Cyberwar, Deeper Truth on China’s Unit 61398

The NSA has been hacking China for years, so it is a cyberwar. What the United States cyber experts have known at least since 2009 spells out that there has been no strategy to combat cyber intrusions much less a declaration that these hacks are an act of war.

The NSA Has A Secret Group Called ‘TAO’ That’s Been Hacking China For 15 Years

China hacking charges: the Chinese army’s Unit 61398
Operating out of a tower block in Shanghai, Unit 61398 allegedly hacks Western companies in support of the Chinese government’s political and economic aims.

From DarkReading:

According to the DOJ indictment, Huang Zhenyu was hired between 2006 and 2009 or later to do programming work for one of the companies (referred to as “SOE-2” in the indictment). Huang was allegedly tasked with constructing a “secret” database to store intelligence about the iron and steel industry, as well as information about US companies.

“Chinese firms hired the same PLA Unit where the defendants worked to provide information technology services,” according to the indictment, which the US Department of Justice unsealed Monday. “For example, one SOE involved in trade litigation against some of the American victims herein hired the Unit, and one of the co-conspirators charged herein, to hold a ‘secret’ database to hold corporate ‘intelligence.'”

The for-hire database project sheds some light on the operations of China’s most prolific hacking unit, Unit 61398 of the Third Department of China’s People’s Liberation Army (also known as APT1), where the alleged hackers work. US Attorney General Eric Holder announced an unprecedented move Monday: The Justice Department had indicted the five men with the military unit for allegedly hacking and stealing trade secrets of major American steel, solar energy, and other manufacturing companies, including Alcoa, Allegheny Technologies Inc., SolarWorld AG, Westinghouse Electric, and US Steel, as well as the United Steel Workers Union.

It has never been a secret, it has only been a topic debated with no resolutions behind closed doors. China has a database on Americans and is filling it with higher details, growing their intelligence on everything America.

China has launched a strategic plan when one examines the order of hacks of American companies, the timing and the data. A full report was published on Unit 61398.

New York Times report

Hacked in the U.S.A.: China’s Not-So-Hidden Infiltration Op

From Bloomberg: The vast cyber-attack in Washington began with, of all things, travel reservations.

More than two years ago, troves of personal data were stolen from U.S. travel companies. Hackers subsequently made off with health records at big insurance companies and infiltrated federal computers where they stole personnel records on 21.5 million people — in what apparently is the largest such theft of U.S. government records in history.

Those individual attacks, once believed to be unconnected, now appear to be part of a coordinated campaign by Chinese hackers to collect sensitive details on key people that went on far longer — and burrowed far deeper — than initially thought.

 

But time and again, U.S. authorities missed clues connecting one incident to the next. Interviews with federal investigators and cybersecurity experts paint a troubling portrait of what many are calling a serious failure of U.S. intelligence agencies to spot the pattern or warn potential victims. Moreover, the problems in Washington add new urgency to calls for vigilance in the private sector.

In revealing the scope of stolen government data on Thursday, Obama administration officials declined to identify a perpetrator. Investigators say the Chinese government was almost certainly behind the effort, an allegation China has vehemently denied.

‘Facebook of Intelligence’

Some investigators suspect the attacks were part of a sweeping campaign to create a database on Americans that could be used to obtain commercial and government secrets.

“China is building the Facebook of human intelligence capabilities,” said Adam Meyers, vice president of intelligence for cybersecurity company CrowdStrike Inc. “This appears to be a real maturity in the way they are using cyber to enable broader intelligence goals.”

The most serious breach of records occurred at the U.S. Office of Personnel Management, where records for every person given a government background check for the past 15 years may have been compromised. The head of the government personnel office, Katherine Archuleta, resigned Friday as lawmakers demanded to know what went wrong.

The campaign began in early 2013 with the travel records, said Laura Galante, manager of threat intelligence for FireEye Inc., a private security company that has been investigating the cyber-attacks.

Stockpiling Records

By mid-2014, it became clear that the hackers were stockpiling health records, Social Security numbers and other personal information on Americans -– a departure from the country’s traditional espionage operations focusing on the theft of military and civilian technology.

“There was a clear and apparent shift,” said Jordan Berry, an analyst at FireEye.

Recognition came too late for many of the victims. Vendors of security devices say health-care companies are spending tens of millions of dollars this year to upgrade their computer systems but much of the data is already gone.

U.S. intelligence agencies were collecting information on the theft of personal data but failed to understand the scope and potential damage from the aggressive Chinese operation, according to one person familiar with the government assessment of what went wrong.

In the last two years, much of the attention of U.S. national security agencies was focused on defending against cyber-attacks aimed at disrupting critical infrastructure like power grids.

 

The Size and Scope of Anonymous, Hacktivists

Now that we are beginning to understand how big the hacker network is, what is the real agenda and mission of those inside the group? One cannot estimate yet it appears to have many variances. Anonymous does get involved in policy issues and members and or sympathizers participate.

Anonymous marchers
Masked Anonymous supporters march away from the U.S. Capitol during a 2013 demonstration. Reuters/Jim Bourg
  • Anonymous holding baby
    A woman wearing an Anonymous mask holds up a baby during a Brazil demonstration in 2013. Reuters/Nacho Doce

 

 

There is a documentary on ‘We Are Legion’,

How big is Anonymous? Maybe bigger than you thought

By: CS Monitor An analysis from a University of Copenhagen graduate student suggests the online-phenomenon-turned-protest movement is more globally connected on the Web than previously thought.

  • close
    Protesters wearing Guy Fawkes masks held signs that read “Anonymous is here for our countrymen” during an April rally against a political corruption in Guatemala City.
     

The actual size and reach of the shadowy hacktivist collective Anonymous has long been the fodder of online squabbles. It’s diminished by detractors and puffed up by ardent devotees.

So, a University of Copenhagen graduate student set out to determine the actual extent of Anonymous’ influence around the world. And, it turns out that Anonymous appears to have a wider scope and is more international than previously imagined.

Even academics who study Anonymous were surprised. “The Anonymous network is larger than many of us thought,” said Gabriella Coleman, an anthropology professor at McGill University and author of “Hacker, Hoaxer, Whistleblower, Spy: The Many Faces of Anonymous.”

Recommended: Revealing Anonymous and its web of contradictions

The analysis looks at Facebook pages connected with Anonymous to gain insight into its international prowess. Yevgeniy Golovchenko, a graduate student in the school’s sociology department, examined 2,770 Anonymous Facebook pages that generated a collective 22.2 million “likes.” This is just the “absolute minimal size” of the entire global Anonymous network, Mr. Golovchenko explained in an interview.

The point of the study was to “show the enormity and connectivity of the Anonymous movement at a global level,” he said. The end result revealed a network greater than he expected. It was even “a lot bigger than my Anon informants thought it would be,” said Golovchenko.

Professor Coleman, considered the leading expert on Anonymous, says the data reveals “a parallel world, or really worlds, that live on Facebook” instead of other social media sites such as Twitter and Internet Relay Chat services.

It is far more likely there are more Anonymous Facebook pages than the ones in Golovchenko’s study. Facebook pages belonging to Anonymous included in his analysis had to meet at least one of the following criteria: Pages directly identified as Anonymous (“we are Anonymous”), shared or organized “operations,” or used Anonymous symbols beyond the Guy Fawkes mask.

“The [Anonymous’ network is also dynamic,” he noted, since when “some pages die out, others are born.” The average Anonymous page was connected to 18 other Anonymous pages. Golovchenko used Facebook “likes” as a way to establish connections, because a “like” acts as an “acknowledgement,” and shows the admin of one page is aware of another Anonymous contingent, in most cases in a different country. The “Offiziell Anonymous Page” had the most connections with 517 likes. It should be noted that “Offiziell Anonymous Page” hasn’t updated since December 2014.

Golovchenko was drawn to Anonymous’ Facebook pages given these pages are a public and easily accessible aspect of the relatively secretive hacktivist collective. These Facebook pages exist to either share information, or promote and help organize projects, and if they were harder to access, they’d alienate the average person.

Looking at all this Facebook data reveals several patterns. The position of the “node groupings was done by an algorithm, but it magically describes the realities of where people live in the world, to some extent,” said Golovchenko. An example of this are the German Anonymous Facebook pages, like the Anonymous Deutschland node, which are shown as blue dots:

German Anonymous Facebook pages. Yevgeniy Golovchenko

Another example of this regional breakdown is the Anonymous Unified Korea node, which is primarily focused in West Asia, except for that one supportive Belgian Facebook page:

Anonymous Unified Korea node, which is primarily focused in West Asia, except for one supportive Belgian Facebook page. Yevgeniy Golovchenko

Looking at the Anonymous Angola node reveals an even smaller network comprised of only a few African countries with the exception being Brazil (see below). Anonymous Hacker Brazil has a much larger international network.

Through this visualization, it is easy to identify allies of certain sects, or regional Anonymous crews. For example, quite a few Brazilian Anonymous pages are connected to Anonymous in Iceland, of all countries. The Occupy Brazil node is connected to various Anonymous Facebook pages in Canada, which could explain why so much traffic during a recent operation against Canadian government websites came from Brazil.

Yevgeniy Golovchenko

All these networks within networks reveal an incredibly complicated communication stratus. “Even if only one-third of the likes represent actual Facebook users,” noted Golovchenko, “the network is surprisingly immense … . Only few mainstream media can match the movement’s enormous internet infrastructure.”

United Nations New Order of the Globe Influenced by BRICS

BRICS is a group of nations that include Brazil, Russia, India, China and South Africa. BRICS is taking control of global insecurity and the charge is actually led by Russia.

BRICS has their own financial security system and at all costs will protect and enhance their money power worldwide. The president of Brazil was in the White House this past week where several discussions took place and more than likely Barack Obama was opening the pathway for the United States to cooperate with BRICS and abdicating power to BRICS and the United Nations.

Russian President Vladimir Putin has met with the leaders of emerging powers in the Russian city of Ufa for a summit widely seen as an attempt by Moscow to show it is not isolated despite its standoff with the West over the conflict in Ukraine.
The leaders of the BRICS countries — Brazil, Russia, India, China, and South Africa — adopted a declaration expressing “deep concern” about the deadly conflict in eastern Ukraine pitting government forces against pro-Russian separatists. 
The document called on both sides to abide by a cease-fire signed in February by Ukraine, Russia, the rebels, and the Organization for Security and Cooperation in Europe (OSCE).
Ukraine and the West, however, have accused Moscow of continued support for the separatist fighters.

Russian President Vladimir Putin (right) meets with his Iranian counterpart, Hassan Rohani, during a meeting on the sidelines of the BRICS Summit in Ufa, Russia, on July 9.
The Iranian nuclear issue was also on the agenda of the summit, which takes place as negotiators from Iran, Britain, China, France, Germany, Russia, and the United States are working in Vienna to strike a deal to curb Tehran’s controversial nuclear program in exchange for sanctions relief.
BRICS nations voiced confidence that the Vienna talks will result in a deal.

Enter the United Nations Security Council and Ban Ki-moon

UN Security Council

Ban Ki-moon to Welcome BRICS’ Intention to Reform UN Security Council

UN Under-Secretary-General for Political Affairs Jeffrey Feltman said that UN Secretary-General Ban Ki-moon himself talked about the need for reform of the Security Council and he supports strong intention of BRICS countries to reform the UN Security Council.

UFA (Sputnik), Anastasia Levchenko — The UN chief will support the BRICS initiative to reform the UN Security Council, UN Under-Secretary-General for Political Affairs Jeffrey Feltman told Sputnik on Thursday, adding the BRICS format could prove effective when addressing international issues.

He said UN Secretary-General Ban Ki-moon will welcome the strong intention of BRICS countries to reform the UN Security Council in order to make it more representative for states with growing political and economic influence.

“The Secretary-General himself has talked about the need for reform of the Security Council, the need for the institutions to evolve and reflect the world as it is today. I know that Secretary-General will be very supportive of member states addressing seriously the question of the Security Council reform,” Feltman said, commenting on the BRICS states’ intention to reform the UNSC.

However, it “will be up to the member states themselves to decide what is the best approach for reforming Security Council,” he emphasized.

The UN Security Council consists of five permanent members with veto power – China, Russia, France, Russia, Britain, and the United States – and ten non-permanent members, elected by the General Assembly for a two-year term.

Russia and China are also part of the BRICS club of developing countries, along with Brazil, India, and South Africa. The nations are meeting in the Russian city of Ufa to step up integration and arrange financial assistance to projects in member countries, as well as in other emerging markets.

Feltman admitted that BRICS countries have great political weight, but they or any other group of countries cannot be considered as an alternative to the UN Security Council.

“BRICS represent a very important set of countries, and there are many examples where BRICS format can be useful for international developments, peace and security etc. I think we all recognize the strength of the BRICS format, strength of BRICS grouping. But I think it is hard for any other organization or group of states to replicate the Security Council,” Feltman told Sputnik.

Earlier in the day, BRICS said in its declaration that it had a flexible format, allowing it to address a much wider range of international issues than the UN Security Council. The document also addressed a range of issues that undermine global stability, including dealing with the root cause of recent hike in illegal migration and preventing foreign military interventions.

 

 

 

The Words in General Dempsey’s Swan Song

Si Vis pacem, para bellum

GW Bush said it was going to be a long war when the top enemy was al Qaeda. Defeat was realized until the rules of engagement and strategy were altered dynamically month by month beginning in 2009.

There is Russia and Ukraine as noted by the Institute for the Study of War.

Then there is the Baltic Balance as summarized by the Rand Corporation.

There is Islamic State throughout the Middle East region where the caliphate is beyond incubation.

An outcome of the Iran P5+1 talk on the nuclear program is eminent and that could spell an armed conflict that includes Saudi Arabia and or Israel.

The forgotten region is the South China Sea.

Dempsey’s Final Instruction to the Pentagon, Prepare for a Long War

By: Marcus Weisgerber

Non-state actors, like ISIS, are among the Pentagon’s top concerns, but so are hybrid wars in which nations like Russia support militia forces fighting on their behalf in Eastern Ukraine threaten national security interests, Dempsey writes.

“Hybrid conflicts also may be comprised of state and non-state actors working together toward shared objectives, employing a wide range of weapons such as we have witnessed in eastern Ukraine,” Dempsey writes. “Hybrid conflicts serve to increase ambiguity, complicate decision-making, and slow the coordination of effective responses. Due to these advantages to the aggressor, it is likely that this form of conflict will persist well into the future.”

Dempsey also warns that the “probability of U.S. involvement in interstate war with a major power is … low but growing.”

“We must be able to rapidly adapt to new threats while maintaining comparative advantage over traditional ones. Success will increasingly depend on how well our military instrument can support the other instruments of power and enable our network of allies and partners,” Dempsey writes.

The strategy also calls for greater agility, innovation and integration among military forces.

“[T]he 2015 strategy recognizes that success will increasingly depend on how well our military instrument supports the other instruments of national power and how it enables our network of allies and partners,” Dempsey said Wednesday.

The military will continue its pivot to the Pacific, Dempsey writes, but its presence in Europe, the Middle East, Latin America and Africa will evolve. The military must remain “globally engaged to shape the security environment,” he said Wednesday.

The Russian campaign in Ukraine has military strategists questioning if traditional U.S. military force as it is deployed globally is still — or enough of — a deterrence to hybrid and non-state threats like today’s terrorism. “If deterrence fails, at any given time, our military will be capable of defeating a regional adversary in a large-scale, multi-phased campaign while denying the objectives of – or imposing unacceptable costs on – another aggressor in a different region,” Dempsey writes.

The chairman also criticizes Beijing’s “aggressive land reclamation efforts” in the South China Sea where it is building military bases in on disputed islands. In the same region, on North Korea, “In time, they will threaten the U.S. homeland,” Dempsey writes, and mentions Pyongyang’s alleged hack of Sony’s computer network.

Dempsey scolds Iran, which is in the midst of negotiating a deal with Washington to limit its nuclear program, for being a “state-sponsor of terrorism that has undermined stability in many nations, including Israel, Lebanon, Iraq, Syria, and Yemen.”

Russia, Iran, North Korea and China, Dempsey writes, are not “believed to be seeking direct military conflict with the United States or our allies,” but the U.S. military needs to be prepared.

“Nonetheless, they each pose serious security concerns which the international community is working to collectively address by way of common policies, shared messages, and coordinated action,” Dempsey said.

Prepare for a long war. General Dempsey is retiring as Chairman of the Joint Chiefs and will likely move on to academia. Meanwhile, on July 9, the Senate Armed Services will hold a confirmation hearing for General Joseph Dunford.

As General Dempsey is making his farewell rounds, his words speak to some liberation in saying what needs to be said in his swan song.

In a new National Military Strategy, the chairman of the Joint Chiefs of Staff warns the Pentagon to reorganize its global footprint to combat prolonged battles of terrorism and proxy wars.

The U.S. military needs to reorganize itself and prepare for war that has no end in sight with militant groups like the Islamic State and nations that use proxies to fight on their behalf, America’s top general warned Wednesday.

In what is likely his last significant strategy direction before retiring this summer, Gen. Martin Dempsey, chairman of the Joint Chiefs of Staff, said at the Pentagon that “global disorder has trended upward while some of our comparative advantages have begun to erode,” since 2011, the last update to the National Military Strategy.

“We are more likely to face prolonged campaigns than conflicts that are resolved quickly… that control of escalation is becoming more difficult and more important… and that as a hedge against unpredictability with reduced resources, we may have to adjust our global posture,” Dempsey writes in the new military strategy.

Dempsey, the president’s senior military advisor, criticizes Russia, Iran, North Korea and China for aggressive military actions and warns that the rapidly changing global security environment might force the U.S. military to reorganize as it prepares for a busy future.

The military has been shrinking since 2012, when the Obama administration announced plans to pivot forces to the Asia-Pacific region as troops withdrew from Afghanistan and Iraq. But since then, Obama slowed the Afghanistan withdrawal as fighting continues there, and thousands of American military forces have found themselves back in the Middle East and North Africa conducting airstrikes, gathering intelligence and training and advising Iraqi soldiers that are battling ISIS. Since U.S. forces are not deployed to Iraq in a combat role, significantly fewer numbers are needed compared to the hundreds of thousands troops that were sent to Iraq and Afghanistan over the past decade. Still, U.S. commanders have repeatedly said it will take decades  to defeat ISIS, and a stronger nonmilitary effort to defeat the ideology that fuels Islamic extremist groups.

Non-state actors, like ISIS, are among the Pentagon’s top concerns, but so are hybrid wars in which nations like Russia support militia forces fighting on their behalf in Eastern Ukraine threaten national security interests, Dempsey writes.

“Hybrid conflicts also may be comprised of state and non-state actors working together toward shared objectives, employing a wide range of weapons such as we have witnessed in eastern Ukraine,” Dempsey writes. “Hybrid conflicts serve to increase ambiguity, complicate decision-making, and slow the coordination of effective responses. Due to these advantages to the aggressor, it is likely that this form of conflict will persist well into the future.”

Dempsey also warns that the “probability of U.S. involvement in interstate war with a major power is … low but growing.”

“We must be able to rapidly adapt to new threats while maintaining comparative advantage over traditional ones. Success will increasingly depend on how well our military instrument can support the other instruments of power and enable our network of allies and partners,” Dempsey writes.

The strategy also calls for greater agility, innovation and integration among military forces.

“[T]he 2015 strategy recognizes that success will increasingly depend on how well our military instrument supports the other instruments of national power and how it enables our network of allies and partners,” Dempsey said Wednesday.

The military will continue its pivot to the Pacific, Dempsey writes, but its presence in Europe, the Middle East, Latin America and Africa will evolve. The military must remain “globally engaged to shape the security environment,” he said Wednesday.

The Russian campaign in Ukraine has military strategists questioning if traditional U.S. military force as it is deployed globally is still — or enough of — a deterrence to hybrid and non-state threats like today’s terrorism. “If deterrence fails, at any given time, our military will be capable of defeating a regional adversary in a large-scale, multi-phased campaign while denying the objectives of – or imposing unacceptable costs on – another aggressor in a different region,” Dempsey writes.

The chairman also criticizes Beijing’s “aggressive land reclamation efforts” in the South China Sea where it is building military bases in on disputed islands. In the same region, on North Korea, “In time, they will threaten the U.S. homeland,” Dempsey writes, and mentions Pyongyang’s alleged hack of Sony’s computer network.

Dempsey scolds Iran, which is in the midst of negotiating a deal with Washington to limit its nuclear program, for being a “state-sponsor of terrorism that has undermined stability in many nations, including Israel, Lebanon, Iraq, Syria, and Yemen.”

Russia, Iran, North Korea and China, Dempsey writes, are not “believed to be seeking direct military conflict with the United States or our allies,” but the U.S. military needs to be prepared.

“Nonetheless, they each pose serious security concerns which the international community is working to collectively address by way of common policies, shared messages, and coordinated action,” Dempsey said.

FBI Official Warning, Hackers Attacking Corporations

The FBI Most Wanted hackers. Law enforcement is willing to pay $4.2 million to get them

Cybercrime represents one of the most serious threat to Governments and private industries worldwide, law enforcement hunt down this emerging class of criminals who are able to influence the social context like drug traffickers and terrorists.

The FBI has published the lists of most wanted cyber criminals and the rewards for their capture. According to FBI data these individuals are responsible for hundreds of millions of dollars in losses, for this reason, the Feds are willing to pay a combined $4.2 million for information leading to their arrest.

U.S. Retailer giants Target and Home Depot are just a couple of samples of companies that suffered major cyber attacks, we cannot avoid mentioning other illustrious victims of the cybercrime like the Sony Pictures and government agencies, including the Office of Personnel Management.

Recently Trustwave firm published a report related to 2014 incidents that revealed cyber criminal activities are paying with 1,425% return on investment. More details here.

***

But the warning bells are sounding from the FBI

FBI Warns U.S. Companies to Be Ready for Chinese Hack Attacks

by Shane Harris:
In a message obtained by The Daily Beast, the bureau strongly implies Beijing was behind the massive hack that exposed U.S. government employees’ secrets—and U.S. companies are next.
Within the U.S. government, there’s a debate about who’s responsible for the massive hack of federal employees’ darkest secrets. The FBI on Wednesday weighed in with its own answer, strongly implying that it was the work of China.

The FBI is warning U.S. companies to be on the lookout for a malicious computer program that has been linked to the hack of the Office of Personnel Management. Security experts say the malware is known to be used by hackers in China, including those believed to be behind the OPM breach.

The FBI warning, which was sent to companies Wednesday, includes so-called hash values for the malware, called Sakula, that can be used to search a company’s systems to see if they’ve been affected.

The warning, known as an FBI Liaison Alert System, or FLASH, contains technical details of the malware and describes how it works. While the message doesn’t mention the OPM hack, the Sakula malware is used by Chinese hacker groups, according to security experts. And the FBI message is identical to one the bureau sent companies on June 5, a day after the Obama administration said the OPM had been hacked, exposing millions of government employees’ personal information. Among the recipients of both alerts are government contractors working on sensitive and classified projects.

Director of National Intelligence James Clapper has publicly called China the “leading suspect” in the OPM hack, but he hasn’t offered any evidence publicly to substantiate those claims. Devin Nunes, the chairman of the House Intelligence Committee, has said the jury is still out on whether China is to blame.

In an email obtained by The Daily Beast, the FBI said it was sending the alert again because of concerns that not all companies had received it the first time. Apparently, some of their email filters weren’t configured to let the FBI message through.

The FLASH alert says the bureau has identified “cyber actors who have compromised and stolen sensitive business information and personally identifiable information.”
The FLASH alert says the bureau has identified “cyber actors who have compromised and stolen sensitive business information and personally identifiable information,” which includes names, dates of birth, and Social Security Numbers. The message notes that this information was a “priority target” of the hackers and that such data are frequently used for financial fraud. But “the FBI is not aware of such activity by these groups,” the message says.

Experts believe the data stolen from OPM is being compiled for espionage purposes, including targeting U.S. government employees and contractors who have access to classified information and could be blackmailed or recruited as spies.

The message also described the malware as being designed to copy information and send it to another computer, presumably being operated by a hacker. The Sakula malware has been linked to a breach of patient records at the health insurer Anthem. Some experts now believe the hackers who pulled off that breach are the same ones who penetrated the OPM’s computers.

The alert comes as Obama administration officials have been briefing members of Congress and their staff about the extent of the OPM hack. The Daily Beast reported earlier that the hackers had compromised so-called adjudication information, which includes revealing details, gleaned from background investigations, about government employees’ sex lives, their history of drug and alcohol use, and their financial problems. The OPM hack has also raised questions about whether the personnel records of intelligence agency employees, including covert operatives, were compromised.