Join our Mailing List

"For a happier, more stable and civilized future, each of us must develop a sincere, warm-hearted feeling of brotherhood and sisterhood."

China attack on Google 'routine'

January 18, 2010

BBC NEWS 2010/01/14
By Maggie Shiels
Technology reporter, BBC News, Silicon Valley

The cyber-attack that made Google consider pulling out of China was run of
the mill, say security experts.

Google revealed its move following attempts to hack Gmail accounts of human
rights activists.

The search giant said analysis showed that the series of attacks originated
from inside China.

"This wasn't in my opinion ground-breaking as an attack. We see this fairly
regularly," said Mikko Hypponen, of security firm F-Secure.

"Most companies just never go public," he added.

"Human-rights activists are the biggest target," said Mr Hypponen. "Everyone
from Freedom for Tibet to Falun Gong supporters and those involved in
Liberation of Taiwan are hit."

F-Secure has been monitoring such attacks against Chinese human-rights
activists since 2005.

Google has operated in China since 2006 and has now said it was no longer
willing to censor results on its Chinese search engine as the government

China has responded to Google and said that foreign firms were welcome to
trade in the nation "according to the law". The spokesman added that the net
was "open" in China.

Other victims

Of the attacks, Google said only two Gmail accounts were accessed and that
hackers got very limited information. This included when the account was set
up and the subject line rather than content of e-mail messages.

The company said that the accounts of dozens of US, China and Europe-based
users who are advocates of human rights in China had been routinely accessed
by third parties.

The cyber-criminals broke in using a tactic known as "phishing" where a
legitimate e-mail is sent claiming to come from someone the user knows and

Typically these e-mail messages have a booby-trapped attachment that, once
opened, places malware on a computer.

Once an e-mail account is compromised, attackers can piggyback on it to get
access to confidential files and systems throughout an organisation.

"The attacker really did their homework finding out first who to attack, who
the key people were in the organisation and how to attack them," said Mr

Google has said publicly that another 20 companies were hit. Adobe is the
only other company to go public with this information.

But many security experts say the figure is much higher.

"We know of at least 40 companies that were attacked. For the most part they
were in the US," said Chris Day, chief security architect of IT services
firm Terremark.

"This goes on all the time. Of the Fortune 100 companies, all 100 are under
some sort of attack all the time."

Mr Day told the BBC a host of those targeted were technology and software
companies based in Silicon Valley.

Google has revealed that finance, chemical and media firms were hit.

Blame game

Questions are now being asked about who orchestrated the attacks.

"We are not saying one way or another these attacks were state sponsored or
done with the approval of the state," said David Drummond, Google's chief
legal officer.

"We do know they were highly organised and we believe the attacker came from

The inference being drawn across the security community is that the Google
attack and those on other US companies were sanctioned by government.

"Sources indicate that they believe the attack is the work of actors
operating on behalf of or in the direct employ of official intelligence
entities of the People's Republic of China," said iDefense Labs in an e-mail
to the BBC.

IDefense also revealed that this incident resembles one that took place in
July 2009 against nearly 100 IT-focused companies.

"A nation state getting into the business of hacking companies is a really
big shift," said Dan Kaminsky, director of penetration testing at security
firm IOActive.

"The question now is are we going to see a significant increase or decrease
in these kinds of attacks?"

Safe and secure

Google has stressed that users have nothing to fear about the security of
the information it holds.

"The fact that they have come out and are transparent about what has
happened is good for user trust," said Terremark's Mr Day.

"I have seen far worse things happen and I think larger organisations, and
even individuals, should take this as an object lesson that no-one is immune
to these attacks."

General security advice for all users is to have a strong password that is
changed regularly and includes letters, numbers and symbols.

All security patches should be up-to-date and users should never open
attachments unless they know the person they are being sent by and are
expecting them.
CTC National Office 1425 René-Lévesque Blvd West, 3rd Floor, Montréal, Québec, Canada, H3G 1T7
T: (514) 487-0665
Developed by plank