“Book reveals how Chinese intelligence steals U.S. tech secrets to dominate world” by Bill Gertz
This article is contributed by desultory, who writes that
this is “a personal topic since my technology and that of people close to me
have been ripped off. Info has been scarce, now starting to surface.” Thank you
desultory.
~~~~~~~~~~~~~~~~~~~~~~~
‘Hey there, do you sell the ‘Poisonivy Program’? How much do
you sell it for? i wish to buy one which can not be detect and killed by the
Anti-Virus software.”
The email was sent to a Chinese cyber security company from
a military officer in a special part of China’s People’s Liberation Army
intelligence service, formally known as the Third Department of the General
Staff Department.
American intelligence officials know the spy service simply
as 3PLA, and it has been one of Communist China’s most successful tools for
stealing American military technology through cyber means. A second Chinese
military intelligence-gathering arm is called the Second Department of the
General Staff Department, or 2PLA. The Fourth Department, or 4PLA, conducts
both electronic spying and electronic warfare.
Together the PLA intelligence units have placed China at the
forefront of the most significant foreign intelligence threat to American
security. All three cooperate closely in stealing a broad array of secrets from
the United States. If the information is in digital form, the Chinese steal it.
PoisonIvy is well known in international hacker circles as
the favored software of the PLA. It is a remote access tool (RAT) and, while
not the most advanced software on the international hacker black market, would
turn out to be an extraordinarily effective cyber intelligence-gathering weapon
for 3PLA.
The reason PoisonIvy is so widely used is simple: All
computers and networks using Microsoft Windows operating systems are easy prey.
Once inside, the malware allows remote key logging, screen capturing, video
capturing, massive transfers of files, password theft, system administration
access, internet and data traffic relaying and more.
The email from the 3PLA officer seeking PoisonIvy
cyber-spying software had been intercepted by the National Security Agency and
would eventually lead to the arrest and conviction of a major Chinese cyber
espionage actor named Su Bin, aka Stephen Su. The case of Su Bin would reveal
for the first time the Chinese military’s relentless drive to steal American
weapons know-how from defense contractors such as Boeing to build up its forces
for the ultimate defeat of “American imperialism” — the term used by China in
many of its internal communications to describe the Communist Party of China’s
main enemy, the United States.
Military intelligence organizations are strategic players in
the Chinese goal of achieving information dominance — the first step in laying
waste to the main enemy in both peacetime and war and paving the way forward to
achieving global supremacy.
Defeatist policy
Until 2016 and the advent of the Trump presidency, details
about Chinese cyberattacks and the organizations behind them were tightly held
secrets. Successive U.S. administrations since the 1990s sought to cover up and
hide nefarious Chinese intelligence activities as part of rigid policies
designed to appease Beijing.
It was through such feckless, defeatist policies that the
United States theorized that conciliation and engagement would lead the Party
rulers and their military henchmen away from communism and toward democracy and
free markets. Instead, a hated Communist Party regime was not only perpetuated
but strengthened at the expense of America’s most precious intellectual
resources.
In spring 2018, the Trump administration took an
unprecedented step and, for the first time, exposed the activities of one of
China’s most important spymasters, PLA Major General Liu Xiaobei. Gen. Liu for
many years headed 3PLA.
In late 2015, 3PLA was subsumed into a service-level
military organization known as the Strategic Support Force and became the main
component of a new unit called the Cyber Corps. The Cyber Corps is one of the
PLA’s most secret units and is staffed by as many as 100,000 hackers, language
specialists and analysts at its headquarters in the Haidian District of
Beijing. Branch units are located in Shanghai, Qingdao, Sanya, Chengdu and
Guangzhou.
Beginning in the 1990s, the Chinese used large-scale
cyberattacks in support of a larger industrial policy of building up the
country’s science and technology business and military sector. 3PLA is China’s
most aggressive technology collector by far, with at least 19 confirmed and
nine possible cyber units under its command. The CIA identified Gen. Liu in a
2014 report as an encryption specialist and director of the Technical
Reconnaissance Bureau, another term for 3PLA.
The general appeared in a 2013 PLA propaganda video called
“Silent Contest,” which described the United States as the main target of
Chinese cyberattacks, based on the country being the birthplace of the internet
and having the ability to control its core resources.
A U.S. Trade Representative (USTR) report on Chinese
technology theft provided some of the first clear evidence of the massive
damage caused by cyber-economic spying attacks. Chinese unfair trade practices
and Beijing’s intellectual property theft, according to the report, cost
Americans a staggering $225 billion to $600 billion annually in lost
information.
The Su Bin case
The case of Su Bin provides one of the clearest examples of
how that theft occurs. Mr. Su was the owner of a company based in China and
Canada called Beijing Lode Technology Company Ltd., an aviation and space
technology supply firm with clients in China and around the world, including
the United States.
The email dated July 23, 2008, from the PLA officer marked
the beginning of a series of events that ultimately led the U.S. government to
expose part of China’s hugely successful campaign of cyber theft operations —
the most massive transfer of American wealth through cyberattacks in U.S.
history.
That technology theft ranged from extremely valuable
government information to the pillaging of proprietary electronic data on some
of the most strategic weapons systems — all obtained covertly from the small
group of American defense contractors, including Boeing and Lockheed, who built
and maintained cutting-edge aircraft, warships and other military hardware that
made the United States the most powerful nation on earth. China significantly
undermined the United States’ standing as the world’s premier military power by
funneling this stolen military intelligence into the PLA for use in its massive
arms modernization program.
On October 24, 2009, a day after receiving a contract, Mr.
Su returned the signed document in an email to the 3PLA officer. Over the next
five months Mr. Su and the two PLA officers directed a team of hackers
operating in China, who began targeting specific employees with access to
computer networks at the Boeing C-17 assembly plant in Long Beach, California.
The Chinese used emails with fraudulent email sender
addresses that were carefully crafted to masquerade as someone known to the
recipient. The objective was to have the person click on an innocuous computer
link that would automatically download malicious Chinese hacking software. The
practice is called “spear phishing,” or just phishing, and is a tactic mastered
by the Chinese.
Sometime between December 2009 and January 2010, the Chinese
hacking operation hit pay dirt. Mr. Su was able to gather details of several
Boeing executives, and within a few months the hackers had stolen 85,000 files
on the C-17 aircraft from Boeing.
An intercepted email to higher-ups in the PLA outlined the
operations in detail. It outlined the successful exfiltration of C-17 secrets
between two other PLA officers and one other member of the hacking team —
probably a civilian hacker working as a contractor. The report expressed the
elation the hackers experienced from stealing the crown jewels of a development
project that had cost American taxpayers around $40 billion to develop from the
1980s to the 1990s. Ultimately, 280 C-17 aircraft were built at an average cost
of $202 million apiece.
Extraordinary coup
For the Chinese, the operation to steal the vital secrets
was an intelligence coup of extraordinary magnitude. Not only did Chinese
aircraft manufacturers save billions of dollars in development costs, but those
companies quickly incorporated the secrets in a new PLA transport, Y-20, that
cost a mere 2.7 million RMB, or $393,201.98 for the entire cyber-spying
operation.
The PLA summary of the operation read in part:
“… Thorough planning, meticulous preparations, seizing
opportunity, [we] initiated all human and material preparations for the
reconnaissance in the beginning of 2009. After a few months’ hard work and
untiring efforts, through internal coordination [we] for the first time broke
through the internal network of the Boeing Company in January of 2010.
Currently, we have discovered in its internal network 18 domains and about
10,000 machines.
“From breaking into its internal network to obtaining
intelligence, we repeatedly skipped around in its internal network to make it
harder to detect reconnaissance, and we also skipped around at suitable times
in countries outside the U.S. In the process of skipping, we were supported by
a prodigious quantity of tools, routes, and servers, which also ensured the
smooth landing of intelligence data.
“… We made appropriate investment and reaped enormous
achievement. Through our reconnaissance on the C-17 strategic transport
aircraft, we obtained files amounting to 65G [gigabytes]. Of these, there were
630,000 files and 85,000 file folders, containing the scans of C-17 strategic
transport aircraft drawings, revisions, and group signatures, etc. The drawings
include the aircraft front, middle, and back; wings; horizontal stabilizer;
rudder; and engine pylon. The contents include assembly drawings, parts and
spare parts. Some of the drawings contain measurement and allowance, as well as
details of different pipelines, electric cable wiring, and equipment
installation.
“Additionally, there were flight tests documents. This set
of documents contains detailed contents, and the file system is clear and
detailed, considered top-flight drawings by experts! This project took one year
and 2.7 million RMB to execute, showing cost effectiveness and enormous
achievement. This reconnaissance job, because of the sufficient preparations,
meticulous planning, has accrued rich experience for our work in future. We are
confident and able … to complete new mission.”
The PLA report was made public in court documents from the
Su Bin case after his arrest — five years after the PLA stole Boeing’s secrets.
Less than a decade after the Boeing C-17 data heist, the
Chinese were busy showing off their version of the aircraft, the Xian Y-20
heavy transport, a jet that not surprisingly looked almost identical to the
C-17 when it was showcased in November 2018 at the Zhuhai International Air
Show. Chinese propaganda outlets bragged that the Y-20 “made China the third
country after Russia and the US to design and develop its own heavy military
transport aircraft.” The first prototypes were built in 2013 — three years
after the Boeing hack.
Michelle Van Cleave, a former high-ranking US counterintelligence
official within the Office of the Director of National Intelligence, said the
Su prosecution was a success. But the case did little to stem the torrent of
secrets flowing out of American computer networks and represented but “a drop
in a bucket that keeps getting bigger every year.”
“The Chinese have a sophisticated network of tens of
thousands of human spies and computer hackers targeting American military and
technological secrets,” Ms. Van Cleave said. “What they can’t acquire legally
through trade, or creatively through mergers and acquisitions, they are
prepared to steal. And it’s getting harder all the time to stop them.”
Comments
Post a Comment