NewsBreakingOnline

FBI to investigate as China denies suggestions it was behind ‘phishing’ attacks on senior military and government personnel The FBI is to investigate “very serious” allegations that the Google mail accounts of senior US government officials have been attacked by Chinese hackers, the secretary of state Hillary Clinton said, as the long-running war between the technology giant and the Chinese government escalated. China hit back angrily at suggestions it was behind the “phishing” attacks on the email addresses of hundreds of targets, including senior military and government personnel from the US and South Korea. A spokesman for the Chinese foreign ministry called the accusation “a total fabrication” made by those “with ulterior motives”. “Hacking attacks are an international issue. China is also a victim,” Hong Lei told a press conference in Beijing. According to Google , the scam targeted the Gmail accounts of “hundreds of users including, among others, senior US government officials, Chinese political activists, officials in several Asian countries (predominantly South Korea), military personnel and journalists”. A cabinet-level official in the US government was among those whose Gmail password was stolen and whose data was compromised, an official told the Washington Post . Clinton told reporters that the US was disturbed by the reports. “These allegations are very serious,” she said. “We take them seriously. We are looking into them.” She declined to comment further on the matter, referring questions to both Google and “to the FBI which will be conducting the investigation”. Clinton said attacks such as the one described by Google were a prime reason the State Department has for the first time created a cyber-security coordinator. “We know this is going to be a continuing problem and therefore we want to be as prepared as possible to deal with these matters when they do come to our attention,” she said. The Pentagon said it had very little information since the reported breaches involved personal accounts rather than government email. And since the accounts were not official, it wasn’t aware whether defence employees were among the targeted individuals, the statement said. The US government intends to broaden its laws of armed conflict to designate cyber attacks a potential act of war, it emerged this week , in a move with significant implications for the militarisation of cyberspace. Google said on Wednesday that it had traced the scam to Jinan in Shandong province, believed to be a hub for Chinese cyber espionage. A “vocational school” in the city has been named as one of two colleges suspected in earlier attacks on Google and other American companies. The internet company did not directly accuse the Chinese government of being behind the attacks, but experts believe their sophistication and highly targeted nature point to a government source. Google said it had become aware of the scam, which sought to trick targets inadvertently to disclose their email logins and passwords, through its own “abuse detection systems” put in place following a “highly sophisticated and targeted” attack in December 2009. Following that assault, which it believed was intended to gather information on Chinese human rights activists, the company said it would no longer agree to censor its Chinese search results. The Chinese authorities have since withdrawn the licence for Google’s mainland-based search operations. On becoming aware of the latest attack, the company said on its official blog, it had notified all victims and taken steps to secure their accounts. Though the company became aware of the nature and scale of the scam relatively recently, it was first publicly exposed more than three months ago by a technology blogger based in Washington DC who writes pseudonymously as Mila Parkour . In a post on 17 February , Parkour noted that “spear-phishing” attacks, their origin at the time unspecified, had specifically targeted the personal Google email accounts of “military, government employees and associates”. She had been alerted to the issue by a contact, she told the Guardian, and so carried out “a mini- research and analysis and posted the findings as I heard it happened to other people in the military and US government”. So-called spear-phishing attacks work by tricking their targets into revealing their logons and passwords in order to take control of their email accounts. Because they depend on human lapses, they are a comparatively unsophisticated form of cyber attack that do not necessarily, in themselves, compromise hi-tech security systems. For that reason, Parkour saw no reason to alert Google immediately. Indeed, she wrote on her blog, she would not normally have blogged about the incident at all, were it not for its “particularly invasive approach”. The method of the scam she described displayed impressive levels of ingenuity. Targets would receive an email which appeared to come from a colleague or close associate – in fact a spoofed address – to which a file appeared to be attached. The hackers had taken care to use idiomatic, jargon-heavy language that would lend the mail credibility to recipients. One example, an email headed “Fw: Draft US-China Joint Statement”, read: “This is the latest version of State’s joint statement. My understanding is that State put in placeholder econ language and am happy to have us fill in but in their rush to get a cleared version from the WH, they sent the attached to Mike.” Clicking on the apparent attachment would open a page almost identical to the Gmail page, where victims were prompted to enter their user name and password, just as they would if logging into their own mail. Once the target had effectively handed over the keys to his or her private data, the attackers would then set up the account to forward all incoming emails to another address, read the incoming mail to learn more about the target, and use the information they learned – such as the details of family members and colleagues – to refine future spoof emails to victims, in the hope of engaging them in responses or even conversations. Such emails, said Parkour, would be sent on a monthly or bi-weekly basis. Asked about the length of time it had taken Google to disclose publicly the scale of the scam, Parkour said: “Looks like they exhausted all the leads and found out as much as they could to address it before going public. Sometimes it is best to finish the investigation before public notice not to alert the bad actors. It has been three months and considering that hundreds of victims involved, it is not too long.” US national security Hillary Clinton FBI United States China South Korea Google Internet Esther Addley guardian.co.uk