community weblog - [ January 8, 2008 ]

Readers will gain background from:

It is helpful to place China Cyber Army within the context of rising state on state cyber ops. The third annual VIRTUAL CRIMINOLOGY REPORT, CYBERCRIME: THE NEXT WAVE, points out three trends for 2008 and beyond:

The states most at risk as cybertargets "are those countries which are heavily networked and reliant on the Internet as well as those countries with an unstable political environment."

The Chinese have publicly stated that they are pursuing activities in cyber-espionage and government white paper, as read by McAfee Avert Labs, they speak of technology being a large part of war in the future. The United States, United Kingdom, Germany and several other countries are likely targets for political, military, economic and technical espionage.

And other nations may have similar plans to conduct online spying operations.

"There are signs that intelligence agencies around the world are constantly probing other governments’ networks looking for strengths and weaknesses and developing new ways to gather intelligence," said Peter Sommer, an expert in information systems and innovation at the London School of Economics.

"Everybody is hacking everybody," said Johannes Ullrich, an expert with the SANS Technology Institute, pointing to Israeli hacks against the United States and French hacks against European Union partners. But it is aspects of the Chinese approach that worry him. "The part I am most afraid of is...staging probes inside key industries. It’s almost like having sleeper cells, having ways to disrupt systems when you need it if it ever came to war."

And with an estimated 120 countries working on their cyberattack commands, in 10-20 years experts believe we could see countries jostling for cyber supremacy."

Sommer warns that countries are undoubtedly gearing themselves up to launch international all-out online attacks. The present political environment is one in which countries are testing the waters to gauge the potential influence (and risks) of such assaults...

"The Chinese were first to use cyberattacks for political and military goals," said James Mulvenon, an expert on China’s military and director of the Center for Intelligence and Research in Washington. "Whether it is a battlefield preparation or hacking networks connected to the German chancellor they are the first state actor to jump feet first into the 21st century cyber warfare technology. This is becoming a more serious and open problem."

High-tech crime is no longer just a threat to industry and individuals...

China Cyber Army architecture and operation

China Cyber Army describes eight discrete operating groups placed in Beijing/TienJing, SiAnn, ShangHai, SiChuan, HuBei, JianSu, FuJian,and GuoDong. As Jun is the word for military troop, an individual group would be known as, say, HuBei Jun. (Unlike official state responses which have been reticent to name Chinese state assets as perpetrator, China Cyber Army pointedly labels China as the relevant actor.) The purpose of the groups is said to be commercial and military espionage as opposed botnet herding or site defacement. No surprise that "Motivation" is said to be "Political Control, Military Operation, and High Tech intelligent properties." Group membership is said to be drawn from university, military, criminal sources and what I would describe as global for-hire hackers, notably from Taiwan.

Hacker group roles are delineated as:

These hacker groups demonstrate intense organization. A rigorous summer operating schedule of two shifts is described for this cyber army: Start work at 0750 GMT+8, primarily entry hacking and launching data collect commands; lunch at 1200 GMT+8; recover data from the morning effort; break at 1700 GMT+8; first shift ends at 1900 GMT+8 and is replaced by second shift. Attacks are said to be "everyday" which may be interpreted as a seven day week. Encryption keys are "arranged by area," group members employ "the same tool not common seen in the public internet," Chinese military signatures are seen in the tools and extensive use is made of language experts and machine translation.

Prime human targets are in government, defense, military, foreign affairs, media plus any site containing potentially sensitive information. Data target comprise the usual suspects: contact lists, mailbox contents, databases, passwords and keys, MS Office files, Acrobat PDFs, images and internal system settings. Once this data is gathered, relationship databases are constructed, key personnel are identified to receive email Trojans and phishing attacks, malware is inserted at key points, ID-passwords and keys are examined for subsequent targeting, while potentially useful data is routed to language analyzers (machine translation).

Direct reverse Connect

Hacker to Way Station Relay Program:

(1) Hacker change the DN
(2) Remote Control the WS through 3389 (TS) or other back door
(3) Open the backdoor controller on WS for victim on 80,53,443,1863

Way Station Relay Program to Victim:

(1) Backdoor on victim, Query the Domain Names or IP
(2) Connect to the way station through normal Ports like 80,53,443,1863 etc.

Relay Connect

Hacker to Way Station Relay Program:

(1) Hacker change the DN mapping to Way-Station
(2) Start the Relay Program on WS
(3) Open the backdoor controller on Hacker’s PC listening

Way Station Relay Program to Victim:

(1) Backdoor on victim, Query the Domain Names or IP
(2) Connect to the way station through normal Ports like 80,53,443,1863 etc.

Switching Connect

Hacker to Way Station Relay Program:

(1) Hacker change the DN mapping to Way-Station
(2) Start the Switching Program on WS
(3) Start the backdoor controller & Connect to WS
(4) Pick the Victim Connection , build a tunnel * Not all the flow will pass to hacker

Way Station Relay Program to Victim:

(1) Backdoor on victim, Query the Domain Names or IP
(2) Connect to the way station through normal Ports like 80,53,443,1863 etc.
(3) Waiting For Select!

Great efforts are taken to prevent discovery and shield attack source: multiple Way Stations, "Leveling" steps involving checking importance of victims and inserting new backdoors, dynamic domain name shifting, and parallel channels for downloads.

An "independent defense analyst," Cheng Ta-chen, was quoted in translation from Taipei Times regarding China's "cyber army":

A state of war, or peace, is merely a cost benefit analysis:

Economic and military threads are warp and weft of the same cloth, yet too many continue to believe the fallacy that nations that trade together do not war with one another. The reality is that they trade so long as their national cost-benefit analysis tells them to continue doing so. Tipping points exist. The key is to recognize their immergence and be prepared to prosecute them. Short of that, business must address the uncertainties as their governments jostle for advantage.

The content of China Cyber Army is as interesting as its provenance is obscured. The anonymous poster used the name DeepThroat. The poster's join date to Slideshare was October 2007 and has only shared this one slideshow. I'd conclude that this alias came up with the express purpose of posting the cyber set. There are no introductory or closing foils (pages). The foils are atypically clean, i.e., they are not burdened by the typically overwrought graphics that the feds and the military employ.

Many of the foils have rather dodgy spellings and word constructions that are not bad enough, or consistent enough, to be a machine translation but appear to be the hand of a non-native English speaker. (Certain word constructs are tantalizing and cry out for clarification.) The "Asian fan" is the background is not something that an Occidental would generally use, but when I have seen a fan the subject is Japan rather than China. There is a nice touch in having a slide transcript as footer to the foils.

We found it interesting that DeepThroat used a "no download, view only" PPT format as the release mechanism instead of a PDF posted to one of many widely read security forums. As we thought the material of value and were uncertain how long the PPT would remain active, a full screen capture was made of each foil as individual jpg files, rolled into a PDF for better examination and portability, and then posted under a fair use guideline as China Cyber - Fair Use.

World faces "cyber cold war" threat
By Peter Griffiths
Reuters
Nov 29, 2007 8:37am EST
Mirror

Cyber war to escalate in 2008
120 countries developing ways to attack computer networks
Andrea-Marie Vassou
Computeractive/vnenet
29 Nov 2007

Nations must defend against cyber warfare
Problem is getting worse as technology improves methods of attack
Tom Young
Computing/vnunet
29 Nov 2007

VIRTUAL CRIMINOLOGY REPORT
CYBERCRIME: THE NEXT WAVE
By Ian Brown, Oxford Internet Institute; Lilian Edwards, Institute for Law and the Web (UK); Eugene Spafford et al from CERIAS center at Purdue University (US)
The annual McAfee global cyber trends study into organized crime and the Internet in collaboration with leading international security experts
Commissioned by McAfee
2007