Source: DTN News - - This article compiled by Roger Smith from reliable sources By NATHAN HODGE And ADAM ENTOUS - The Wall Street Journal
Law-enforcement agencies said they are investigating the incidents, which McAfee said have been going on at least since late 2009 but may have started as early as 2007. The company said the attacks, which they dubbed "Night Dragon," were still occurring.
McAfee said the hackers targeted five multinational firms, but wouldn't identify the companies by name because some of them are clients. McAfee said it was sharing the findings "to protect those not yet impacted and to repair those who have been." Asked if they were victims of the hacking, BP PLC and ExxonMobil Inc., among other large oil companies, declined to comment. ChevronCorp. said it wasn't aware of any successful hacks into the company's data systems by Night Dragon.
Sensitive Internal Documents Taken
According to McAfee, the cyberattacks successfully took gigabytes of highly sensitive internal documents, including proprietary information about oil- and gas-field operations, project financing and bidding documents. And that pattern of espionage, the company said, should raise fresh alarms in the corporate world about information theft.
"While Night Dragon attacks focused specifically on the energy sector, the tools and techniques of this kind can be highly successful when targeting any industry," the report states.
McAfee and its competitors have an incentive for publicizing threats like Night Dragon because they are in the business of selling cybersecurity services. The company has informed the FBI of its report, which said it was investigating the attacks and took the matter seriously.
U.S. intelligence agencies have warned in recent years that China is developing sophisticated cyber warfare strategies which could be used to attack governments and key industries. China, the second-largest economy after the U.S., is keenly interested in competing for energy resources around the world to fuel domestic growth.
"It's important to get this out in public discussion, so companies can identify that kind of threat," said Ron Plesco, CEO of the National Cyber Forensic Training Alliance Foundation, a group that tracks cybercrime threats. "And sharing information adds toward the ultimate goal of mitigation."
The Night Dragon attacks used hacking tools that exploited Microsoft Corp. operating systems and remote administration tools to copy and extract information, according to McAfee. It appears to have been designed purely for spying. "We saw no evidence of sabotage activities" in these attacks, said Dmitri Alperovitch, vice president of threat research at McAfee.
Trail Leads Back to China
Mr. Alperovitch said researchers were able to trace data taken from those companies back to Chinese Internet addresses in Beijing. The hacking tools used were mainly of Chinese origin, he said and the hackers didn't take steps to cover their tracks.
"These individuals almost seemed like company worker bees," he said. "They operated on a strict weekdays, nine-to-five Beijing time-zone schedule."
Through forensic research, McAfee identified one individual who appeared to provide the external servers used by the hackers. McAfee identified this individual as Song Zhiyue, based in Heze City, Shandong Province, China. It is unclear to what extent Mr. Song might have been aware of the espionage. McAfee believes many actors participated in these attacks.
Mr. Alperovitch said it was unclear if the attacks were done with any official sanction. "The facts point to Chinese hacker activity that is organized, so [it is] potentially directed either by the private sector or the public sector. But it's impossible for me to know for sure which one," he said.
Wang Baodong, a spokesman for the Chinese embassy in Washington, said he had no knowledge of the report, but added that past allegations about Chinese hacking had been raised unfairly. "China has very strict laws against hacking activities, and China is also a victim of such activity," he said.
A 2010 Defense Department report to Congress on Chinese military capabilities said computer systems around the world, including U.S. government networks, had been the target of intrusions that appear to originate from China. The report added that it was unclear if those intrusions were done at the behest of the Chinese military of elements of the Chinese government.
Early last year, Google Inc. took the unusual step of complaining publicly about sophisticated cyberattacks that it claimed had originated in China. McAfee investigated those attacks, which it dubbed Operation Aurora. Leaked U.S. diplomatic cables collected by the WikiLeaks website included allegations that the attacks were ordered by top Chinese leaders.
DTN NEWS ON TWITTER (30 SUBJECTS)
