China syndromeMicrosoft partner in China trains hackers, steals 50 MB of U.S. gov't e-mail

The Chinese government may have used its access to Microsoft source code to develop attacks that exploited weaknesses in the Windows operating system, according to a U.S. diplomatic memo recently published by Wikileaks.

The 29 June 2009 diplomatic cable claims that a Chinese security firm with close ties to the People’s Republic of China, got access to the Windows source under a 2003 agreement designed to help companies improve the security of the Microsoft operating system. Topsec allegedly worked with a government organization known as CNITSEC, short for the China Information Technology Security Center, which actively worked with “private sector” hackers to develop exploits.

“Additionally, CNITSEC enterprises has recruited Chinese hackers in support of nationally-funded ‘network attack scientific research projects,’” the cable stated. “From June 2002 to March 2003, TOPSEC employed a known Chinese hacker, Lin Yong (a.k.a. Lion and owner of the Honker Union of CHINA), as senior security service engineer to manage security service and training.”

The memo continues:

“While links between top Chinese companies and the PRC are not uncommon, it illustrates the PRC’s use of its ‘private sector’ in support of governmental information warfare objectives, especially in its ability to gather, process, and exploit information. As evidenced with TOPSEC, there is a strong possibility the PRC is harvesting the talents of its private sector in order to bolster offensive and defensive computer network operations capabilities.”

Dan Goodin writes that Topsec Chairman, He Weidong, allegedly told a Chinese news outlet that half of his company’s start-up capital came from that country’s government. Topsec started out in 1995 with funding of just $4,400, and by 2002, had earnings about $440 million. It is now China’s largest provider of information security products and services, according to the cable.

“Interestingly, shareholders did not receive bonuses, as all earnings went for future investment,” the memo stated. “Weidong also stated a bank loan was never used.”

Goodin notes that it is one of a handful of documents published in the past week that outlines U.S. diplomatic concerns about Chinese-sponsored hacking against foreign-based companies and governments.

According to a separate cable, attackers with ties to the Chinese government and military compromised U.S. computer systems in early 2008 to get access to sensitive government communications. The collective operated under the moniker of BC, short by Byzantine Candor.

“During this time period, the actors exfiltrated at least 50 megabytes of e-mail messages and attached documents, as well as a complete list of usernames and passwords from an unspecified USG agency,” the memo stated. “Additionally, multiple files were transferred to the compromised ISP system from other BC-associated systems that have been previously identified collecting e-mail messages from additional victims.”

The same 3 November 2008 memo outlines another BC attack that actively infiltrated at least one U.S. government agency after compromising “multiple systems located at a US Internet service provider (ISP).” Chines hackers also sent a booby-trapped Microsoft Word file to Canadian government officials in October 2008. BC actors have been carrying out social engineering attacks against U.S. government organizations date back since 2002.

“BC intruders have relied on techniques including exploiting Windows system vulnerabilities and stealing login credentials to gain access to hundreds of USG and cleared defense contractor systems over the years,” it continues. “In the U.S., the majority of the systems BC actors have targeted belong to the U.S. Army, but targets also include other DoD services as well as DoS, Department of Energy, additional USG entities, and commercial systems and networks.”