Reports of Chinese hacker activity are surfacing again. First against Germany, then unclassified Pentagon networks, the EU parliment (in 2005) and now the UK. These reports seem to constantly rear their heads. But, as I pointed out in 2005, the limited descriptions of the attacks that filter into the press, have the same MO as the Chinese Triads (that info is from 1997). Given the big move of criminal organisations onto the Internet, why is the first assumption the Chinese Government?
I have two (non exclusive) theories, the first more likely than the second:
- The targeted compromise of government and sensitive corporate networks is far more widespread than the few media reports we receive, and possible of the events detected by the security teams.
- The 'horn blowing' around these attacks is completely opposite to what we have seen with other compromises where it took a (American only) law to get any sort of disclosure out of companies. Could it be that some sort of pariah state is looking to garner sympathy for an attack (the truth of the compromise is not relevant in this theory).
“The Trojan is an old trick favoured by Chinese hackers,” Mr Preatoni said.
Trojans
are also favoured by malware writers and SPAMmers, in fact, a majority
of malware written at the moment is Trojan and/or bot based, with the
line between the two getting blurry. Even better:
The attacks are part of a pattern in which China and Russia are switching from “old-fashioned espionage” techniques to electronic hacking into government computers to gain Britain’s military secrets, the sources added.
It seems Russia is added to the pot, which is just as silly, as we know there is a ton of organised internet-based crime originating from there too. Once again, the message being clearly spelled out is that this is 'espionage' which implies government involvement.