2009 Security threat report: State-sponsored cybercrime

Digital espionage increasing

Countries spy on each other for political, commercial and military advantage and it would be naive to think they do not take advantage of computers and the internet to help them do so.

During 2007 it became common for countries to openly accuse each other of engaging in spying via the internet, such as the Chinese military being blamed for a cyberattack on a Pentagon computer system in September of that year48, for example. Concern about state-sponsored cybercrime climaxed at the end of 2007 with the discovery that MI5, the British Security Service, had written to 300 chief executives and security chiefs at UK companies warning
them of the “electronic espionage attack”.

2008 saw even more reports of alleged governmentsponsored cybercrime. Even though it can be extraordinarily difficult to prove an attack has been endorsed by a state, 2009 is likely to bring more claims of countries attacking and spying on each other via the internet.

• April 2008. Der Spiegel reported that the BND – Germany’s foreign intelligence service – used spyware to monitor the Ministry of Commerce and Industry in Afghanistan49. Confidential documents, passwords and email communications were reportedly compromised by German spies, and sent to the BND’s headquarters. This news followed revelations that the BND had intercepted emails between Spiegel journalist Susanne Koelbl and Afghanistan’s Commerce Minister Amin Farhang, resulting in a diplomatic row between the countries.
• May 2008. Senior Indian government officials in New Delhi were said to have confirmed that Chinese hackers targeted the Ministry of External Affairs and the National Informatics Centre50, which provides the network backbone for central and state government, as well as other administrative bodies in India. The unnamed officials were quoted as saying that this was China’s way of gaining “an asymmetrical advantage” over a potential adversary.
• May 2008. Belgium also accused the Chinese government of cyber-espionage, claiming that hacking attacks against the Belgian Federal Government had originated in China, and were likely to have been at the behest of the Beijing government51. Separately, the Belgian Minister of Foreign Affairs told parliament that his ministry had been the subject of cyber-espionage by Chinese agents several weeks before.
• August 2008. As tensions rose over South Ossetia, Russian and Georgian hackers launched attacks against each other52. Examples include a distributed denial of service attack against the website of the South Ossetian government and the defacement of the Georgian Ministry of Foreign Affairs website with a collage of pictures of Georgian president Mikheil Saakashvili and Adolf Hitler53.
• September 2008. Seoul accused its adversaries in North Korea of stealing documents from military officers through the use of spyware and a female agent54. The spyware attack took the form of a malicious email attachment designed to steal documents from infected computers. The email addresses were supplied by 35-year-old Won Jeong Hwa.

Sophos.com