Congress warned: China winning cyber war

China is aggressively developing its power to wage cyber warfare and is now in a position to delay or disrupt the deployment of America's military forces around the world, potentially giving it the upper hand in any conflict, a panel of the US Congress has warned.

The panel's report discloses an alarming increase in incidents of Chinese computer attacks on the US government, defence companies and businesses. It notes that China now has both the intent and capability to launch cyber attacks "anywhere in the world at any time".

The conclusions reached in this year's US-China Economic and Security Review are far more dramatic than before. In 2007, it says, about 5m computers in the US were the targets of 43,880 incidents of malicious activity — a rise of almost a third on the previous year.

China's ability to wage cyber warfare is now "so sophisticated that the US may be unable to counteract or even detect the efforts", the report warns.
Given the dependence on the internet of key sectors of US public life, from the federal government and military to water treatment, social security and the electricity grid, "a successful attack on these internet-connected networks could paralyse the US".

The review's six Democrat and six Republican commissioners travelled to China, Taiwan, South Korea and Japan, and heard testimony from US intelligence agencies for their 393-page report.

There has been concern about Chinese computer espionage since 2002, when a large-scale series of cyber intrusions was launched on US military and government computer systems. In that attack, codenamed Titan Rain by the US, the Chinese downloaded up to 20 terabytes of data — twice the amount stored in the entire print collection of the Library of Congress.

Much of the activity is likely to emanate from groups of hackers, but the lines between private espionage and government-sponsored operations are blurred. Some 250 hacker groups are tolerated, and may even be encouraged, by Beijing to invade computer networks. Individual hackers are also being trained in cyber operations at Chinese military bases.

"China is stealing vast amounts of sensitive information from US computer networks, said Larry Wortzel, the commission's chairman.

According to the report, Beijing is investing huge resources in cyber and space missions because it sees America's computer networks and space assets as its "soft ribs and strategic weaknesses". The extent of its activities gives it the potential to beat the US in military conflict. Technologically, China has improved its range of satellites, so it can now accurately locate US aircraft carrier battle groups quickly, and from a great distance. Such information could be used to guide Chinese missiles to their targets.

The Chinese government has given no response to the accusations, but in the past has complained of cyber attacks coming in the opposite direction.

In addition to cyber warfare, the panel warns that Beijing is taking an increasingly aggressive stance in its rapidly developing space programme. The panel believes China has concluded that space will in future be an essential arena of warfare.

It notes that China tested an anti-satellite weapon last year, giving it the ability to destroy US satellites, in addition to its existing capability to "blind" them by using lasers. So far this year, 15 rockets and 17 satellites have been put into space.

China became the third country to explore space in 2003, after the Soviet Union and the US. Until 2002 Beijing opposed the militarisation of space, but it has quietly dropped its opposition since.

China's growing military power, running parallel to its increasing economic might, is likely to present challenges to the incoming administration of Barack Obama. The president-elect has said that "China is rising and it's not going away", although he prefers to characterise the US-Chinese relationship as one between "competitors" rather than enemies.

// http://www.guardian.co.uk/technology/2008/nov/20/china-us-military-hacking

Hackers warn high street chains

The hackers panel is one of the highlights of InfoSecurity Europe

High street chains will be the next victims of cyber terrorism, some of the world's elite hackers have warned.

They claim it is only a "matter of time" before the likes of Tesco and Marks & Spencer are targeted.

Criminals could use the kind of tactics which crippled Estonia's government and some firms last year, they warned.

The experts were members of the infamous "Hackers Panel" which convened in London this week at the InfoSecurity Europe conference.

The panel includes penetration testers and so-called "white hat" hackers, who help companies tighten up their digital security by searching for flaws in their defences.

Previous panellists include Gary McKinnon, known as Solo, alleged by the US government to have hacked into dozens of US Army, Navy, Air Force, and Department of Defense computers.

The "hackers" usually remain anonymous, "for security reasons", but this year's panellists agreed to break cover.

Common cause

First up was Roberto Preatoni, the founder of the cyber crime monitoring site, Zone-H, and WabSabiLabi, a trading site for security researchers.

His appearance came just a few months after he was arrested by Italian authorities on charges of hacking and wiretapping, as part of the ongoing investigation into the Telecom Italia scandal.

Mr Preatoni told the audience that the attacks in Estonia were a harbinger for a new era of cyber warfare.

Notorious hacker Gary McKinnon has previously taken part in the panel

"I'm afraid we will have to get used to this," said Mr Preatoni, also known as SyS64738. "We had all been waiting for this kind of attack to happen.

"Estonia was just unfortunate to be the first country to experience it. But very soon, our own [western] companies and countries will be getting attacked for political and religious reasons.

"This kind of attack can happen at any time. And it will happen."

During the two week "cyber war" against Estonia, hackers shut down the websites of banks, governments and political parties using "denial-of-service" (DoS) attacks, which knock websites offline by swamping servers with page requests.

As many of the attacks originated from Russia, the Estonian government pointed the finger at the Kremlin. But Mr Preatoni said that, having spoken to contacts in the hacking community, he was clear that "Putin was not involved".

"In my opinion, this was a collection of private individuals who spontaneously gathered under the same flag.

"Even though Estonia is one of the world's most advanced countries in IT technology, the whole economy was brought to its knees.

"That's the beauty of asymmetric warfare. You don't need a lot of money, or an army of people. You can do it from the comfort of your living room, with a beer in your hand.

Gate control

His warning was echoed by Steve Armstrong, who teaches seminars in hacking techniques, at the SANS Institute for information security training.

"If someone wants to have a pop at the UK, they are unlikely to go for the government web servers. They will go for the lower hanging fruit - companies which are seen as good representatives of the country.

"The likes of Tesco, Marks & Spencer and B&Q can be seen as legitimate targets.

"We have to get the message across to companies [to invest in information security].

"At the moment Chief Executives are only interested in the bottom line. But remember - if tesco.com goes down, that's a lot of shopping."

Mr Preatoni said that the Estonian government's repeated failure to thwart the attacks was proof that we still have "no good solutions" for denial of service attacks.

The panellists then argued over whether Internet Service Providers should do more to tighten security, by helping customers' protect their computers from being "zombified" by hackers for use in distributed DoS attacks.

"Actually, I don't think the ISPs should have any role in security," said Preatoni.

"In my opinion, that's like asking the Royal Mail to be responsible for the quality of your post."

But his view was immediately challenged by the third panellist, Jason Creasey, head of research at the independent Information Security Forum.

"I believe ISPs can play a phenomenal role in security, with a little bit of legal pressure," he claimed.

Net weakness

He was backed by an audience member, Angus Pinkerton, of Lynks Security Consulting. "The only way to defend against a distributed attack is with a distributed defence," he argued.

"I think it's unacceptable that ISPs are content to let their customers be part of bot-nets."

He challenged Steve Armstrong's view that asking ISPs to perform security duties was "fundamentally, censorship."

"This is not about free speech," said Mr Pinkerton. "Free speech does not entitle you to shout fire in a crowded theatre."

In the meantime, Mr Preatoni warned the audience it is "only going to get easier" to carry out a DoS attack, because he claimed the latest net address system, known as Internet Protocol Version 6 (IPv6), is actually more amenable to DoS.

Later, he told the BBC that the rise in cyber attacks originating in China was a convenient cloak for western countries to disguise their own cyber espionage activities.

"It's too easy to blame China," he said. "In fact, legitimate countries are bouncing their attacks through China. It's very easy to do, so why not?

"My evil opinion is that some western governments are already doing this."