Com­ment: a “broad” new hack­ing attack, involv­ing Chi­na but cen­tered in Ger­many, has pen­e­trat­ed the data­bas­es of numer­ous cor­po­ra­tions. In FTR #699, we exam­ined Ger­man anx­i­ety about U.S. cozi­ness with Chi­na. Fol­low­ing the hack­ing attack (ear­li­er this year) on Google, among oth­er firms, rela­tions between the U.S. and Chi­na became strained. Oba­ma is now meet­ing with the Dalai Lama, whose coun­sel he had pre­vi­ous­ly shunned.

Might the hack­ing attacks have been a Ger­man gam­bit to effect dis­tance between the U.S. and the Peo­ple’s Repub­lic of Chi­na?

“Broad New Hack­ing Attack Detect­ed” by Siob­han Gor­man; Wall Street Jour­nal; 2/18/2010.

Hack­ers in Europe and Chi­na suc­cess­ful­ly broke into com­put­ers at near­ly 2,500 com­pa­nies and gov­ern­ment agen­cies over the last 18 months in a coor­di­nat­ed glob­al attack that exposed vast amounts of per­son­al and cor­po­rate secrets to theft, accord­ing to a com­put­er-secu­ri­ty com­pa­ny that dis­cov­ered the breach.

A glob­al hack­ing offen­sive has bro­ken into U.S. com­pa­nies and gov­ern­ment agen­cies. Cyber attacks could soon be seen as a nation­al secu­ri­ty threat, WSJ exec­u­tive edi­tor Jer­ry Seib tells the News Hub.

The dam­age from the lat­est cyber­at­tack is still being assessed, and affect­ed com­pa­nies are still being noti­fied. But data com­piled by NetWit­ness, the close­ly held firm that dis­cov­ered the breach­es, showed that hack­ers gained access to a wide array of data at 2,411 com­pa­nies, from cred­it-card trans­ac­tions to intel­lec­tu­al prop­er­ty.

The hack­ing oper­a­tion, the lat­est of sev­er­al major hacks that have raised alarms for com­pa­nies and gov­ern­ment offi­cials, is still run­ning and it isn’t clear to what extent it has been con­tained, NetWit­ness said. Also unclear is the full amount of data stolen and how it was used. Two com­pa­nies that were infil­trat­ed, phar­ma­ceu­ti­cal giant Mer­ck & Co. and Car­di­nal Health Inc., said they had iso­lat­ed and con­tained the prob­lem.

Start­ing in late 2008, hack­ers oper­at­ing a com­mand cen­ter in Ger­many got into cor­po­rate net­works by entic­ing employ­ees to click on con­t­a­m­i­nat­ed Web sites, email attach­ments or ads pur­port­ing to clean up virus­es, NetWit­ness found.

In more than 100 cas­es, the hack­ers gained access to cor­po­rate servers that store large quan­ti­ties of busi­ness data, such as com­pa­ny files, data­bas­es and email.

They also broke into com­put­ers at 10 U.S. gov­ern­ment agen­cies. In one case, they obtained the user name and pass­word of a sol­dier’s mil­i­tary email account, NetWit­ness found. A Pen­ta­gon spokesman said the mil­i­tary did­n’t com­ment on spe­cif­ic threats or intru­sions.

At one com­pa­ny, the hack­ers gained access to a cor­po­rate serv­er used for pro­cess­ing online cred­it-card pay­ments. At oth­ers, stolen pass­words pro­vid­ed access to com­put­ers used to store and swap pro­pri­etary cor­po­rate doc­u­ments, pre­sen­ta­tions, con­tracts and even upcom­ing ver­sions of soft­ware prod­ucts, NetWit­ness said.

Data stolen from anoth­er U.S. com­pa­ny point­ed to an employ­ee’s appar­ent involve­ment in crim­i­nal activ­i­ties; author­i­ties have been called in to inves­ti­gate, NetWit­ness said. Crim­i­nal groups have used such infor­ma­tion to extort sen­si­tive infor­ma­tion from employ­ees in the past.

The spy­ware used in this attack allows hack­ers to con­trol com­put­ers remote­ly, said Amit Yoran, chief exec­u­tive of NetWit­ness. NetWit­ness engi­neer Alex Cox said he uncov­ered the scheme Jan. 26 while installing tech­nol­o­gy for a large cor­po­ra­tion to hunt for cyber­at­tacks.

That dis­cov­ery points to the grow­ing num­ber of attacks in recent years that have draft­ed com­put­ers into cyber armies known as botnets—intrusions not blocked by stan­dard antivirus soft­ware. Researchers esti­mate mil­lions of com­put­ers are con­script­ed into these armies.

“It high­lights the weak­ness­es in cyber secu­ri­ty right now,” said Adam Mey­ers, a senior engi­neer at gov­ern­ment con­trac­tor SRA Inter­na­tion­al Inc. who reviewed the NetWit­ness data. “If you’re a For­tune 500 com­pa­ny or a gov­ern­ment agency or a home DSL user, you could be suc­cess­ful­ly vic­tim­ized.”

Dis­clo­sure of the attack comes on the heels of Google Inc.‘s alle­ga­tion that it and more than 20 oth­er com­pa­nies were breached by Chi­nese hack­ers. This oper­a­tion appears to be more far-reach­ing, infil­trat­ing some 75,000 com­put­ers and touch­ing 196 coun­tries. The high­est con­cen­tra­tions of infect­ed com­put­ers are in Egypt, Mex­i­co, Sau­di Ara­bia, Turkey and the U.S.

NetWit­ness, based in Hern­don, Va., said it was shar­ing infor­ma­tion with the com­pa­nies infect­ed. Mr. Yoran declined to name them. The com­pa­ny pro­vides com­put­er secu­ri­ty for U.S. gov­ern­ment agen­cies and com­pa­nies. Mr. Yoran is a for­mer Air Force offi­cer who also served as cyber secu­ri­ty chief at the Depart­ment of Home­land Secu­ri­ty.

Besides Mer­ck and Car­di­nal Health, peo­ple famil­iar with the attack named sev­er­al oth­er com­pa­nies infil­trat­ed, includ­ing Para­mount Pic­tures and soft­ware com­pa­ny Juniper Net­works Inc.

Mer­ck said in a state­ment that one com­put­er had been infect­ed. It said it had iso­lat­ed the attack and that “no sen­si­tive infor­ma­tion was com­pro­mised.”

Car­di­nal said it removed the infect­ed com­put­er from its net­work. Para­mount declined to com­ment. Juniper’s secu­ri­ty chief, Bar­ry Greene, would­n’t speak about any spe­cif­ic inci­dents but said the com­pa­ny worked aggres­sive­ly to counter infec­tions.

NetWit­ness, which does exten­sive work for the U.S. gov­ern­ment and pri­vate-sec­tor clients, said it was shar­ing its infor­ma­tion with the Fed­er­al Bureau of Inves­ti­ga­tion. The FBI said it received numer­ous alle­ga­tions about poten­tial com­pro­mis­es of net­work sys­tems and respond­ed prompt­ly, in coor­di­na­tion with law-enforce­ment part­ners.

The com­put­ers were infect­ed with spy­ware called ZeuS, which is avail­able free on the Inter­net in its basic form. It works with the Fire­Fox brows­er, accord­ing to com­put­er-secu­ri­ty firm Secure­Works. This ver­sion includ­ed a $2,000 fea­ture that works with Fire­Fox, accord­ing to Secure­Works.

Evi­dence sug­gests an East­ern Euro­pean crim­i­nal group is behind the oper­a­tion, like­ly using some com­put­ers in Chi­na because it’s eas­i­er to oper­ate there with­out being caught, said NetWit­ness’s Mr. Yoran.

There are some elec­tron­ic fin­ger­prints sug­gest­ing the same group was behind a recent effort to dupe gov­ern­ment offi­cials and oth­ers into down­load­ing spy­ware via emails pur­port­ing to be from the Nation­al Secu­ri­ty Agency and the U.S. mil­i­tary, NetWit­ness’s Mr. Yoran said.

That attack was described in a Feb. 5 report from the Depart­ment of Home­land Secu­ri­ty, which said it was issu­ing an alert to the gov­ern­ment and oth­er orga­ni­za­tions to “pre­vent fur­ther com­pro­mis­es.”

A DHS offi­cial said that ZeuS was among the top five report­ed tools for mal­ware infec­tions.