Skip to main content


#China government #hackers penetrate #US #internet providers to #spy

Beijing’s hacking effort has “dramatically stepped up from where it used to be,” says fmr top US #cybersecurity ofcl.

#Chinese govt-backed hackers have penetrated deep into US ISPs in recent months to spy on their #users.

The unusually aggressive & sophisticated attacks include access to ≥2 major providers w/millions of customers as well as several smaller providers.

#InfoSec #security #geopolitics
https://www.washingtonpost.com/technology/2024/08/27/chinese-government-hackers-penetrate-us-internet-providers-spy/

reshared this

Unknown parent

Nonilex
Though there is no evidence that the new inroads are aimed at anything other than gathering #intelligence, some of the techniques & resources employed are associated w/those used in the past year by a #China-backed group known as #VoltTyphoon…. #US intelligence ofcls said that group sought access to equipment at Pacific #ports & other #infrastructure to enable China to sow #panic & #disrupt America’s ability to move #troops, #weaponry & supplies to #Taiwan if armed conflict breaks out.
#security
in reply to Nonilex

#Lumen researchers said they had identified 3 US ISPs that had been hacked this summer, one of them large, along w/another #US company & 1 in #India.

In a blog made public Tues, Lumen said the #hackers used a previously unknown vulnerability, known as a #ZeroDay flaw, in a program made by #VersaNetworks for managing wide-area networks. #Versa acknowledged the critical vulnerability late last week, warning only its direct customers.

#InfoSec #security #China #geopolitics
https://blog.lumen.com/taking-the-crossroads-the-versa-director-zero-day-exploitation/
Unknown parent

Nonilex

“This is privileged, high-level connectivity to interesting customers,” said Mike Horka, a researcher at Lumen Technologies & a fmr #FBI agent. It was notable, he added, that the groups considered the effort important enough to exploit previously undiscovered #software flaws that could have been preserved for later use.

#InfoSec #espionage #ISP #Internet #tech #cybersecurity #security #China #US #geopolitics

Unknown parent

Nonilex

#DNS manipulation is something of a specialty among Chinese govt #hacking groups. A mysterious campaign identified earlier this year by #security experts at #Infoblox & attributed to #China involved using the so-called Great #Firewall of China, which normally misdirects people on the mainland trying to reach restricted services or content.

#InfoSec #espionage #ISP #Internet #tech #cybersecurity #US #geopolitics

in reply to Nonilex

On Mon, the Santa Clara, CA-based company published a blog post about the problem, saying that it had issued a patch & that “impacted customers failed to implement system hardening & #firewall guidelines.”

#Lumen wrote that it located #malware inside #ISP routers serving certain groups or individual customers that could intercept passwords from those customers. Lumen said it believed the malicious #software was being used by #VoltTyphoon.

#InfoSec #espionage #security #China #US #geopolitics

in reply to Nonilex

In a separate report earlier this month, #security company #Volexity said it had found another high-end technique in play at a different, unnamed #ISP. In that case, it said a Chinese state #hacking group distinct from #VoltTyphoon was able to get far enough inside the service provider to alter #DNS web addresses that users were trying to reach & divert them elsewhere, allowing the #hackers to insert #backdoors for #espionage.

#InfoSec #Internet #tech #cybersecurity #China #US #geopolitics