Reports of Chinese hacker activity are surfacing again. First against Germany, then unclassified Pentagon networks, the EU parliment (in 2005) and now the UK. These reports seem to constantly rear their heads. But, as I pointed out in 2005, the limited descriptions of the attacks that filter into the press, have the same MO as the Chinese Triads (that info is from 1997). Given the big move of criminal organisations onto the Internet, why is the first assumption the Chinese Government?
I have two (non exclusive) theories, the first more likely than the second:
- The
targeted compromise of government and sensitive corporate networks is
far more widespread than the few media reports we receive, and possible
of the events detected by the security teams.
- The 'horn
blowing' around these attacks is completely opposite to what we have
seen with other compromises where it took a (American only) law to get
any sort of disclosure out of companies. Could it be that some sort of
pariah state is looking to garner sympathy for an attack (the truth of
the compromise is not relevant in this theory).
To put this
into context, bear in mind that the US is usually rated as the biggest
source of intrusion attempts and SPAM in many reports, but we don't see
these referred to as 'Attacks by the US'. Is this just another case of
'them and us'? Quotes such as the following highlight this mentality:
“The Trojan is an old trick favoured by Chinese hackers,” Mr Preatoni said.
Trojans
are also favoured by malware writers and SPAMmers, in fact, a majority
of malware written at the moment is Trojan and/or bot based, with the
line between the two getting blurry. Even better:
The attacks are part of a pattern in which China and Russia are switching from “old-fashioned espionage” techniques to electronic hacking into government computers to gain Britain’s military secrets, the sources added.
It seems Russia is added to the pot, which is just as silly, as we know there is a ton of organised internet-based crime originating from there too. Once again, the message being clearly spelled out is that this is 'espionage' which implies government involvement.