"China is not the only place to engage in this kind of espionage, but they are certainly busy," said James Lewis, a cybersecurity expert at the Center for Strategic and International Studies (CSIS) here.

"They're probably the biggest actors when it comes to economic espionage," Lewis said, and the hacking of Google and more than 30 other firms "fits in with all the complaints you've heard about intellectual property and piracy."

Web security firm McAfee said in its "Virtual Criminology Report" released in November that China, France, Israel, Russia and the United States were among the countries which have developed "advanced offensive cyber capabilities."

"China's at the top of the list," Dmitri Alperovitch, vice president of threat research for McAfee, told AFP. "They have great focus on espionage activities and penetration of organizations.

"They've been very successful in penetrating the US government in a variety of ways in recent years and exfiltrating valuable classified data about ongoing military operations, military hardware specs, that sort of thing," he said.

While stressing McAfee had "no proof" the Chinese government was directly behind the attack on Google, Alperovitch said "there are indications though that a nation-state is behind it."

"It fits the pattern of a very sophisticated cyber espionage program that's been underway for years," said CSIS's Lewis, that involves "more than just the Chinese government.

"There's probably a centrally directed program, an espionage program," he said. "But there's other people who do it as freelancers, or companies do it, or ministries do it.

"There was GhostNet about a year ago, which was a Chinese effort to look at computers around the world," he said. "There was an effort in 2007 to look at defense, energy, commerce, NASA, there were efforts before that targeted at defense."

Ronald Deibert, director of Citizen Lab at the Munk Center for International Studies at the University of Toronto, agreed that Chinese-based hackers are by no means the only ones probing the computer networks of business and political rivals around the world.

"It's not just China that's doing it although China's very aggressive," said Deibert, an author of the GhostNet report, which uncovered a China-based network that had compromised 1,295 government and private computers in 103 countries including those of the Tibetan spiritual leader the Dalai Lama.

"There is a real arms race in cyberspace going on," he said.

"Espionage attacks that we've seen that seem to come from mainland China are consistent with China's strategic doctrine in this area and also consistent with what a lot of other countries are proposing to do in this area," he said.

"For example, if you look at the United States, the director of national intelligence, Dennis Blair, said that we need to be more aggressive stealing other countries secrets," Deibert said.

"In (President Barack) Obama's cybersecurity review, among the things that were underlined was the need to develop operational capabilities to fight and win wars in cyberspace including cyber espionage attacks of this sort."

Web security experts and analysts interviewed by AFP said it is almost impossible to prove who is behind a particular cyberattack and noted that companies rarely come forward and admit that they have been targeted.

"We've conducted a three-year research project on surveillance and one of the things we've learned is how absolutely very difficult it is to study," said Colin Maclay, managing director of the Berkman Center for Internet and Society at Harvard University.

"Anyone will tell you that with properly conducted surveillance you can't catch it," Maclay said. "You just don't know."

"Google did us a favor by coming out of the closet," said CSIS's Lewis. "Most companies won't do it."

Only one other company, Adobe, has acknowledged it was targeted in the attack which Google said originated from China and was an apparent bid for computer source codes, intellectual property, and information about China human rights activists around the world.

While the probing of Google's computer systems was "not unusual," said Citizen Lab's Deibert, what was extraordinary was their "public response."

"And the response they took was quite provocative," he said of Google's decision to no longer censor Internet search results in China and threat to potentially shut down their operations in the world's largest online market.

earlier related report
Web browser vulnerability used in Google attacks: Microsoft
Washington (AFP) Jan 14, 2010 - Microsoft said Thursday that a security vulnerability in its Internet Explorer browser was used in cyberattacks which prompted Google to threaten to shut down its operations in China.

Web security firm MaAfee Inc. said meanwhile that the attacks on Google and other companies showed a level of sophistication beyond that of cyber criminals and more typical of a nation-state.

Revealing the attacks on Tuesday, Google said they originated from China and targeted the email accounts of Chinese human rights activists around the world but did not explicitly accuse the Chinese government of responsibility.

Dmitri Alperovitch, vice president of threat research for McAfee, said that while McAfee had "no proof that the Chinese are behind this particular attack, I think there are indications though that a nation-state is behind it."

Google said more than 20 other unidentified firms were targeted in the "highly sophisticated" attacks while other reports have put the number of companies attacked at more than 30.

Google said that following the attacks it had decided to no longer censor its Internet search engine in China and was prepared to close its operations there entirely if it could not reach an agreement with the Chinese authorities.

Only one other company, Adobe, has come forward so far and acknowledged that it was a target of the attacks, which exploited a previously unknown security flaw in Internet Explorer.

"Internet Explorer was one of the vectors used in targeted and sophisticated attacks targeted against Google and other corporate networks," Mike Reavey, the director of Microsoft's Security Response Center, said in a blog post Thursday.

Reavey stressed that Microsoft "has not seen widespread customer impact, rather only targeted and limited attacks exploiting (Internet Explorer 6)."

Changing browser security settings to "high" would protect users from the vulnerability, he said.

Microsoft chief executive Steve Ballmer said meanwhile that the US software giant takes cyberattacks "seriously" but has no plans to pull out of China.

"We've been quite clear that we're going to operate in China," Ballmer told CNBC television. "We're going to abide by the law.

"We need to take all cyberattacks seriously, not just this one," he said.

McAfee's Alperovitch said the attacks on Google and other companies, which he was not allowed to identify, were unusual in their sophistication.

"We have seen attacks like this before but only in the government space, in the defense-industrial space," Alperovitch said. "We have never seen that level of sophistication, level of planning and reconnaissance and attention to detail in attacks on commercial entities.

"Primarily the threat to commercial entities is from cybercrime individuals after financial data," he said. "They're typically sloppy."

"This exploit was highly sophisticated," he said. "It used multiple levels of obfuscation and encryption, more so than in any other types of exploits that we have seen previously."

Such sophistication is "typically an attribute of a nation-state type of attack -- and that's exactly what we see here," the McAfee researcher said.

Alperovitch said the attackers used email or some other lure to get employees of a targeted company to click on a link and visit a specially crafted website using Internet Explorer.

"Malware would then be downloaded that has the capability to essentially install a 'back door' in the machine," he said. "This allows the attacker to log into the machine and essentially take it over as if they were sitting at the keyboard manipulating that machine.

"What that does is it gives the attacker a beachhead into the organization from which point they can start exploring, identifying valuable pieces of data and other vulnerable services," he said.

del.icio.us	Digg	Reddit
YahooMyWeb	Google	Facebook

Memory Foam Mattress Review

SPACE MEDIA NETWORK PROMOTIONS Solar Energy Solutions Tempur-Pedic Mattress Comparison ... Newsletters :: SpaceDaily :: SpaceWar :: TerraDaily :: Energy Daily XML Feeds :: Space News :: Earth News :: War News :: Solar Energy News