ON FEBRUARY 19th Mandiant, a security firm, released a report alleging that hackers from a Chinese military outfit known as Unit 61398 were probably behind attacks against more than a hundred companies and government agencies around the world. Without delving into the geopolitics of the the incident, involvement in which the Chinese authorities vehemently deny (and which we write about here), Babbage decided to examine what is known about the hackers' methods.
In fact, Mandiant's detailed account of a group it dubs APT1 (after the term Advanced Persistent Threat) will not strike internet-security wonks as particularly Earth-shattering. It reveals the use of well-known techniques coupled with publicly available softwarethough some proprietary software, apparently perfected over many years, was also used. What has turned heads is the duration of the attacks and the range of the group's "ecosystem" of remote-control software. This combination allowed the hackers to siphon terabytes, or trillions of bytes, of data from their victims.
In many ways, the attacks resembled those criminal groups and spammers deploy against individuals and businesses. A "spearphishing" e-mail is sent, which attempts to get members of an organisation to open an attachment that appears to originate from a colleague or business partner, and contains some typical business data. Rather than a file, though, the attachment is a piece of malware. When opened, it exploits system flaws to install backdoor access to the computer. This allows remote command-and-control servers anywhere on the internet to install additional software, capture keystrokes and images on the screen, and ferret around the local network.
Mandiant says the hackers sometimes used malicious remote-access toolkits readily available on the "dark side" of the internet (if not through your average Google search). But mostly they either developed or acquired at least 42 "families" of proprietary remote-access tools. Some have dates imprinted in them which indicate they were initially programmed as early as 2004, with updates added over the subsequent six years. The attacks, in other words, were carefully planned and premeditated.
To fool firewalls and other software, some remote-control malware mimicked traffic patterns of legitimate internet services, like the Jabber/XMPP chat system used by Google and Facebook, among others. This allowed them to send information to and from the infected machines without raising suspicions. A lot of the insidious traffic was encrypted, but this too is commonplace for many websites and services, including Twitter and standard e-mail.
APT1 tried hard to retrieve password-related information, often using common cracking tools. Before being stored a password is usually fed into an algorithm called a hash function. This converts it into an obscure string of symbols, or a "hash", that offers no clue as to the original input. The function is irreversible, so you cannot work back from a hash to the password. You can, however, run different words through a hash function and compare the resulting hash with the one stored. Many such "brute-force" attacks use large dictionaries of common and less common passwords. As a number of companies discovered last year, poor passwords make for easy pickings. Some clever tools actually let an attacker log into a system using the encrypted form of a password, dispensing with the need to crack it.
There is also evidence of hackers gleaning network information in order to make connections within a network and infect more machines. Some of the backdoors captured credentials for virtual private networks (VPNs), which allow direct remote access to a network without having to rely on a single compromised computer. Once in, the eavesdroppers used e-mail-extraction tools, which Mandiant says are unique to the group, to pull messages or attachments of interest from a user's inbox, both current and archived. Many of these exploits remain in place, sometimes in multiple forms in case one is found and removed. Hackers stuffed any files deemed of interest into compressed archive formats and added password protection before whisking them away.
For all their sophistication, however, the hackers could display incredible insouciance. For example, APT1 registered domain names for some of its systems and used either a Shanghai mailing address or included an e-mail address tracked via a simple Google search to a Shanghai-based organisation. Remote-access sessions using a Microsoft tool nearly always originated from hacker machines using the simplified Chinese keyboard layout. Backdoor software included "path" information, revealing details about folder organisation on programmers' computers, as well as the date software was written.
Most absurdly, perhaps, some hackers used the remote sessions on compromised machines to access their personal Facebook, Twitter or Gmail accounts. Among others, Mandiant has fingered a certain Wang Dong, who uses the handle Ugly Gorilla and who registered one of the command-and-control domains. It also included a screen shot of a Gmail inbox of another hacker. Mandiant is bracing for reprisals.
Facebook
Twitter