With that in mind, a report published this week found that a penetration into critical U.S. systems by state-sponsored hackers in China was a lot worse than previously believed.
"A cyberespionage campaign blamed on China was more sweeping than previously known, with suspected state-backed hackers exploiting a device meant to boost internet security to penetrate the computers of critical U.S. entities," The Associated Press reports.
"The hack of Pulse Connect Secure networking devices came to light in April, but its scope is only now starting to become clear. The Associated Press has learned that the hackers targeted telecommunications giant Verizon and the country’s largest water agency. News broke earlier this month that the New York City subway system, the country’s largest, was also breached," the AP added.
There are dozens of other "high-value" targets that have yet to be identified publicly as part of the Pulse Secure breach, which is utilized by scores of countries and companies to obtain remote secure access (or not so secure) to their online networks.
It's also not yet clear what sensitive information may have been compromised by the hacks, but it's safe to bet that if Chinese espionage got into these systems, they didn't leave empty-handed (because the point of a hack is to find and take data). Complicating the problem is the fact that very often, it will take months to figure out just how extensive a hack was, if cyber security experts are ever able to find out. And even if nothing of value was stolen, the fact that the hackers managed to breach critical organizations and systems that would be useful to China is bad enough.
“The threat actors were able to get access to some really high-profile organizations, some really well-protected ones,” Charles Carmakal, the chief technology officer of Mandiant, whose firm was the first to make the hacking campaign public in April, the AP reported.
The newswire service adds:
The Pulse Secure hack has largely gone unnoticed while a series of headline-grabbing ransomware attacks have highlighted the cyber vulnerabilities to U.S. critical infrastructure, including one on a major fuels pipeline that prompted widespread shortages at gas stations. The U.S. government is also still investigating the fallout of the SolarWinds hacking campaign launched by Russian cyber spies, which infiltrated dozens of private sector companies and think tanks as well as at least nine U.S. government agencies and went on for most of 2020.
While China's hacking capabilities are reportedly not on par with those of the United States, they are certainly very good, as evidenced by the Pulse Secure Breach. Plus, China has been hacking away at American commercial and defense systems literally for years. In fact, much of the technology Beijing has was taken from someone else, not developed domestically -- and much of that data came from American computer systems.
The Office of the Director of National Intelligence has also noted that China has long used the internet to spy on the U.S., presenting a “prolific and effective cyber-espionage threat," to say the least.
“The capability is very strong and difficult to defend against, and the profile of victims is very significant,” Adrian Nish, the head of cyber at BAE Systems Applied Intelligence, told the AP. “This is a very targeted attack against a few dozen networks that all have national significance in one way or another.”
“We know that bad actors try to compromise our systems,” added Verizon spokesman Rich Young. “That is why internet operators, private companies and all individuals need to be vigilant in this space.”
Yes, well, until China is made to pay a price for this activity, Beijing won't be changing its habits.
Sources include:
Please contact us for more information.
