” Mr Alperovitch said.
“This is the biggest transfer of wealth in terms of intellectual
property in history,” he said. “The scale at which this is occurring is really, really frightening.”
Mr Alperovitch said that McAfee had notified all 72 victims of the attacks, which are under investigation by law enforcement agencies around the world. He declined to give more details.
Jim Lewis, a cyber expert with the Centre for Strategic and International Studies, who was briefed on the hacking discovery by McAfee, said it was very likely that China was behind the campaign because some of the targets had information that would be of particular interest to Beijing.
The systems of the IOC and several national Olympic Committees were breached in the runup to the 2008 Beijing Games, for example.
And China views Taiwan as a renegade province, and political issues between them remain contentious even as economic ties have strengthened in recent years. “Everything points to China. It could be the Russians, but there is more that points to China than Russia,” Mr Lewis said.
McAfee, acquired by Intel Corporation this year, would not comment on whether China was responsible.
Vijay Mukhi, an independent cyber-expert based in India, says some south Asian governments, including India, are highly vulnerable to hacking from China as it strives to broaden its influence and strategic interests in the region. “I’m not surprised because that’s what China does, they are gradually dominating the cyberworld,” he said.
“I would call it child’s play (for a hacker to get access to Indian government data) ... I would say we’re in the stone age.” An Indian telelcommunications official declined to say if he was aware of the hacking on the government.
The UN said it was aware of the report, and that it has started an investigation to ascertain if there was an intrusion. But Hwang Mi-kyung, with leading South Korean cyber security firm Ahnlab, cautioned against assuming China was the only one involved. “I think we’re beyond the stage where we should be focusing on the technical aspect of addressing individual attacks and instead we should think more in terms of what we can do policywise. For that, the involvement of the Chinese government is very important,” she said.
McAfee released the report to coincide with the start of the Black Hat conference in Las Vegas on Wednesday, an annual gathering of security professionals and hackers who use their skills to promote security and fight cyber crime.
In the scorching desert heat, they will meet to talk about a series of recent headline-grabbing hacks, such as on Lockheed Martin, the International Monetary Fund, Citigroup, Sony Corporation and EMC Corp’s RSA Security.
The activist groups Anonymous and Lulz Security have recently grabbed the spotlight for temporarily shutting down some high-profile websites and defacing others.
But attacks like Operation Shady RAT are far more costly and often undisclosed, as victims fear reputational damage or attention from other hackers. McAfee sees Operation Shady RAT as the tip of the iceberg.
“I am convinced that every company in every conceivable industry with significant size and valuable intellectual property and trade secrets has been compromised (or will be shortly), with the great majority of the victims rarely discovering the intrusion or its impact,” Mr Alperovitch wrote in the report.
“In fact, I divide the entire set of Fortune Global 2000 firms into two categories: those that know they’ve been compromised and those that don’t yet know.”