Chinese hackers allegedly breached telecommunications company Nortel in 2000 and these cyber-spies gained access to reams of sensitive technical documents, as well as internal communications and email, for nearly 10 years, according to a report in The Wall Street Journal.
The attackers, suspected of being based in China, breached the network using stolen credentials and installed spying software deep within the companys networking environment to gain access to all documents and communications, the Journal reported Feb. 14. The breach appears to date as far back as 2000, Brian Shields, the former senior advisor for systems security at Nortel who led the internal investigation, told the paper.
The attackers managed to steal log-in credentials for seven Nortel executives, including a former chief executive. Over the years, they downloaded technical papers, research and development reports, business plans, employee emails and other documents. It took investigators years to realize the pervasiveness of the problem.
The attackers had “access to everything,” Shields told the Journal. “They had plenty of time. All they had to do was figure out what they wanted.
U.S. government officials and company executives are increasingly worried about international corporate espionage. In January, reports surfaced about China-based hackers who breached Canadian law firms to intercept information related to a $40 billion acquisition of Potash Corp. of Saskatchewan by an Australian mining giant in 2010.
The Chinese government has long denied allegations of corporate cyber-espionage, claiming that the country was also a victim of cyber-attacks. Officials have used words such as “irresponsible” in response to these charges since no concrete evidence has been produced.
The Chinese Embassy told the Journal that these kinds of attacks are “transnational and anonymous.”
Even though the computers appeared to be transmitting data back to China, it is premature to accuse Chinese hackers, Graham Cluley, a senior technology consultant at Sophos, wrote on the Naked Security blog. It is just as likely that a computer in Shanghai was compromised by a remote hacker in another part of the world, Cluley said. These types of attacks are not limited to just the Chinese, as they can easily be based in Great Britain, Italy, South Africa and Canada, to name a few.
“It’s all too easy to point a finger, but it’s dangerous to keep doing so without proof,” Cluley wrote.
Nortel didn’t respond to requests for comment.
The breach was first discovered in 2004 when an employee noticed that a senior executive had downloaded an “unusual set of documents,” the Journal reported. When questioned, the executive denied downloading them. The internal investigators managed to trace the suspicious activity to China-based IP addresses.
Nortel’s network structure made it easy for the attackers to move around once the perimeter was breached because there were very few controls within the environment, according to Shields. Inside the network was “soft and gooey,” he said.
Security experts have long advocated deploying multiple layers of security so that if attackers manage to breach the network perimeter, there are other defenses in place to keep them out. Without additional layers, once an attacker is in, there’s nothing to stop them from accessing data, as Nortel discovered.
During the six-month investigation, Nortel did not try to determine whether the attackers had compromised any of its products. Nortel did “nothing from a security standpoint” other than resetting the passwords, according to the internal report reviewed by the Journal.
Shields saw signs the network was still compromised six months after the initial discovery because some of the computers were still sending data to the same Shanghai-based IP addresses. He suggested taking additional steps to secure the network but Nortel declined.
The day after leaving Nortel, Shields found out that a sophisticated form of spyware on two of the computers had been detected. The rootkit gave remote attackers full control over the infected computer and was not previously detected by the Nortel antivirus software. One of the computers had an encrypted communications channel with a computer near Beijing and another had a program installed that probed the network for other weaknesses to exploit.
It is not clear how the seven passwords were initially compromised, but it is possible the executives had been tricked by a phishing scam. These kinds of scams have been successful in the past, such as the one that tricked senior U.S. officials into clicking on links in messages, which resulted in their Gmail accounts being compromised last year.