Hackers Turned Defense Contractor QinetiQ Into Intelligence Playground

For more than three years, hackers linked to China thoroughly compromised U.K.-based QinetiQ, a firm that bills itself as "a world leading defense technology and security company," to steal intellectual property and sensitive defense information, according to reports of the incident.
The long-running breach resulted in numerous visits from federal investigators from December 2007 until late 2010, according to Bloomberg News, which first reported the massive compromise. The incident, spelled out in emails leaked from security firm HBGary in 2011, resulted in large swaths of data on sensitive technologies--such as drones and military helicopters—getting transmitted overseas. "The scary part of this particular type of intrusion is you are no longer talking about business interests and intellectual property, but about national security, and that raises the stakes quite a bit," said Alex Cox, principal research analyst for RSA's FirstWatch incident response group. The report is the latest evidence linking compromises at defense and critical-infrastructure companies to a Chinese group known as the "Comment Crew." In February, incident response firm Mandiant released a report identifying the group as the source of more than 140 incidents of espionage investigated by the firm since 2006. The group is a part of the People's Liberation Army known as Unit 61398, Mandiant said.

The widespread attacks on sensitive corporate and government organizations had top U.S. cyber-officials ranking the threat above terrorism, in terms the threat posed to U.S. interests. In March, the director of National Intelligence and the head of the U.S. Cyber Command both warned of the danger of the ongoing espionage.
In the recently reported incident, QinetiQ suffered a number of attacks over three years. A July 2010 report, leaked from security firm HBGary by hacktivists linked to Anonymous, discussed two of the attacks that resulted in the compromise of at least 71 systems—about 3.5 percent of systems investigated. Among the tools used by the hackers to control compromised systems was a remote access Trojan (RAT) known as "lprinp.dll," the report stated. "It is a well known and used variety of malware that is customized and built from source code (that is, not an attack toolkit/generator)," the report stated. "HBGary believes this malware strain to be tightly coupled to a Chinese hacking group that targets the DoD and its contractors. HBGary has code-named this threat group as 'Soysauce.' This group is also known as 'Comment Crew' by some." The chain of compromises of QinetiQ’s network stretched back to December 2007, when the Naval Criminal Investigative Service contacted the company and notified them that two of their employees had lost information to hackers, according to the Bloomberg article. Over the next three year, the company called in a succession of security contractors but limited their investigations and failed to take adequate steps to stop the attacks, the report stated

U.S. Aims to Force Web Services to Compromise Message Encryption

Frustrated that email and social network users can encrypt their messages, law-enforcement agencies want the feds to enact punitive measures to force cooperation.

Even if it accomplished nothing else, the Middle Eastern governments’ crackdowns on communications during the Arab Spring movement two years ago demonstrated how much governments, in general, and repressive governments, in particular, hate encryption—particularly in the hands of private citizens. This is why governments from Egypt to Oman to India have tried to ban BlackBerry smartphones with their uncrackable encryption. Now, in the United States, the Federal Bureau of Investigation and the military and intelligence agencies are going after your encrypted communications on Google, Facebook and other Web communication services. Google, as you’ll likely recall, was hacked by the Chinese military who tried to get into the email accounts of dissidents who use Gmail for communicating their pro-freedom activities. The Chinese, a repressive regime if there ever was one, just hates dissidents. So the military hackers wanted to read their email to find out who they were and what they were up to. Google responded by encrypting its network from end to end. Facebook, after being attacked repeatedly, has done the same thing. Other networks that pride themselves on their security are also providing encrypted communications, including BlackBerry, which is widely used by the U.S. government precisely for this reason.
Of course those other repressive governments never actually banned BlackBerry devices because their own intelligence agencies also use them and needed the security more than they needed to read other people’s email.

So now we come to the FBI and other U.S. law-enforcement agencies that are trying to read the text messages, chats and the email of people they think are bad guys. The feds say that they’re doing this to fight crime and terrorism. And they say they have a right to get information if they have a legally obtained wiretap order. The problem is, as The Washington Post reported recently, that not all providers of communications services have the ability to comply with a federal wiretap order. Their systems are secure and they’re meant to stay that way. What the FBI is asking for is the ability to fine those companies that don’t comply with a wiretap order, even if they’re technically unable to do so within a time limit set by the FBI. In other words, if you can’t provide the feds with a back door to your system, the government will keep piling on fines until you go out of business. The idea, of course, is to compel companies that provide secure communications to also build in a means for the feds carry out get their wiretaps.