News / Science & Technology

Researcher: Chinese Hackers Spied on Europeans Before G20 Meeting

Russia's President Vladimir Putin speaks during a media conference after a G20 summit in St. Petersburg, Russia on Sept. 6, 2013.
Russia's President Vladimir Putin speaks during a media conference after a G20 summit in St. Petersburg, Russia on Sept. 6, 2013.
Reuters
— Chinese hackers eavesdropped on the computers of five European foreign ministries before last September's G20 Summit, which was dominated by the Syrian crisis, according to research by computer security firm FireEye.
 
The hackers infiltrated the ministries' computer networks by sending emails to staff containing tainted files with titles such as “UStmilitarytoptionstintSyria,” said FireEye, which sells virus fighting technology to companies.
 
When recipients opened these documents, they loaded malicious code on to their personal computers.
 
For about a week in late August, California-based FireEye said its researchers were able to monitor the “inner workings” of the main computer server used by the hackers to conduct their reconnaissance and move across compromised systems.
 
FireEye lost access to the hackers after they moved to another server shortly before the G20 Summit in St. Petersburg, Russia. FireEye said it believes the hackers were preparing to start stealing data just as the researchers lost access.
 
The U.S. company declined to identify the nations whose ministries were hacked, although it said they were all members of the European Union. FireEye said it reported the attacks to the victims through the Federal Bureau of Investigation.
 
A spokeswoman for the FBI, Jenny Shearer, declined to comment.
 
“The theme of the attacks was U.S. military intervention in Syria,” said FireEye researcher Nart Villeneuve, one of six researchers who prepared the report. “That seems to indicate something more than intellectual property theft... The intent was to target those involved with the G20.”
 
The Sept. 5-6 G20 summit was dominated by discussion of the Syrian crisis, with some European leaders putting pressure on U.S. President Barack Obama to hold off on taking military action against Syrian President Bashar al-Assad.
 
Villeneuve said he was confident that the hackers were from China based on a variety of technical evidence, including the language used on their control server and the machines that they used to test their malicious code.
 
However, Villeneuve also admitted that he did not have any hard evidence that linked the hackers to the Chinese government. “All we have is technical data,” Villeneuve said, stressing the impossibility of coming to an absolute conclusion on technical data alone.
 
Chinese Foreign Ministry spokesman Hong Lei said China opposed any hacking activities.
 
“U.S. internet companies are keen on hyping up the so-called hacker threat from China, but they never obtain irrefutable proof, and what so-called evidence they do get is widely doubted by experts. This is neither professional nor responsible,” Hong told a daily news briefing in Beijing.
 
One of Dozens
 
Western cybersecurity firms monitor several dozen hacking groups operating in China, most of which they suspect of having ties to the government. The firms also suspect the hacking groups of stealing intellectual property for commercial gain.
 
China has long denied those allegations, saying it is the victim of spying by the United States. Those claims gained some credibility after former National Security Agency contractor Edward Snowden began leaking documents about U.S. surveillance of foreign countries, including China.
 
FireEye said it had been following the hackers behind the Syria-related attack for several years, but this is the first time the group's activities have been publicly documented. The company calls the group “Ke3chang,” after the name of one of the files it uses in one of its pieces of malicious software.
 
FireEye said it believed the hackers dubbed the Syria-related campaign “moviestar” because that phrase was used as a tag on communications between infected computers and the hackers' command-and-control server.
 
In 2011, the group ran another operation dubbed “snake”, which enticed victims with a file that FireEye said contained nude pictures of Carla Bruni, the Italian-French singer, songwriter and model who in 2008 married then French President Nicolas Sarkozy.
 
The host name for that campaign's command-and-control server contained the string “g20news”, which might indicate that it was related to the G20 Finance Ministers meeting in Paris in 2011, FireEye said.
 
The email address used to send those malicious files had the phrase “consulate” in it, which also bolstered the possibility that the attack was politically motivated, Villeneuve said.
 
He said researchers only gathered evidence about “snake” through reviewing emails and malicious code. They did not have access to its command-and-control server, which they did in the case of the “moviestar” attack.

You May Like

Koreas Mark 61st Anniversary of War Armistice

Muted observances on both sides of heavily-armed Demilitarized Zone that separates two decades-long enemies More

Judge Declares Washington DC Ban on Public Handguns Unconstitutional

Ruling overturns capital city's prohibition on carrying guns in pubic More

Pricey Hepatitis C Drug Draws Criticism

Activists are using the International AIDS Conference to criticize drug companies for charging high prices for life-saving therapies More

Featured Videos

Your JavaScript is turned off or you have an old version of Adobe's Flash Player. Get the latest Flash player.
Students in Business for Themselvesi
X
Mike O'Sullivan
July 26, 2014 11:04 AM
They're only high school students, but they are making accessories for shoes, fabricating backpacks and doing product photography - all through their own businesses. It's the result of a partnership between a non-profit organization that teaches entrepreneurship and their schools. VOA's Mike O'Sullivan and Deyane Moses met the budding entrepreneurs near Los Angeles.
Video

Video Students in Business for Themselves

They're only high school students, but they are making accessories for shoes, fabricating backpacks and doing product photography - all through their own businesses. It's the result of a partnership between a non-profit organization that teaches entrepreneurship and their schools. VOA's Mike O'Sullivan and Deyane Moses met the budding entrepreneurs near Los Angeles.
Video

Video Astronauts Train in Underwater Lab

In the world’s only underwater laboratory, four U.S. astronauts train for a planned visit to an asteroid. The lab - called Aquarius- is located five kilometers off Key Largo, in southern Florida. Living in close quarters and making excursions only into the surrounding ocean, they try to simulate the daily routine of a crew that will someday travel to collect samples of a rock orbiting far away from earth. VOA’s George Putic has more.
Video

Video Not Even Monks Spared From Thailand’s Junta-Backed Morality Push

With Thailand’s military government firmly in control after May’s bloodless coup, authorities are carrying out plans they say are aimed at restoring discipline, morality and patriotism to all Thais. The measures include a crackdown on illegal gambling, education reforms to promote students’ moral development, and a new 24-hour phone hotline for citizens to report misbehaving monks. Steve Sandford reports from Bangkok.
Video

Video Virtual Program Teaches Farming Skills

In a fast-changing world beset by unpredictable climate conditions, farmers cannot afford to ignore new technology. Researchers in Australia are developing an online virtual world program to share information about climate change and more sustainable farming techniques for sugar cane growers. As VOA's Zlatica Hoke reports, the idea is to create a wider support network for farmers.
Video

Video Airline Expert: Missile will Show Signature on Debris

The debris field from Malaysia Airlines Flight 17 is spread over a 21-kilometer radius in eastern Ukraine. It is expected to take investigators months to sort through the airplane pieces to learn about the missile that brought down the jetliner and who fired it. VOAs Carolyn Presutti explains how this work will be done.
Video

Video Treatment for Childhood Epilepsy Heats up Medical Marijuana Debate

In the United States, marijuana is classed as an illegal drug by the federal government. But nearly half the states have legalized it, to some degree. Proponents say some strains of marijuana might have exceptional health benefits, for treating pain or inflammation in chronic conditions such as cancer, multiple sclerosis and epilepsy. Shelley Schlender reports on a strain of medical marijuana developed in Colorado that is reputed to reduce seizures in childhood epilepsy
Video

Video Airbus Adds Metal 3D Printed Parts to New Jets

By the end of this year, European aircraft manufacturing consortium Airbus plans to deliver the first of its new, extra-wide-body passenger jets, the A350-XWB. Among other technological innovations, the new plane will also incorporate metal parts made in a 3-D printer. VOA's George Putic has more.
Video

Video AIDS Conference Welcomes Exciting Developments in HIV Treatment, Prevention

Significant strides have been made in recent years toward the treatment and prevention of HIV, the virus that causes AIDS. This year, at the International AIDS Conference, the AIDS community welcomed progress on a new pill that may prevent transmission of the deadly virus. VOA’s Anita Powell reports from Melbourne, Australia.
Video

Video IAEA: Iran Turns its Enriched Uranium Into Less Harmful Form

Iran has converted its stockpiles of enriched uranium into a less dangerous form that is more difficult to use for nuclear weapons, according to the United Nations’ Atomic Energy Agency. The move complies with an interim deal reached with Western powers on Iran's nuclear program last year, in exchange for easing of sanctions. Henry Ridgwell reports for VOA from London.

AppleAndroid