FBI investigates possible China military involvement in cyber attack

hacking hackers chinese registry.com

The FBI is investigating possible Chinese military involvement in a cyber hack at Register.com, which manages more than 1.4m website addresses for businesses around the world.

Hackers, who appear to have stolen network and employee passwords, have accessed Register’s network for about a year, said people familiar with the probe. But the breach, which the company reported to the FBI but not to customers or investors, is not known to have caused disruptions or resulted in any theft of client data.

That has bolstered investigators’ belief that the hackers are state-sponsored rather than criminals intent on making money from credit card data or social security information.

Although the investigative trail has pointed to Chinese military involvement, it is unclear what China would want to accomplish by hacking the site. Some current and former law enforcement officials said, however, that the hack could be aimed at obtaining the ability to undermine large parts of internet infrastructure.

That would enable hackers to redirect traffic to unintended websites, steal data, access email accounts associated with those sites, or cause web pages to crash, among other consequences.

The Chinese defence ministry did not respond to a request for comment.

The Register.com threat reflects the growing danger of state-sponsored cyber hacks, which are more difficult to prosecute than criminal attacks. In 2014 in an unprecedented move, the Justice Department indicted five members of the Chinese military for hacking into several US companies to steal trade secrets but it is doubtful that they will ever be apprehended.

Register.com is a unit of Web.com, whose companies cater to businesses large and small as well as doctors’ practices. In addition to managing web addresses, known as domain names, they also host websites and provide ecommerce and email services, so they have access to a site’s files, credit card data and other information.

Other subsidiaries of parent company Web.com such as Network Solutions, the third largest internet registrar in the world with more than 4.5m domain names, could also be vulnerable, people familiar with the case said. In 2013, Network Solutions suffered a breach that caused a temporary outage at Linkedin.com, but the networking site is no longer a client.

The Securities and Exchange Commission has provided guidance on cyber breaches, urging publicly traded companies to disclose hacks if they are “material” events, but it is often left to companies to decide whether a cyber attack is “material.”

Web.com, which is publicly traded, has not specifically disclosed the breach in SEC filings, but expanded its description of cyber security risks in its 2014 annual report.

“We may not be able to remedy these problems in a timely manner, or at all,” it said in the February filing. “Because techniques used by outsiders to obtain unauthorised network access or to sabotage systems change frequently and generally are not recognised until launched against a target, we may be unable to anticipate these techniques or implement adequate preventive measures.”

A Web.com spokesman declined to comment on specific breaches but said the company had built up security protocols and tools to constantly monitor and mitigate threats. He added that the company was not aware of a “loss of any customer data resulting from an attack on any Web.com system.”

He acknowledged that Web.com clients have been targeted by hackers using “phishing” emails that encourage a user to click on what appears to be a legitimate message in an attempt to steal information.

“Despite our efforts to mitigate the impacts of customer infections through product improvements and user education, phishing and spear phishing activities remain a serious problem,” the spokesman said.

There are no federal standards for reporting cyber breaches and state laws vary, with most rules focusing on ensuring that companies disclose anything affecting an individual’s personal information like healthcare records and social security numbers but little else. Proposals in Congress to establish federal reporting standards also focus on personal information.

That means companies in sectors where breaches do not expose such data but instead are focused on stealing intellectual property, trade secrets or other business-oriented information are not required to report breaches and often do not.

In many attacks on defence and industrial sector targets, hackers have been linked to the Chinese military and have remained in company networks for several years because the companies cannot get rid of them, but the breaches remain undisclosed to the public, according to people familiar with those cases.


Henry Sapiecha

Leave a Reply

Your email address will not be published. Required fields are marked *