DeepPanda still hacking
As we highlighted yesterday, Chinese state-sponsored hackers have been found to still be hacking into US corporates. Outraged editors have had a field day across most of the US popular press.Yesterday CrowdStrike, the company that found DeepPanda to still be active, attempted to calm the storm saying “we are not stating anywhere that the Chinese are violating the agreement”, pointing out that none of the twenty attacks monitored actually resulted in theft. The reality of the matter is that advanced persistent threats cannot simply be turned-off and hitting the self-destruct button might not be helpful to the bilateral accord as it would show the extent of China's infiltration: the only real hope is that the command and control centres are wound down.

Late last month, President Barack Obama and Chinese President Xi Jingping announced that they had reached an agreement that the two countries would not conduct economic espionage or hack commercial targets. But just one day later, China-based hackers attempted to breach the network of a US technology company, according to a report published today by the security firm CrowdStrike.

"Over the last three weeks, the CrowdStrike Falcon platform has detected and prevented a number of intrusions into our customers’ systems from actors we have affiliated with the Chinese government," Dimitri Alperovitch, the chief technology officer of CrowdStrike, wrote in a blog post today. "Seven of the companies are firms in the Technology or Pharmaceuticals sectors, where the primary benefit of the intrusions seems clearly aligned to facilitate theft of intellectual property and trade secrets, rather than to conduct traditional national-security related intelligence collection, which the Cyber agreement does not prohibit."

The White House fact sheet on the summary of agreements made during President Xi's visit states, "The United States and China agree that neither country’s government will conduct or knowingly support cyber-enabled theft of intellectual property, including trade secrets or other confidential business information, with the intent of providing competitive advantages to companies or commercial sectors."

CrowdStrike investigators linked the attempted intrusions—which did not succeed—to Deep Panda, the alleged hacking group tied to the vast data breach at the Office of Personnel Management earlier this year. The Chinese government has denied ties to the group in the past. But investigators at CrowdStrike, other security companies, and within the US government believe that Deep Panda works on behalf of the Chinese government—if not with its direct instruction or blessing.

Advertisement

The attacks presented in CrowdStrike's report are "not an exhaustive list of all the intrusions from Chinese-government affiliated actors we have detected during this time period," Alperovitch noted, but "is limited only to commercial entities that fit squarely within the hacking prohibitions covered under the Cyber agreement. The intrusion attempts are continuing to this day, with many of the China-affiliated actors persistently attempting to regain access to victim networks even in the face of repeated failures."

An unnamed White House official told The Wall Street Journal that the administration was aware of the report and would not comment on its findings, other than to note, "We have and will continue to directly raise our concerns regarding cybersecurity with the Chinese."

The Chinese embassy did not respond to a request for comment.

It's not clear how far the two governments have advanced implementation of the agreement, which includes the creation of a "high-level joint dialogue mechanism on fighting cyber crime and related issues." China is to designate "an official at the ministerial level" to be the lead in the joint effort from the China side and communicate directly with the US Secretary of Homeland Security and the US Attorney General. That official has not yet been named.

Alperovitch acknowledged that "the fact that there is some time delay between agreement and execution is not entirely unexpected. But, we need to know the parameters for success, and whether the parties to the agreement discussed a timeframe for implementation or, instead, expected it to be immediate." He also praised the Obama administration for its efforts to curb the volume of Chinese attacks on corporate networks.