F-22Raptor
ELITE MEMBER
- Joined
- Jun 19, 2014
- Messages
- 16,980
- Reaction score
- 3
- Country
- Location
WASHINGTON — The F.B.I. and the Department of Homeland Security are preparing to issue a warning that China’s most skilled hackers and spies are working to steal American research in the crash effort to develop vaccines and treatments for the coronavirus. The efforts are part of a surge in cybertheft and attacks by nations seeking advantage in the pandemic.
The warning comes as Israeli officials accuse Iran of mounting an effort in late April to cripple water supplies as Israelis were confined to their houses, though the government has offered no evidence to back its claim. More than a dozen countries have redeployed military and intelligence hackers to glean whatever they can about other nations’ virus responses. Even American allies like South Korea and nations that do not typically stand out for their cyberabilities, like Vietnam, have suddenly redirected their state-run hackers to focus on virus-related information, according to private security firms.
A draft of the forthcoming public warning, which officials say is likely to be issued in the days to come, says China is seeking “valuable intellectual property and public health data through illicit means related to vaccines, treatments and testing.” It focuses on cybertheft and action by “nontraditional actors,” a euphemism for researchers and students the Trump administration says are being activated to steal data from inside academic and private laboratories.
The decision to issue a specific accusation against China’s state-run hacking teams, current and former officials said, is part of a broader deterrent strategy that also involves United States Cyber Command and the National Security Agency. Under legal authorities that President Trump issued nearly two years ago, they have the power to bore deeply into Chinese and other networks to mount proportional counterattacks. This would be similar to their effort 18 months ago to strike at Russian intelligence groups seeking to interfere in the 2018 midterm elections and to put malware in the Russian power grid as a warning to Moscow for its attacks on American utilities.
But it is unclear exactly what the U.S. has done, if anything, to send a similar shot across the bow to the Chinese hacking groups, including those most closely tied to China’s new Strategic Support Force, its equivalent of Cyber Command, the Ministry of State Security and other intelligence units.
The forthcoming warning is also the latest iteration of a series of efforts by the Trump administration to blame China for being the source of the pandemic and exploiting its aftermath.
Secretary of State Mike Pompeo claimed this month that there was “enormous evidence” that the virus had come from a Chinese lab before backing off to say it had come from the “vicinity” of the lab in Wuhan. United States intelligence agencies say they have reached no conclusion on the issue, but public evidence points to a link between the outbreak’s origins at a market in Wuhan and China’s illegal wildlife trafficking.
The State Department on Friday described a Chinese Twitter campaign to push false narratives and propaganda about the virus. Twitter executives have pushed back on the agency, noting that some of the Twitter accounts that the State Department cited were actually critical of Chinese state narratives.
But it is the search for vaccines that has been a particular focus, federal officials say.
“China’s long history of bad behavior in cyberspace is well documented, so it shouldn’t surprise anyone they are going after the critical organizations involved in the nation’s response to the Covid-19 pandemic,” said Christopher Krebs, the director of the Cybersecurity and Infrastructure Security Agency. He added that the agency would “defend our interests aggressively."
Last week, the United States and Britain issued a joint warning that “health care bodies, pharmaceutical companies, academia, medical research organizations and local governments” had been targeted. While it named no specific countries — or targets — the wording was the kind used to describe the most active cyberoperators: Russia, China, Iran and North Korea.
The hunt for spies seeking intellectual property has also accelerated. For months, F.B.I. officials have been visiting major universities and presenting largely unclassified briefings about their vulnerabilities.
But some of those academic leaders and student groups have pushed back, comparing the rising paranoia about stolen research to the worst days of the Red Scare era. They particularly objected when Senator Tom Cotton, Republican of Arkansas, declared last month on Fox News that it was “a scandal” that the United States had “trained so many of the Chinese Communist Party’s brightest minds to go back to China.”
Security experts say that while there is a surge of attacks by Chinese hackers seeking an edge in the race for a Covid-19 vaccine, or even effective treatment, the Chinese are hardly alone in seeking to exploit the virus.
Iranian hackers were also caught trying to get inside Gilead Sciences, the maker of remdesivir, the therapeutic drug approved 10 days ago by the Food and Drug Administration for clinical trials. Government officials and Gilead have refused to say if any element of the attack, which was first reported by Reuters, was successful.
Israel’s security advisers met last week for a classified session on a cyberattack on April 24 and 25, which the authorities were calling an attempt to cut off water supplies to rural parts of the country. The Israeli news media has widely blamed the attack on Iran, though they have offered no evidence in public. The effort was detected fairly quickly and did no damage, the authorities said.
The rush to attribute the attack to Iran could be faulty. When a Saudi petrochemical plant was similarly attacked in 2017, Iran was presumed as the source of the effort to cause an industrial accident. It turned out to be coordinated from a Russian scientific institute.
The coronavirus has created whole new classes of targets. In recent weeks, Vietnamese hackers have directed their campaigns against Chinese government officials running point on the virus, according to cybersecurity experts.
South Korean hackers have taken aim at the World Health Organization and officials in North Korea, Japan and the United States. The attacks appeared to be attempts to compromise email accounts, most likely as part of a broad effort to gather intelligence on virus containment and treatment, according to two security experts for private firms who said they were not authorized to speak publicly. If so, the moves suggest that even allies are suspicious of official government accounting of cases and deaths around the world.
In interviews with a dozen current and former government officials and cybersecurity experts over the past month, many described a “free-for-all” that has spread even to countries with only rudimentary cyberability.
“This is a global pandemic, but unfortunately countries are not treating it as a global problem,” said Justin Fier, a former national security intelligence analyst who is now the director of cyberintelligence at Darktrace, a cybersecurity firm. “Everyone is conducting widespread intelligence gathering — on pharmaceutical research, PPE orders, response — to see who is making progress.”
The frequency of cyberattacks and the spectrum of targets are “astronomical, off the charts,” Mr. Fier said.
Even before the pandemic, the United States was becoming far more aggressive in pursuing cases involved suspected Chinese efforts to steal intellectual property related to biological research. The Justice Department announced in January that it had charged Charlies M. Lieber, the chairman of Harvard’s department of chemistry and chemical biology, with making false statements related to his participation in China’s Thousand Talents program to recruit scientific talent to the country.
But Harvard also has a joint study program underway with a Chinese institute on coronavirus treatments and vaccines. And researchers have said that international cooperation will be vital if there is hope for a global vaccine, putting the expected national competitions to be first in tension with the need for a cooperative effort.
At Google, security researchers identified more than a dozen nation-state hacking groups using virus-related emails to break into corporate networks, including some sent to U.S. government employees. Google did not identify the specific countries involved, but over the past eight weeks, several nation states — some familiar, like Iran and China, and others not so familiar, like Vietnam and South Korea — have taken advantage of softer security as millions of workers have suddenly been forced to work from home.
“The nature of the vulnerabilities and attacks has altered pretty radically with shelter-in-place,” said Casey Ellis, the founder of Bugcrowd, a security firm. In some cases, Mr. Ellis said, hackers were just “kicking a baby,” hacking hospitals that were already overstretched and simply lacked the resources to prioritize cybersecurity.
In other cases, they were targeting the tools that workers used to remotely access internal networks and encrypted virtual private networks, or VPNs, that allow employees to tunnel into corporate networks, to gain access to proprietary information.
“Governments that might otherwise be reluctant to target international public health organizations, hospitals and commercial organizations are crossing that line because there is such a thirst for knowledge and information,” said John Hultquist, the director of intelligence analysis at FireEye, a cybersecurity firm.
Even Nigerian cybercriminals are getting in on the game: They recently started targeting businesses with coronavirus-themed email attacks to try to convince targets to wire them money, or to steal personal data that could fetch money on the dark web.
“These are not complex, but clever social engineering is getting them through,” said Jen Miller-Osborn, the deputy director of threat intelligence at Palo Alto Networks, a cybersecurity company. Because Nigerian hackers are less skilled, they lack the so-called “op sec,” or operational security, to cover their tracks.
https://www.nytimes.com/2020/05/10/us/politics/coronavirus-china-cyber-hacking.html
The warning comes as Israeli officials accuse Iran of mounting an effort in late April to cripple water supplies as Israelis were confined to their houses, though the government has offered no evidence to back its claim. More than a dozen countries have redeployed military and intelligence hackers to glean whatever they can about other nations’ virus responses. Even American allies like South Korea and nations that do not typically stand out for their cyberabilities, like Vietnam, have suddenly redirected their state-run hackers to focus on virus-related information, according to private security firms.
A draft of the forthcoming public warning, which officials say is likely to be issued in the days to come, says China is seeking “valuable intellectual property and public health data through illicit means related to vaccines, treatments and testing.” It focuses on cybertheft and action by “nontraditional actors,” a euphemism for researchers and students the Trump administration says are being activated to steal data from inside academic and private laboratories.
The decision to issue a specific accusation against China’s state-run hacking teams, current and former officials said, is part of a broader deterrent strategy that also involves United States Cyber Command and the National Security Agency. Under legal authorities that President Trump issued nearly two years ago, they have the power to bore deeply into Chinese and other networks to mount proportional counterattacks. This would be similar to their effort 18 months ago to strike at Russian intelligence groups seeking to interfere in the 2018 midterm elections and to put malware in the Russian power grid as a warning to Moscow for its attacks on American utilities.
But it is unclear exactly what the U.S. has done, if anything, to send a similar shot across the bow to the Chinese hacking groups, including those most closely tied to China’s new Strategic Support Force, its equivalent of Cyber Command, the Ministry of State Security and other intelligence units.
The forthcoming warning is also the latest iteration of a series of efforts by the Trump administration to blame China for being the source of the pandemic and exploiting its aftermath.
Secretary of State Mike Pompeo claimed this month that there was “enormous evidence” that the virus had come from a Chinese lab before backing off to say it had come from the “vicinity” of the lab in Wuhan. United States intelligence agencies say they have reached no conclusion on the issue, but public evidence points to a link between the outbreak’s origins at a market in Wuhan and China’s illegal wildlife trafficking.
The State Department on Friday described a Chinese Twitter campaign to push false narratives and propaganda about the virus. Twitter executives have pushed back on the agency, noting that some of the Twitter accounts that the State Department cited were actually critical of Chinese state narratives.
But it is the search for vaccines that has been a particular focus, federal officials say.
“China’s long history of bad behavior in cyberspace is well documented, so it shouldn’t surprise anyone they are going after the critical organizations involved in the nation’s response to the Covid-19 pandemic,” said Christopher Krebs, the director of the Cybersecurity and Infrastructure Security Agency. He added that the agency would “defend our interests aggressively."
Last week, the United States and Britain issued a joint warning that “health care bodies, pharmaceutical companies, academia, medical research organizations and local governments” had been targeted. While it named no specific countries — or targets — the wording was the kind used to describe the most active cyberoperators: Russia, China, Iran and North Korea.
The hunt for spies seeking intellectual property has also accelerated. For months, F.B.I. officials have been visiting major universities and presenting largely unclassified briefings about their vulnerabilities.
But some of those academic leaders and student groups have pushed back, comparing the rising paranoia about stolen research to the worst days of the Red Scare era. They particularly objected when Senator Tom Cotton, Republican of Arkansas, declared last month on Fox News that it was “a scandal” that the United States had “trained so many of the Chinese Communist Party’s brightest minds to go back to China.”
Security experts say that while there is a surge of attacks by Chinese hackers seeking an edge in the race for a Covid-19 vaccine, or even effective treatment, the Chinese are hardly alone in seeking to exploit the virus.
Iranian hackers were also caught trying to get inside Gilead Sciences, the maker of remdesivir, the therapeutic drug approved 10 days ago by the Food and Drug Administration for clinical trials. Government officials and Gilead have refused to say if any element of the attack, which was first reported by Reuters, was successful.
Israel’s security advisers met last week for a classified session on a cyberattack on April 24 and 25, which the authorities were calling an attempt to cut off water supplies to rural parts of the country. The Israeli news media has widely blamed the attack on Iran, though they have offered no evidence in public. The effort was detected fairly quickly and did no damage, the authorities said.
The rush to attribute the attack to Iran could be faulty. When a Saudi petrochemical plant was similarly attacked in 2017, Iran was presumed as the source of the effort to cause an industrial accident. It turned out to be coordinated from a Russian scientific institute.
The coronavirus has created whole new classes of targets. In recent weeks, Vietnamese hackers have directed their campaigns against Chinese government officials running point on the virus, according to cybersecurity experts.
South Korean hackers have taken aim at the World Health Organization and officials in North Korea, Japan and the United States. The attacks appeared to be attempts to compromise email accounts, most likely as part of a broad effort to gather intelligence on virus containment and treatment, according to two security experts for private firms who said they were not authorized to speak publicly. If so, the moves suggest that even allies are suspicious of official government accounting of cases and deaths around the world.
In interviews with a dozen current and former government officials and cybersecurity experts over the past month, many described a “free-for-all” that has spread even to countries with only rudimentary cyberability.
“This is a global pandemic, but unfortunately countries are not treating it as a global problem,” said Justin Fier, a former national security intelligence analyst who is now the director of cyberintelligence at Darktrace, a cybersecurity firm. “Everyone is conducting widespread intelligence gathering — on pharmaceutical research, PPE orders, response — to see who is making progress.”
The frequency of cyberattacks and the spectrum of targets are “astronomical, off the charts,” Mr. Fier said.
Even before the pandemic, the United States was becoming far more aggressive in pursuing cases involved suspected Chinese efforts to steal intellectual property related to biological research. The Justice Department announced in January that it had charged Charlies M. Lieber, the chairman of Harvard’s department of chemistry and chemical biology, with making false statements related to his participation in China’s Thousand Talents program to recruit scientific talent to the country.
But Harvard also has a joint study program underway with a Chinese institute on coronavirus treatments and vaccines. And researchers have said that international cooperation will be vital if there is hope for a global vaccine, putting the expected national competitions to be first in tension with the need for a cooperative effort.
At Google, security researchers identified more than a dozen nation-state hacking groups using virus-related emails to break into corporate networks, including some sent to U.S. government employees. Google did not identify the specific countries involved, but over the past eight weeks, several nation states — some familiar, like Iran and China, and others not so familiar, like Vietnam and South Korea — have taken advantage of softer security as millions of workers have suddenly been forced to work from home.
“The nature of the vulnerabilities and attacks has altered pretty radically with shelter-in-place,” said Casey Ellis, the founder of Bugcrowd, a security firm. In some cases, Mr. Ellis said, hackers were just “kicking a baby,” hacking hospitals that were already overstretched and simply lacked the resources to prioritize cybersecurity.
In other cases, they were targeting the tools that workers used to remotely access internal networks and encrypted virtual private networks, or VPNs, that allow employees to tunnel into corporate networks, to gain access to proprietary information.
“Governments that might otherwise be reluctant to target international public health organizations, hospitals and commercial organizations are crossing that line because there is such a thirst for knowledge and information,” said John Hultquist, the director of intelligence analysis at FireEye, a cybersecurity firm.
Even Nigerian cybercriminals are getting in on the game: They recently started targeting businesses with coronavirus-themed email attacks to try to convince targets to wire them money, or to steal personal data that could fetch money on the dark web.
“These are not complex, but clever social engineering is getting them through,” said Jen Miller-Osborn, the deputy director of threat intelligence at Palo Alto Networks, a cybersecurity company. Because Nigerian hackers are less skilled, they lack the so-called “op sec,” or operational security, to cover their tracks.
https://www.nytimes.com/2020/05/10/us/politics/coronavirus-china-cyber-hacking.html
