The building in Shanghai that hosts the Chinese military’s Unit 61398, which has been accused of involvement in hacking attacks. Photograph: Peter Parks/AFP/Getty Images
The Chinese army has launched hundreds of cyber-attacks against western companies and defence groups from a nondescript office building in Shanghai, according to a report that warns hackers have stolen vast amounts of data from their targets.
Mandiant, a security company that has been investigating attacks against western organisations for over six years, said in a report (PDF) the attacks came from a 12-storey building belonging to the People’s Liberation Army (PLA) general staff’s department, also known as Unit 61398.
Mandiant said it believed a hacking network named the Comment Crew or the Shanghai Group was based inside the compound, in a rundown residential neighbourhood. Although the report fails directly to place the hackers inside the building, it argues there is no other logical reason why so many attacks have emanated from such a small area.
“It is time to acknowledge the threat is originating in China, and we wanted to do our part to arm and prepare security professionals to combat that threat effectively,” said the report.
The discovery will further raise the temperature in the intergovernmental cyberwars, which have heated up in recent years as the US, Israel, Iran, China and UK have all used computer subterfuge to undermine rival state or terrorist organisations. One security expert warned that companies in high-profile fields should assume they will be targeted and hacked, and build systems that will fence sensitive data off from each other.
Rik Ferguson, global vice-president of security research at the data security company Trend Micro, said: “We need to concentrate less on building castles and assuming they will be impervious, and more on building better dungeons so that when people get in they can’t get anything else.” .
Mandiant says Unit 61398 could house “hundreds or thousands” of people and has military-grade, high-speed fibre-optic connections from China Mobile, the world’s largest telecoms carrier. “The nature of Unit 61398′s work is considered by China to be a state secret; however, we believe it engages in harmful computer network operations,” Mandiant said in the report.
It said Unit 61398 had been operating since 2006, and was one of the most prolific hacking groups “in terms of quantity of information stolen”. This it estimated at hundreds of terabytes, enough for thousands of 3D designs and blueprints.
“APT1″, as Mandiant calls it, is only one of 20 groups Mandiant says has carried out scores of hacking attacks against businesses and organisations in the west, including companies that work in strategic industries such as US power and water infrastructure.
A typical attack would leave software that hid its presence from the user or administrator and silently siphon data to a remote server elsewhere on the internet at the instruction of a separate “command and control” (C&C) computer. By analysing the hidden software, the pattern of connections and links from the C&C server, the team at Mandiant said they were confident of the source of the threat.
A Chinese foreign ministry spokesman denied the government was behind the attacks, saying: “Hacking attacks are transnational and anonymous. Determining their origins is extremely difficult. We don’t know how the evidence in this so-called report can be tenable. Arbitrary criticism based on rudimentary data is irresponsible, unprofessional and not helpful in resolving the issue.”
But Ferguson told the Guardian: “This is a pretty compelling report, with evidence collected over a prolonged period of time. It points very strongly to marked Chinese involvement.”
Mandiant, based in Alexandria, Virginia, in the US, investigated the New York Times break-in, for which it suggested Chinese sources could be to blame.
President Barack Obama is already beefing up US security, introducing an executive order in his State of the Union speech this month that would let the government work with the private sector to fend off hacking. But it will take until February 2014 to have a final version ready for implementation.
The revelation comes days after the New York Times, Wall Street Journal and Washington Post, as well as the social networks Facebook and Twitter, said they had been subjected to “highly sophisticated” hacks that in some cases focused on correspondents writing about China and its government.
Separate investigations by the computer company Dell, working with the news company Bloomberg, tracked down another alleged hacker, Zhang Changhe, who has written a number of papers on PC hacking. Zhang works at the PLA’s “information engineering university” in Zhengzhou, Henan province, north-central China.
The allegations will raise the temperature in the continuing cyberwar between the west and China, which has been steadily rising since the Pentagon and MI6 uncovered Titan Rain, a scheme that tried to siphon data from the Pentagon and the House of Commons in 2006, and which one security expert said at the time dated back at least to 2004.
Ferguson suggested that western governments were also carrying out attacks against Chinese targets – “but that’s not a culture which would open up about being hit. I would be surprised and disappointed if most western nations don’t have a cybersecurity force.”
The Stuxnet virus, which hit Iran’s uranium reprocessing plant in 2010, is believed to have been written jointly by the US and Israel, while Iranian sources are believed to have hacked companies that issue email security certificates so that they can crack secure connections used by Iranian dissidents on Google’s Gmail system. China is also reckoned to have been behind the hacking of Google’s email servers in that country in late 2009, in an operation that files from WikiLeaks suggested was inspired by the Beijing government.
