News / Science & Technology

Researcher: Chinese Hackers Spied on Europeans Before G20 Meeting

Russia's President Vladimir Putin speaks during a media conference after a G20 summit in St. Petersburg, Russia on Sept. 6, 2013.
Russia's President Vladimir Putin speaks during a media conference after a G20 summit in St. Petersburg, Russia on Sept. 6, 2013.
Reuters
Chinese hackers eavesdropped on the computers of five European foreign ministries before last September's G20 Summit, which was dominated by the Syrian crisis, according to research by computer security firm FireEye.
 
The hackers infiltrated the ministries' computer networks by sending emails to staff containing tainted files with titles such as “UStmilitarytoptionstintSyria,” said FireEye, which sells virus fighting technology to companies.
 
When recipients opened these documents, they loaded malicious code on to their personal computers.
 
For about a week in late August, California-based FireEye said its researchers were able to monitor the “inner workings” of the main computer server used by the hackers to conduct their reconnaissance and move across compromised systems.
 
FireEye lost access to the hackers after they moved to another server shortly before the G20 Summit in St. Petersburg, Russia. FireEye said it believes the hackers were preparing to start stealing data just as the researchers lost access.
 
The U.S. company declined to identify the nations whose ministries were hacked, although it said they were all members of the European Union. FireEye said it reported the attacks to the victims through the Federal Bureau of Investigation.
 
A spokeswoman for the FBI, Jenny Shearer, declined to comment.
 
“The theme of the attacks was U.S. military intervention in Syria,” said FireEye researcher Nart Villeneuve, one of six researchers who prepared the report. “That seems to indicate something more than intellectual property theft... The intent was to target those involved with the G20.”
 
The Sept. 5-6 G20 summit was dominated by discussion of the Syrian crisis, with some European leaders putting pressure on U.S. President Barack Obama to hold off on taking military action against Syrian President Bashar al-Assad.
 
Villeneuve said he was confident that the hackers were from China based on a variety of technical evidence, including the language used on their control server and the machines that they used to test their malicious code.
 
However, Villeneuve also admitted that he did not have any hard evidence that linked the hackers to the Chinese government. “All we have is technical data,” Villeneuve said, stressing the impossibility of coming to an absolute conclusion on technical data alone.
 
Chinese Foreign Ministry spokesman Hong Lei said China opposed any hacking activities.
 
“U.S. internet companies are keen on hyping up the so-called hacker threat from China, but they never obtain irrefutable proof, and what so-called evidence they do get is widely doubted by experts. This is neither professional nor responsible,” Hong told a daily news briefing in Beijing.
 
One of Dozens
 
Western cybersecurity firms monitor several dozen hacking groups operating in China, most of which they suspect of having ties to the government. The firms also suspect the hacking groups of stealing intellectual property for commercial gain.
 
China has long denied those allegations, saying it is the victim of spying by the United States. Those claims gained some credibility after former National Security Agency contractor Edward Snowden began leaking documents about U.S. surveillance of foreign countries, including China.
 
FireEye said it had been following the hackers behind the Syria-related attack for several years, but this is the first time the group's activities have been publicly documented. The company calls the group “Ke3chang,” after the name of one of the files it uses in one of its pieces of malicious software.
 
FireEye said it believed the hackers dubbed the Syria-related campaign “moviestar” because that phrase was used as a tag on communications between infected computers and the hackers' command-and-control server.
 
In 2011, the group ran another operation dubbed “snake”, which enticed victims with a file that FireEye said contained nude pictures of Carla Bruni, the Italian-French singer, songwriter and model who in 2008 married then French President Nicolas Sarkozy.
 
The host name for that campaign's command-and-control server contained the string “g20news”, which might indicate that it was related to the G20 Finance Ministers meeting in Paris in 2011, FireEye said.
 
The email address used to send those malicious files had the phrase “consulate” in it, which also bolstered the possibility that the attack was politically motivated, Villeneuve said.
 
He said researchers only gathered evidence about “snake” through reviewing emails and malicious code. They did not have access to its command-and-control server, which they did in the case of the “moviestar” attack.

You May Like

Multimedia US Nurse ‘Cured of Ebola,’ NIH Says

Nina Pham, Texas nurse who treated first Ebola patient in US, received no experimental drugs; WHO expects vaccine surge in 2015 More

Video Islamic State Militants Encroach on Baghdad

Iraqi capital not under ‘imminent threat,’ US military says, amid worries about foothold More

Video Hong Kong Protesters Focus on Holding Volatile Mong Kok

Activists say holding Mong Kok is key to their movement's success, despite confrontations with angry residents and police More

Featured Videos

Your JavaScript is turned off or you have an old version of Adobe's Flash Player. Get the latest Flash player.
After Decades of Pressure, Luxembourg Drops Bank Secrecy Rulesi
X
October 21, 2014 12:20 AM
European Union finance ministers have reached a breakthrough agreement that will make it more difficult for tax cheats to hide their money. The new legislation, which had been blocked for years by countries with a reputation as tax havens, was approved last week after Luxembourg and Austria agreed to lift their vetoes. But as Mil Arcega reports, it doesn’t mean tax cheats have run out of places to keep their money hidden.
Video

Video After Decades of Pressure, Luxembourg Drops Bank Secrecy Rules

European Union finance ministers have reached a breakthrough agreement that will make it more difficult for tax cheats to hide their money. The new legislation, which had been blocked for years by countries with a reputation as tax havens, was approved last week after Luxembourg and Austria agreed to lift their vetoes. But as Mil Arcega reports, it doesn’t mean tax cheats have run out of places to keep their money hidden.
Video

Video Kobani Refugees Welcome, Turkey Criticizes, US Airdrop

Residents of Kobani in northern Syria have welcomed the airdrop of weapons, ammunition and medicine to Kurdish militia who are resisting the seizure of their city by Islamic State militants. The Turkish government, however, has criticized the operation. VOA’s Scott Bobb reports from southeastern Turkey, across the border from Kobani.
Video

Video China Political Meeting Seeks to Improve Rule of Law

China’s communist leaders will host a top level political meeting this week, called the Fourth Plenum, and for the first time in the party’s history, rule of law will be a key item on the agenda. Analysts and Chinese media reports say the meetings could see the approval of long-awaited measures aimed at giving courts more independence and include steps to enhance an already aggressive and high-reaching anti-corruption drive. VOA’s Bill Ide has more from Beijing.
Video

Video US ‘Death Cafes’ Put Focus on the Finale

In contemporary America, death usually is a topic to be avoided. But the growing “death café” movement encourages people to discuss their fears and desires about their final moments. VOA’s Jerome Socolovsky reports.
Video

Video Ebola Orphanage Opens in Sierra Leone

Sierra Leone's first Ebola orphanage has opened in the Kailahun district. Hundreds of children orphaned since the beginning of the Ebola outbreak face stigma and rejection with nobody to care for them. Adam Bailes reports for VOA about a new interim care center that's aimed at helping the growing number of children affected by Ebola.
Video

Video Young Nairobi Tech Innovator on 'Track' in Security Business

A 24-year-old technology innovator in Nairobi has invented a tracking device that monitors and secures cars. He has also come up with what he claims is the most robust audio-visual surveillance system yet. As Lenny Ruvaga reports from the Kenyan capital, his innovations are offering alternative security solutions.
Video

Video Latinas Converting to Islam for Identity, Structure

Latinos are one of the fastest growing groups in the Muslim religion. According to the Pew Research Center, about 6 percent of American Muslims are Latino. And a little more than half of new converts are female. VOA’s Carolyn Presutti travelled to Miami, Florida -- where two out of every three residents is Hispanic -- to learn more.
Video

Video Exclusive: American Joins Kurds' Anti-IS Fight

The United States and other Western nations have expressed alarm about their citizens joining Islamic State forces in Syria and Iraq. In a rare counterpoint to the phenomenon, an American has taken up arms with the militants' Syrian Kurdish opponents. Elizabeth Arrott has more in this exclusive profile by VOA Kurdish reporter Zana Omer in Ras al Ayn, Syria.
Video

Video South Korea Confronts Violence Within Military Ranks

Every able-bodied South Korean male between 18 and 35 must serve for 21 to 36 months in the country’s armed forces, depending upon the specific branch. For many, service is a rite of passage to manhood. But there are growing concerns that bullying and violence come along with the tradition. Reporter Jason Strother has more from Seoul.
Video

Video North Carolina Emerges as Key Election Battleground

U.S. congressional midterm elections will be held on November 4th and most political analysts give Republicans an excellent chance to win a majority in the U.S. Senate, which Democrats now control. So what are the issues driving voters in this congressional election year? VOA National Correspondent Jim Malone traveled to North Carolina, one of the most politically competitive states in the country, to find out.
Video

Video Comanche People Maintain Pride in Their Heritage

The Comanche (Indian nation) once were called the “Lords of the Plains,” with an empire that included half the land area of current day Texas, large parts of Oklahoma, New Mexico, Kansas and Colorado.The fierceness and battle prowess of these warriors on horseback delayed the settlement of most of West Texas for four decades. VOA’s Greg Flakus reports from Lawton, Oklahoma, that while their warrior days are over, the 15,000 members of the Comanche Nation remain a proud people.
Video

Video Turkey Campus Attacks Raise Islamic Radicalization Fears

Concerns are growing in Turkey of Islamic radicalization at some universities, after clashes between supporters of the jihadist group Islamic State (IS) or ISIS, and those opposed to the extremists. Pro-jihadist literature is on sale openly on the streets of Istanbul. Critics accuse the government of turning a blind eye to radicalism at home, while Kurds accuse the president of supporting IS - a charge strongly denied. Henry Ridgwell reports from London.

All About America

AppleAndroid