Foreign infiltrations of U.S. businesses
We've heard a lot lately about overseas hacking attempts that are increasingly targeting businesses or even political entities. Cases in point: Infiltration attempts against Google and McAfee that are believed to have come from Vietnamese hackers, and reports of Chinese hackers targeting confidential information from India's government and from the Dalai Lama's email systems.
Today, I've been perusing a new report from the Defense Security Service (DSS), and if you've been thinking espionage ended with the Cold War and exists today only in James Bond movies, think again! This report looks at how espionage -- either through human contact or through technology infiltrations -- is targeting U.S. Defense Department contractors, especially in regards to new technology related to UAVs (unmanned aerial vehicles). You can now download the report (14 Mb PDF file) from SecurityInfoWatch.com's whitepapers page.
One of the key points about technology infiltration of cleared defense contractors that the DSS makes is the following:
"Facilitated by ever increasing world wide connectivity, the ease of inundating industry with overt email requests and webpage submissions made direct requests a premier vehicle for solicitation and/or collection. While not all direct requests for information or services represent organized collection attempts, exploitation of this medium provides collectors an efficient, low-cost, high-gain opportunity to acquire classified or restricted information."
One of the things we've heard in the attacks on Google and others is that the governments are saying, "It's not us...it's just individuals in our country who are targeting you." That patterns well with what the DSS says about a shifting focus of who's trying to collect information from defense contractors:
"Aggressive collection attempts by commercial actors continued to surge. In FY08, commercial entities attempted to collect defense technology at a rate nearly double that of governmental or individual collector affiliations. This trend likely represents a purposeful attempt to make the contacts seem more innocuous, shifting focus from government collectors to commercial or non-traditional entities."
So, the point is that the espionage is being pushed out into the commercial arena, rather than from traditional government spies. But how involved are the governments, really? Are they facilitating commercial contact for espionage purposes? It's a question that we'll likely never have answered, and if they are doing that, it gives them plausible deniability. With that deniability, they can say "It's just businesses in our countries that are doing this; our government isn't involved at all." Of course, with the privatization of defense technology work around the world, it's truly possible this is really more about commercial/corporate espionage rather than political espionage, but with the close working relationships between foreign governments and their contractors, I'd find it hard to believe there is not some amount of back-channel government tie-in to these incidents.
One thing is for sure: We are just seeing the tip of the iceberg in this area. Espionage is growing more sophisticated by the year. The era of khaki rain coats and dropped briefcases is turning into an era of business meetings with dubious intentions and late-night password hacks.
In other news:
G4S name change, enterprise security risk management, ONVIF access control, smoking in the boy's room