My First-hand Experience with China's Most Successful Technology Transfer Campaign (better than hacking)

There's no doubt that China is on an aggressive technology acquisition track and has been for 20+ years. Way too much emphasis has been placed on the vacuuming of data from U.S. companies through targeted attacks (otherwise known by the marketing buzzword "APT"). That's actually a terribly inefficient way to conduct the scale of tech transfer that China needs and a lot of the data that gets scooped up has low value, which is partly why I believe that hacker groups from many different countries (including China) are the main instigators behind those attacks rather than the PLA or a Foreign Intelligence Service. Small scale hacker groups are like burglars breaking into peoples' houses. They take as much as they can carry and then try to fence the goods for whatever they can get.

The Chinese government has crafted a much more elegant, legal, and precise way to obtain the exact type of technology that they need. They offer tax incentives and access to the biggest market in the world to U.S. companies who open their Research and Development centers in China. To date, over 1200 companies have taken China up on that offer including Boeing, Microsoft, Dell, Cisco, Intel, GE and many, many more. Part of the deal is that these U.S. companies must hire a percentage of Chinese engineers, who stay for a year or two; learn everything they can about the technology of interest, and then leave to work for a Chinese national champion firm or state-owned enterprise.

Here's a recap of my own first-hand experience with this process. As I've mentioned before, Taia Global has a product in development called Chimera. We are building the world's first and largest commercial database of adversary states' research and development priorities, focusing on technologies that are U.S. export-controlled. These represent the creme de la creme of targets for acts of industrial and cyber espionage. I've been searching for a data scientist with a background in document-matching. Being an ex-Microsoft employee, I started with the Microsoft Research website and learned that almost all of the researchers working on NLP and Search topics are at Microsoft Asia (in Beijing). I identified a couple of researchers in the precise field that I was looking for and sent email introductions to both. It turned out that both had left Microsoft Research and went to work for Huawei's internal R&D lab.

The U.S. government fueled by testimony from InfoSec industry experts can complain about Spear Phishing, APT, and Chinese hackers day-in and day-out but that won't begin to address the much more serious problem of how so many top U.S. firms willingly give their intellectual property away for the promise of cheap research costs and lucrative access to a massive Chinese market. What complaining about the Chinese government hacking U.S. corporations will do is keep the conversation in a politically advantageous zone and away from the political minefield that represents US companies exporting their R&D overseas. If you're looking to blame someone for the estimated $300 billion in IP loss that the U.S. suffered last year, start by taking a hard, honest look at what U.S. companies are willing to risk in order to do business in China.

Related

"China Operates the World's Most Successful Honey Pot"

Add to Cart View detail

DOD Using Chinese satellites underscores the need to negotiate a cyber strategy with China

On March 15, 2013 I wrote an article for Slate magazine ("The U.S. response to Chinese cyberespionage is going to backfire") wherein I said:

The anti-China sentiment on the Hill, in the Pentagon, and at the White House clashes with the pro-China business policies of major U.S. companies, including those with very active in-house security operation centers. Beijing surely knows about this disconnect—and that makes the U.S. strategy look weak or inferior.

That was underscored in a big way with yesterday's announcement via the Danger Room blog that the U.S. Department of Defense's need for satellite bandwidth is so great that they have no alternative but to buy satellite time from the China Satellite Communications company.

Leaving aside DOD's justification for it and the steps that they're taking to protect their data from Chinese collection. And also leaving aside the fact that DOD data WILL be collected despite the encryption and that Chinese researchers have compromised 5 of the world's top ten encryption algorithms, the key take-away here is my original point; that sinophobic cold war rhetoric coming from some information security firm officials, western media, and Congress while U.S. businesses and now the Pentagon NEED to work with China makes the U.S look ridiculous and weak. As I wrote for Slate:

A better approach might be for the federal government to quietly encourage U.S. companies to take steps to harden their networks against low-level attacks (which will shrink the attack surface); identify, segregate, and monitor their crown jewels (which will make it harder for any adversary, including China, to steal them); and engage with China and Russia against a mutual enemy (mercenary hacker crews). This eliminates the rhetoric and focuses on collaboration—a requirement, since the U.S. is never going to make good on threats against the single biggest holder of U.S. debt and a vital market for U.S. multinationals.

Add to Cart View detail

China: Our Incompetent Master Adversary?

According to an article in today's Guardian, State Department and Pentagon officials with their Chinese counterparts have engaged in at least two cyber war games in 2011 and have another planned for next month. These war games are coordinated by two think tanks: Center for Strategic and International Studies for the U.S. and the China Institute of Contemporary International Relations. The goal is to try to manage escalating hostilities between the two nations over China's perceived massive cyber espionage campaign against U.S. companies.

It's distressing to see that the tensions have risen to this point because its based on a seriously flawed evaluation of the facts by well-known companies plus former and present U.S. government officials. For example:

U.S. information security companies like RSA, McAfee, Mandiant, and others routinely issue reports blaming China and ONLY China for intrusions that they've encountered. It's incredible to me that in spite of the 30+ countries actively engaging in acts of cyber espionage, these security giants have only caught China in the act.

Secretary of State Hilary Clinton has been quick to blame China for cyber attacks that targeted Google but for no other reason then because Google said so. And the Secretary has never once warned other countries to cease their cyber attacks against the U.S.

The U.S. China Economic and Security Review Commission routinely puts out alarmist reports about China's military cyber buildup while deliberately refusing to hear testimony by experts who have contrary views to the commission's anti-China agenda.

Richard Clarke's sinophobic, alarmist op-eds routinely get published in the Wall Street Journal and elsewhere even though Mr. Clarke has no standing as a cyber security expert.

No wonder that the Chinese government's irritation with the U.S. has risen to the point where we need CSIS and its Chinese counterpart to conduct a mediation. Beijing is getting tired of being blamed for every attack against every company everywhere in the world, and they're right to be mad. As I've said many times before, it's not that China doesn't do it; they absolutely do, but so do many other countries and just as frequently yet we almost never hear about a major breach being blamed on any country other than China. Either China is the greatest and dumbest adversary that we've ever had, or the real dummies are those in the InfoSec industry who can't be bothered to question the obvious when doing incident response, or who choose to cater to the rising tide of Sinophobia in the U.S. in order to boost their sales; or to politicians and journalists who parrot back the faulty claims of those same companies thereby perpetuating a bad cycle that has resulted in real-world tensions that could have been handled in a more constructive way all along.

While the marketing of anti-China sentiment by some in the InfoSec industry is clearly one part of this disaster in foreign relations, Media deserves its share for opting to print stories that cater to China FUD because it results in higher readership which means more advertising revenue. Since the American public is generally naive about cyber operations by nation states, they believe what they hear about China in the media and cast their votes for the politician who will save them from the menacing red dragon who's sopping up their brain waves and living inside their electric wires. Politicians being what they are cater to that fear and make pronouncements and threats accordingly in order to win votes.

The solution to this problem is simple. As a nation, we need to ask more questions. Accept nothing at face value no matter which "authority" tells it to you, including me. Good intelligence analysts uses negative analysis to test their findings before sending it on to their customers. A little more negative analysis by all parties involved may be what's needed to reduce U.S.-China tensions and improve U.S. security. And it doesn't cost any money to do it. 

Add to Cart View detail

A Review of the NCIX Report on Foreign Economic Collection and Industrial Espionage

Although this is the 14th report on Foreign Economic Collection and Industrial Espionage, it's the first to be written by the Office of the National Counterintelligence Executive (ONCIX); a post created in 2009 under the Office of the Director of National Intelligence. It's also the first to include cyber espionage in its coverage which was a bit surprising to me considering how long cyber espionage has been around. Other firsts in this report are that the ONCIX expanded its traditional sources within the government to include the private sector as well as academic research in an effort to gain the broadest possible coverage of the problem. The report also mentioned but didn't specify "new sources of government information".

I liked this report very much. It's the first official report that I've seen which mentions Russia with China as a source of cyber espionage. I can't tell you how exhausting it's been to try to refute so-called experts who proclaim loudly and often the twin fallacies that only China engages in cyber espionage while only Russia engages in cyber crime. When confronted, some of these experts will fall back on the "if you only had a clearance" retort. Well, ONCIX is cleared, and they came up with essentially the same assessment that I usually give:

We judge that the governments of China and Russia will remain aggressive and capable collectors of sensitive US economic information and technologies, particularly in cyberspace.

The report gets a lot of things right. While it mentions specific states like Russia and China, it also gives tangible examples of espionage that have nothing to do with cyberspace. This is important because it sets a precedent for Russia and China's past activities. Cyberspace has simply made it easier and more efficient for the collectors. For example:

Dongfan Chung was an engineer with Rockwell and Boeing who worked on the B-1 bomber, space shuttle, and other projects and was sentenced in early 2010 to 15 years in prison for economic espionage on behalf of the Chinese aviation industry. At the time of his arrest, 250,000 pages of sensitive documents were found in his house. This is suggestive of the volume of information Chung could have passed to his handlers between 1979 and 2006.a The logistics of handling the physical volume of these documents—which would fill nearly four 4-drawer filing cabinets— would have required considerable attention from Chung and his handlers. With current technology, all the data in the documents hidden in Chung’s house would fit onto one inexpensive CD.

Further, the report demonstrates motivation by identifying key technologies of interest to developing and developed nations:

• Information and communications technology (ICT), which forms the backbone of nearly every other technology.
• Business information that pertains to supplies of scarce natural resources or that provides foreign actors an edge in negotiations with US businesses or the US Government.
• Military technologies, particularly marine systems, unmanned aerial vehicles (UAVs), and other aerospace/ aeronautic technologies.
• Civilian and dual-use technologies in sectors likely to experience fast growth, such as clean energy and health care/pharmaceuticals.

Taia Global clients get a more specific assessment of various nation states' "shopping lists" which help us identify who our clients may have been attacked by, but I'm really happy to see this assessment included in the NCIX report.

While it has many positive points, this report falls short in a few areas. They could have included more information about how Russia is engaging in cyber espionage. Also, under Resources for Help in Appendix A, the report says to contact the NCIX or FBI for assistance in developing effective data protection strategies. I don't have any experience in working with the NCIX but I can tell you that the FBI is completely overwhelmed by cyber cases. We regularly hear from companies who have been contacted by the FBI about a breach in their network but who receive very little to no help at all after the initial contact. They just don't have the resources. Short of the FBI, there's no one else in government that the authors of this report could reasonably list as a point of contact for assistance. 

One might think that they could have listed US-CERT and DHS but neither organization has proven itself as particularly effective or competent in protecting civilian infrastructure. They couldn't list private information security companies for obvious reasons so this underscores a gap that may need filling by a non-profit public-private entity yet to be created.

Add to Cart View detail

The Case Against The Case Against China

This blog post is in response to Jamie Metzl's article "China and Cyberespionage" which, in turn, contains the source material for his Wall Street Journal Op-Ed "China's Threat To World Order" which unfortunately you have to pay Rupert Murdoch in order to read. I learned about this article when Mr. Metzl sent me a tweet asking if I agreed with him. Since I couldn't convey my answer in 140 characters or less, here's my critique of the article.

Mr. Metzl wrote that "China is one of the world's worst state perpetrators of cyber-espionage and malicious computer hacking". In order for that statement to be considered true, Mr. Metzl needed to identify at least some of the nation states who engage in that activity (i.e., Russia, France, Israel, U.S., etc.) and then demonstrate some kind of rating system which puts China at the top. He didn't do that. He merely listed a few reports that tell us what we already know: China engages in cyberespionage on a wide-spread and pervasive basis. The ones that talk about China's cyber warfare operations technically shouldn't be included in Metzl's article since warfare and espionage fall into distinctly separate legal categories and this field is sloppy enough already.

After "Reports" comes "Officials". This entire section should be shit-canned because many (not all) officials operate at the 50,000 foot level and really don't have a grasp of the subject matter. They have legislative aides who in turn ask other so-called experts for their opinion and then give a 5 minute briefing to their boss who reads from a statement. The officials that you want to listen to are the ones like General Hayden who limit their remarks to what they actually know. The others who pretend to know what they're talking about, but really don't (like Richard Clarke on China), do more harm than good despite their past laudable public service.

Moving on to Shady Rat, Night Dragon, Operation Aurora, et al. They all rely on Chinese IP addresses and/or Chinese toolmarks in the code; neither of which means that it came from China. Mr. Metzl and I could lease time on a Chinese server and send Richard Clarke a love letter and he'd no doubt be convinced that it came from Chinese intelligence because the IP address of our email account resolved to Beijing. Malicious software programs like the Ghost Remote Access Tool (RAT) are widely available on the Net so I could have added a malicious link to such a program for good measure.

Listing RSA as a Chinese operation is an insult to China. RSA's own security was astoundingly poor - disgraceful, in fact. So was EMC's handling of the incident. Apart from Joe Stewart's claims which rely on the fatally flawed IP address argument, I've seen no evidence to support a finding of attribution by any nation state for the RSA breach.

In conclusion Mr. Metzl, thanks for encouraging a discussion on this topic. China does engage in cyber espionage on a massive scale, but so does another half-dozen or more countries; most of whom apparently do it much better than China because no one seems to have caught them at it. Therefore my opinion on your article is that you've failed to make the case that the Chinese government is to blame for everything that you and so many others are claiming. Bad analysis relying on faulty evidence or sheer ignorance doesn't become good analysis because it's been repeated a hundred gazillion times. 

Add to Cart View detail

Russian Federation Sets New Science Priorities As 5 US Labs Are Breached

image of accelerator at Large Hadron Collidor

2011 may be the worst year on record for cybersecurity breaches at U.S. national labs and related facilities: 5 breaches in 6 months:
April 11:
- Oak Ridge National Laboratory (managed by Battelle)
- Method of attack - spear phishing w/ 0day payload
June 11:
- Y-12 National Security Complex (managed by BWX, a member of the Battelle Energy Alliance)
- Method of attack: SQL injection
July 1:
- Battelle Memorial Institute
- Pacific Northwest National Laboratory (managed by Battelle)
- Thomas Jefferson National Accelerator Facility (managed by CSC via Jefferson Science Associates)
- Method of attack: un-specified but spokespersons referred to it as "sophisticated" and all three labs stopped email and internet services for several days.


In the meantime, today President Medvedev signed into law a decree establishing the priority areas and critical technologies of the Russian Federation:

Priority Areas:

1. Security and counter-terrorism
2. Nanotechnology
3. Information and Telecommunication Systems
4. Life Sciences
5. Advanced Weapons
6. Biotechnology
7. Transportation and Space Systems
8. Clean energy technology including nuclear power

List of Critical Technologies:

1. Basic and critical military and industrial technology for the development of advanced weapons, military and special equipment
2. Basic technologies of power electronics
3. Biocatalytic, biosynthetic and biosensor technology
4. Biomedical and veterinary technology
5. Genomic, proteomic and post-genome technologies
6. Cell technologies
7. Computer modeling of nanomaterials, nanodevices and nanotechnology
8. Nano-, bio-, information and cognitive technologies
9. Technology of nuclear energy, nuclear fuel cycle, safety of radioactive waste and spent nuclear fuel
10. Technology Bioengineering
11. Diagnostic technologies of nanomaterials and nanodevices
12. Access technology to broadband multimedia services
13. Information technology, control and navigation systems
14. Technology nanodevices and microsystems engineering
15. Technology of new and renewable sources of energy, including hydrogen energy
16. Technology acquisition and processing of structural nanomaterials
17. Technology acquisition and processing of functional nanomaterials
18. Technology and software and distributed high performance computing systems
19. Technologies for monitoring and forecasting of the environment, prevent and eliminate pollution
20. Search technology, exploration and development, mining
21. Technology in disaster situations - natural and manmade
22. Technologies to reduce losses caused by social diseases
23. Technology creating high-speed vehicles and intelligent control systems with new modes of transport
24. Technology of creation of space-rocket and transport equipment of new generation
25. Imaging technology electronic components and energy-efficient lighting devices
26. Technologies create energy efficient transportation, distribution and use of energy
27. Energy efficiency of production and conversion of energy to fossil fuels

The draft decree was sent out for approval to the State bodies on 20 May, 2011. It was signed into law on 07 July 2011. The above language is a machine translation from Russian to English.

My objective for this post is not to accuse the Russian government of being responsible for one or more of the breaches at the 5 national labs listed above, however when attribution is considered, the RF must be included in the group of state suspects. They provide extensive training to their security services in Information Security TTPs. They have a long history of conducting industrial espionage. And they have a critical need for some of the research that's being conducted at the targeted labs. That's not enough to "convict" anyone, but its certainly enough to make the Russian Federation and its Eastern European hacker crews "persons of interest".

Related Posts:
Three U.S. National Labs Attacked On July 1
The 2011 Russian Federation Information Security Reference

Add to Cart View detail

7 Reasons Why China Isn't The World's Biggest Cyber Threat (And Who Is)

When it comes to threats in cyberspace, conventional wisdom and expert commentary assign the number one slot to the country with the most failed operations. A failed operation is defined within the intelligence agencies of most countries as a compromised operation; i.e., one whose existence was discovered. It's important to note that the attribution of any specific country to any specific attack is an untrustworthy mix of art and science based upon IP address, who was victimized, technical evidence in the code, and what "feels right" to the person or team investigating. Based upon this formula, China has been ceded the top position as the number 1 cyber threat in the world.


Instead, I propose that you put aside the marketing hype, the questionable attribution methods, and the upside-down formula of # of failed ops = greatest threat and re-evaluate the cyber threat landscape through a more rational lens. To that end and in the hopes of stimulating some informed discussion on the topic, here are 7 reasons why the Russian Federation should replace the Peoples Republic of China as the world's most dangerous cyber adversary.

1. Russia is the only nation that has engaged in a military action with a cyber warfare component: The Russia-Georgia War of August, 2008.
2. Russia is the only nation that has engaged in a cyber attack which crippled components of an entire nation's critical infrastructure sporadically over a three week period: The Estonia Cyber Attacks 2007
3. Russia's Prime Minister formerly ran industrial espionage operations for the KGB and still considers such operations an asset to the country.
4. Russia has built a parallel military and civilian information warfare infrastructure that it actively uses against internal and external adversaries. For example, the Federal Security Service's 16th Directorate which is responsible for the interception, decryption, and processing of communications has been recently been identified as Military unit (VCH) 71330.
5. The Russian government funds organizations like the Nashi which engage in cyber attacks and other malicious acts.
6. Individuals closely aligned with the Russian government are prominent venture capitalists who invest in the world's largest social network companies and in U.S. technology startups as a self-funding open source intelligence operation.
7. Unlike China, Russian cyber operations are rarely discovered, which is the true measure of a successful op.

-------------
For full disclosure, my company provides this type of research to corporate clients so that they can better gauge their risk among the world's threat actors.

Add to Cart View detail