Chinese Hackers

[kyonides]

FBI Director: China Considers Vital U.S. Infrastructure ‘Fair Game’ for Cyberattacks

FBI director Chris Wray said at a security conference on Thursday that China’s legion of state-sponsored hackers “considers every sector that makes our society run as fair game in its bid to dominate on the world stage.”

Wray said China’s plan is to “land low blows against civilian infrastructure to try to induce panic and break America’s will to resist.”

The FBI director was speaking at security conference called “Summit on Modern Conflict and Emerging Threats,” hosted by Vanderbilt University in Nashville. The 2024 edition of the summit was focused on “challenges China poses to the United States,” ranging from China’s dominance of critical supply chains to the fentanyl epidemic and cyberwar.

Wray called the audience’s attention to Volt Typhoon, the massive hacking operation linked to the People’s Republic of China (PRC) that penetrated an alarming number of critical infrastructure systems in the U.S., including water, power, oil, and transportation.

Volt Typhoon was detected and exposed by Microsoft cybersecurity technicians in May 2023. Microsoft said China’s state-sponsored hackers sought to develop “capabilities that could disrupt critical communications infrastructure between the United States and Asia region during future crises.”

Wray noted that China-sponsored hackers were “pre-positioned for potential cyberattacks against U.S. oil and natural gas companies way back in 2011.”

“When one victim company set up a honeypot – essentially, a trap designed to look like a legitimate part of a computer network with decoy documents – it took the hackers all of 15 minutes to steal data related to the control and monitoring systems,” he recalled.

Wray pointed out that in that incident, the hackers ignored “financial and business-related information,” which suggests “their goals were even more sinister than stealing a leg up economically.”

Honeypot systems are usually hardened to make cracking their core software extremely difficult, but the designers then camouflage the system to look much more vulnerable than it really is. A honeypot is a setup, and its administrators know they will be invaded, so for the invaders to quickly defeat the trap and penetrate the security of the rigged system is a remarkable achievement.

Volt Typhoon was a menacing example of a hacking technique known as “living off the land,” in which the hackers penetrate systems, deposit malware payloads, and then conceal their presence by exploiting and imitating normal system functions. The approach could be compared to a thief who takes a job as a bank teller and quietly works there for years before finally deciding to rob the bank.

“Living off the land” is an alarming tactic because most private hacker groups would not bother to hide for years after penetrating a system. Hackers are usually motivated to steal, vandalize, or hijack a system fairly soon after they gain entry, worried that their presence could be detected or their access to the system might be cut. They are typically eager to steal data for fun or profit.

As Wray explained at the Vanderbilt seminar, the major reason a group of highly skilled and coordinated hackers would lurk in a system for years is because they are planning massive acts of sabotage and waiting for their government handlers to tell them when the time is right to strike.

Wray said the Chinese Communist Party is driven by “aspirations to wealth and power,” which it hopes to realize by seizing control of “economic development in the areas most critical to tomorrow’s economy.”

Other speakers at the seminar highlighted Volt Typhoon as a new and dangerous type of cyberwar menace, including Gen. Timothy Haugh, head of the National Security Agency (NSA) and U.S. Cyber Command.

“What you see in Volt Typhoon is an example of how China has approached establishing access to put things under threat. There is not a valid intelligence reason to be looking at a water treatment plant from a cyber perspective,” he pointed out.

Haugh warned that Volt Typhoon sent “a pretty loud signal” about how China plans to “use cyberspace in a crisis,” such as a confrontation with the U.S. over Taiwan. He strongly recommended listening to that signal.