TaoSecurity Blog

Jack Crook  pointed me toward a story by  Christopher Burgess  about intellectual property theft by "Hongjin Tan, a 35 year old Chinese national and U.S. legal permanent resident... [who] was arrested on December 20 and charged with theft of trade secrets. Tan is alleged to have stolen the trade secrets from his employer, a U.S. petroleum company," according to the criminal complaint filed by the US DoJ. Tan's former employer and the FBI allege that Tan "downloaded restricted files to a personal thumb drive." I could not tell from the complaint if Tan downloaded the files at work or at home, but the thumb drive ended up at Tan's home. His employer asked Tan to bring it to their office, which Tan did. However, he had deleted all the files from the drive. Tan's employer recovered the files using commercially available forensic software. This incident, by definition, involves an "insider threat." Tan was an employee who appears to have cop...

Periodically I read about efforts by China, or Russia, or North Korea, or other countries to replace American software with indigenous or semi-indigenous alternatives. I then reply via Twitter that I love the idea, with a short reason why. This post will list the top five reasons why I want China and other likely targets of American foreign intelligence collection to run their own software. 1. Many (most?) non-US software companies write lousy code.  The US is by no means perfect, but our developers and processes generally appear to be superior to foreign indigenous efforts. Cisco vs Huawei is a good example. Cisco has plenty of problems, but it has processes in place to manage them, plus secure code development practices. Lousy indigenous code means it is easier for American intelligence agencies to penetrate foreign targets. (An example of a foreign country that excels in writing code is Israel, but thankfully it is not the same sort of priority target like China, Russia, or ...

On Friday the Obama administration secured its second win toward establishing a new norm in cyberspace. The  Joint Fact Sheet  published by the White House includes the following language: "no country should conduct or knowingly support cyber-enabled theft of intellectual property, trade secrets, or other confidential business information with the intent of providing competitive advantages to its companies or commercial sectors ;" (emphasis added) This excerpt, as well as other elements of the agreement, mirror words which I covered in my Brookings piece To Hack, Or Not to Hack ? I recommend reading that article to get my full take on the importance of this language, including the bold elements. It's likely many readers don't think of South Korea as an economic threat to the US. While South Korean operations are conducted at a fraction of the scale of their Chinese neighbors, ROK spies still remain busy. In January Shane Harris wrote a great story titled  Our ...

In June 2011 I wrote a blog post with the ever polite title  China's View Is More Important Than Yours . I was frustrated with the Western-centric, inward-focused view of many commentators, which put themselves at the center of debates over digital conflict, neglecting the possibility that other parties could perceive the situation differently. I remain concerned that while Western thinkers debate war using Western, especially Clausewitzian, models, Eastern adversaries, including hybrid Eastern-Western cultures, perceive war in their own terms. I wrote in June 2011: The Chinese military sees Western culture, particularly American culture, as an assault on China , saying "the West uses a system of values (democracy, freedom, human rights, etc.) in a long-term attack on socialist countries ... Marxist theory opposes peaceful evolution, which... is the basic Western tactic for subverting socialist countries" (pp 102-3). They believe the US is conducting psychologic...

This week The Diplomat published an article by Dr Greg Austin titled  What the US Gets Wrong About Chinese Cyberespionage . The subtitle teases the thesis: "Is it government policy in China to pass on commercial secrets obtained via cyberespionage to civil sector firms?" As you might expect (because it prompted me to write this post), the author's answer is "no." The following contains the argument: "Chinese actors may be particularly adept in certain stages of economic espionage, but it is almost certainly not Chinese government policy to allow the transfer of trade secrets collected by highly classified intelligence sources to its civil sector firms for non-military technologies on a wide-spread basis . A U.S. influencing strategy toward China premised on the claim that this is China’s policy would appear to be ill-advised based on the evidence introduced so far by the United States in the public domain." (emphasis added) I find it interest...

We often hear of vulnerabilities in the US military introduced by net-centric warfare and a reliance on communications network. As the Chinese military modernizes, it will introduce similar vulnerabilities. I found another example of this phenomenon courtesy of Chinascope : PLA Used its Online Purchasing Website for its First Online Purchase Written by LKY and AEF    Xinhua reported that on, April 7, the PLA announced that five manufacturers won the bidding, totaling 90 million yuan (US$14.48 million), to supply general and maintenance equipment to the PLA. The article said that these were the first purchase orders that the PLA received since it launched its military equipment purchasing website in January. The site is at http://www.weain.mil.cn/.  The PLA claimed that it saved close to 12 million yuan (US$1.93 million) compared to the list price. The purchase order consisted of items such as containers for maintenance equipment and tools, gas masks, carrier ...

For many years, private organizations in the West have endured attacks by the Chinese government, its proxies, and other parties. These intruders infiltrated private organizations to steal data. Those not associated with the targeted organizations were generally not directly affected. Today an action by the Chinese government is affecting millions of users around the world. This is unacceptable. You may be aware that an American technology company, GitHub , is suffering a massive distributed denial of service attack, at the time of writing. According to Insight Labs , Internet traffic within China is being manipulated, such that users are essentially attacking GitHub. They are unwittingly requesting two sites hosted by GitHub. The first is a mirror of the Chinese edition of the New York Times (blocked for several years ). The other is a mirror of the GreatFire.org Web site, devoted to discovering and exposing Internet filtering by China's "Great Firewall." As n...

I noticed an AFP story posted by Al Jazeera America titled  Iran could allow in Google, other tech companies if they follow rules . It included the following: Iran could allow Internet giants such as Google to operate in the the country if they respect its "cultural" rules, Fars news agency said on Sunday, quoting a senior official. "We are not opposed to any of the entities operating in global markets who want to offer services in Iran," Deputy Telecommunications and Information Technology Minister Nasrollah Jahangard reportedly told Fars. "We are ready to negotiate with them and if they accept our cultural rules and policies they can offer their services in Iran," he said. Jahangard said Iran is "also ready to provide Google or any other company with facilities" that could enable them to provide their services to the region. These statements caught my eye because they contrast with China's actions, in the opposite direct...

Last week the Christian Science Monitor published a story titled  How North Korea built up a cadre of code warriors prepared for cyberwar . It contained the following section: North Korea is faced with tremendous limitations. All of its Internet connections go through servers in China, for example. But it soon may find other ways to connect to the outside world. North Korean leader Kim Jong-Un is expected to meet with Russian President Vladimir Putin later this year in a bid to, among other things, begin running networks through Russia, too. This caught my attention. Years ago I bought a giant map of Asia for my office at Mandiant. I was fascinated by the small part of the world where Russia and North Korea share a border, shown below. If you zoom into that area, you see the following. China, Russia, and North Korea share a common border near the Russian town of Khasan . From that location, Russia and North Korea share a border dividing the Tumen River, approximately...

Screen capture from 2 Jan 2015 SCMP This is an amazing story in the South China Morning Post . Typist sentenced to death in China for leaking military secrets Worker said to have sold secrets about centre researching secret weapon to an unnamed foreign intelligence agency A young typist who worked at a Chinese military manufacturer’s research centre that was developing a secret weapons system has been sentenced to death for spying for a foreign intelligence agency, according to a state-run media report. Yu Hongyang, a member of staff at an unnamed research office, was said to have damaged national security by leaking state secrets, the news website of the Global Times newspaper reported. He was caught by the Ministry of State Security for allegedly buying secret information and then selling it in an “extremely severe” case that warranted the death penalty, the report said. The foreign intelligence agency allegedly involved was not named. Yu was employed at the centr...

I just read a thoughtful article by Michael O'Hanlon and James Steinberg, posted at Brookings and Foreign Policy titled Don't Be a Menace to South (China Sea) . It addresses thorny questions regarding China as President Obama visits South Korea, Japan, Malaysia, and the Philippines. I wanted to share five quick thoughts on the article, fully appreciating I don't have all the answers to this complex strategic problem. 1. "Many in China see the U.S. rebalance as ill-disguised containment, while many in the United States see Chinese military modernization and territorial assertiveness as strong indications that Beijing seeks to undermine Washington's alliances and drive the United States from the Western Pacific." I agree with these statements as being perceptions by both sides, but I also think they are closer to the truth than what the authors believe. I recommend Dr Ashley Tellis' monograph  Balancing Without Containment: An American Strategy for...

People often ask me how to tell if they might be victims of state-serving adversaries . As I've written before , I don't advocate the position that "everyone is hacked." How then can an organization make informed decisions about their risk profile? A unique aspect of Chinese targeted threat operations is their tendency to telegraph their intentions. They frequently publish the industry types they intend to target, so it pays to read these announcements. Adam Segal Tweeted a link to a Xinhua story titled China aims to become world technological power by 2049 . The following excerpts caught my attention: China aims to become a world technological power by 2049 and strives to be a leading nation in innovation and scientific development, according to a government document released on Sunday. The document, released by the Communist Party of China Central Committee and the State Council, or the Cabinet, namely opinions on "deepening technological system reform...

Thanks to the show Asia Biz Today I learned of an industrial espionage case involving South Korea, Israel, and China. In brief, agents of the South Korean branch of an Israeli company stole technology from two South Korean companies, and passed the loot to Chinese and Taiwanese companies. On June 27th the Yonhap news agency in South Korea reported the following: Key technologies to manufacture advanced flat-panel displays at Samsung Mobile Display and LG Display have been leaked by an local unit of an Israeli company, local prosecutors said Wednesday, raising concerns the leakage could pose a major threat to the national interest. The Seoul Central District Prosecutors' Office indicted under physical detention three employees at the local unit of an Israeli inspection equipment supplier, including a 36-year-old man surnamed Kim, on charges of leaking key local technologies used to produce active-matrix organic light-emitting diode (AMOLED) displays and white organic lig...

Last month I attended an event at the Brookings Institute about the Air-Sea Battle concept, which I mentioned in China's High-Tech Military Threat and Air Sea Battle yesterday. A good companion to the briefing is the article Air-Sea Battle: Promoting Stability in an Era of Uncertainty published in February in the journal The American Interest. In that article, General Norton A. Schwartz, USAF (at right in the picture) & Admiral Jonathan W. Greenert, USN write: When Secretary of Defense Leon Panetta introduced the new strategic guidance for the Department of Defense, he stated that the “smaller and leaner” Joint Force of the future must be prepared, in conjunction with allies and partners, to confront and defeat aggressors anywhere in the world, “including those seeking to deny our power projection.” The new strategic guidance directs U.S. forces to maintain the “ability to project power in areas in which our access and freedom to operate is challenged” and to be “cap...

Two months ago Bill Gertz published an excellent article titled China's High-Tech Military Threat . I wanted to share a few excerpts that resonated with me. [I]n November 2011, the Pentagon conducted an unusual rollout of a new military unit called the Air Sea Battle Office... The concept calls for the Air Force, Navy, and Marine Corps to integrate forces and other capabilities to defeat what the Pentagon has labeled “anti-access and area denial weapons” — high-technology arms that can prevent or deter the United States military from operating in certain areas... When pressed on the question of whom the initiative was targeting, one official responded, “The concept isn’t about a specific actor; it’s about countering anti-access, area-denial capabilities...” [T]he Air Sea Battle Concept is the culmination of a strategy fight that began nearly two decades ago inside the Pentagon and U.S. government at large over how to deal with a single actor: the People’s Republic of Chin...

The toughest question in digital security is "who cares?" The recent Tweet by hogfly (@4n6ir) made me ponder this question. He points to an Aviation Week story by David Fulghum, Bill Sweetman, and Amy Butler titled China's Role In JSF's Spiraling Costs . It says in part: How much of the F-35 Joint Strike Fighter’s spiraling cost in recent years can be traced to China’s cybertheft of technology and the subsequent need to reduce the fifth-generation aircraft’s vulnerability to detection and electronic attack? That is a central question that budget planners are asking, and their queries appear to have validity. Moreover, senior Pentagon and industry officials say other classified weapon programs are suffering from the same problem. Before the intrusions were discovered nearly three years ago, Chinese hackers actually sat in on what were supposed to have been secure, online program-progress conferences, the officials say. The full extent of the connection is stil...

When an organization like National Public Radio devotes an eleven minute segment to Chinese digital espionage, even the doubters have to realize something is happening. Rachel Martin's story China's Cyber Threat A High-Stakes Spy Game is excellent and well worth your listening ( .mp3 ) or reading time. Rachel interviews three sources: Ken Lieberthal of the Brookings Institution, Congressman Mike Rogers (chairman of the House Intelligence Committee), and James Lewis from the Center for Strategic and International Studies. If you listen to the report you'll hear James Lewis mention "a famous letter from three Chinese scientists to Deng Xiaoping in March of 1986 that says we're falling behind the Americans. We're never going to catch up unless we make a huge investment in science and technology." James is referring to the so-called 863 Program (Wikipedia). You can also read directly from the Chinese government itself here , e.g.: In 1986, to meet the gl...

Many of you have probably seen coverage of the 2011 ONCIX Reports to Congress: Foreign Economic and Industrial Espionage . I recommend every security professional read the latest edition (.pdf). I'd like to highlight the key findings of the 2011 version: Pervasive Threat from Adversaries and Partners Sensitive US economic information and technology are targeted by the intelligence services, private sector companies, academic and research institutions, and citizens of dozens of countries. • Chinese actors are the world’s most active and persistent perpetrators of economic espionage. US private sector firms and cybersecurity specialists have reported an onslaught of computer network intrusions that have originated in China, but the IC cannot confirm who was responsible. • Russia’s intelligence services are conducting a range of activities to collect economic information and technology from US targets. • Some US allies and partners use their broad access to US institutions to acqui...

(Photo: Business Insider ) This is not a political blog, so I'm not here to endorse candidates. However, I do want to point out another example of high-level policymakers discussing ongoing activities by China against the US and other developed economies. First, the Washington Post published an editorial by Mitt Romney which included the following: China seeks advantage through systematic exploitation of other economies. It misappropriates intellectual property by coercing “technology transfers” as a condition of market access; enables theft of intellectual property, including patents, designs and know-how; hacks into foreign commercial and government computers ... The result is that China sells high-quality products to the United States at low prices. But too often the source of that high quality is American innovations stolen by Chinese companies. I missed this in August, but former ambassador to China Jon Huntsman said the following during a debate: Huntsman Jr. pointed to Ch...

Thanks to a source who wishes to remain anonymous, I read Chinese spy mania sweeps the world , an article not from a Western publication. Rather, it's from Voice of Russia . Does any of this sound familiar? [T]his is the most powerful secret service based on the principle of attracting all ethnic Chinese, wherever they may live. An adherent of the “total espionage” strategy, Beijing even encourages emigration in the hope that its citizens will remain loyal to and useful for their historical homeland after moving to another country... "The history of China’s espionage activities on Russian armaments is not only limited to one precedent or one type of weapons. One of the top Chinese priorities is to produce complete replicas of Russia’s best machines and weapons , from the Sukhoi Su-33 fighter jet to missiles, aircraft carriers and so on. This is a truly purpose-oriented strategy of a large country - snatch anything you can and reproduce it domestically ," ["IT exp...