China successfully identifies individuals within the NSA responsible for launching a cyberattack on Northwestern Polytechnical University, shedding light on state-sponsored cyber espionage activities.
Beijing, China: In a significant development during the investigation into the cyberattack on Northwestern Polytechnical University (NPU), a leading Chinese aviation institution, China has successfully extracted multiple samples of spyware named SecondDate. Collaborating with partners from various countries, Chinese authorities have unveiled the true identities of the National Security Agency (NSA) personnel responsible for orchestrating the cyberattack, as reported by the National Computer Virus Emergency Response Center (CVERC) and Chinese internet security company 360.
NPU had publicly disclosed in June 2022 that it had fallen victim to a cyberattack orchestrated by an overseas hacker organization, targeting sensitive data.
China’s investigative efforts uncovered that the Office of Tailored Access Operations (TAO), operating under the Data Reconnaissance Bureau of the NSA’s Information Department, was the mastermind behind the cyberattack on NPU. SecondDate, a cyber weapon developed by the NSA, was identified as the spyware used in the attack. This sophisticated tool is typically deployed on network boundary devices like gateways, firewalls, and edge routers, covertly monitoring cyber traffic and, when necessary, redirecting, intercepting, and manipulating specific network sessions.
The investigation, led by CVERC and 360, yielded crucial samples of the spyware, revealing its highly advanced nature. Experts believe that the developers of this espionage tool possess an in-depth understanding of cyber technology, particularly network firewall technology. It essentially installs content-filtering firewalls and proxy servers on target network devices, granting attackers complete control over these devices and the network traffic passing through them. This control enables long-term data theft from other hosts and users within the targeted network and serves as a “forward base” for launching further cyberattacks.
SecondDate is typically used in conjunction with various firewall and router vulnerability exploitation tools developed by TAO. Following the successful exploitation of vulnerabilities and acquisition of permissions, it is implanted into the target device. The spyware is divided into server-side and control-side components. The server-side is deployed on target network boundary devices and continuously monitors and filters traffic through underlying drivers. The control-side activates the mechanism by sending specially crafted packets, prompting the server-side to initiate connections and execute man-in-the-middle attacks as needed.
The spyware uses the UDP protocol for network connections and employs encryption throughout the communication process, with randomized communication ports. The control-side can remotely configure the server-side’s operational mode and the target for hijacking.
The joint investigative efforts conducted by China and its industry partners extended globally, revealing hidden spyware and derivative versions in thousands of network devices across multiple countries and regions. Additionally, jump servers remotely controlled by the NSA were identified in countries such as Germany, Japan, South Korea, India, and Taiwan, China.
“Cybersecurity is a global issue that calls for a concerted response. Safeguarding cybersecurity is the common responsibility of all countries,” stated Chinese Foreign Ministry spokesperson Mao Ning. He emphasized China’s commitment to cybersecurity and highlighted its role in proposing the Global Initiative on Data Security, contributing to global digital governance, and seeking a peaceful, secure, open, cooperative, and orderly cyberspace.
The successful extraction of spyware samples and the identification of NSA personnel involved in the cyberattack underscore China’s determination to thwart US government-backed cyberattacks and protect global cybersecurity. By disclosing details of state-sponsored hacking activities, China aims to raise awareness, identify threats, and resist cyberattacks. The revelation of the individuals behind the NSA’s cyberattacks is expected to draw international attention to the indiscriminate cyber offensive actions of the US government.
Mao further emphasized the Chinese government’s commitment to cybersecurity and data security, citing the rollout of laws and regulations aimed at enhancing personal information protection. The ongoing 2023 China Cybersecurity Week signifies the government’s dedication to strengthening cybersecurity and raising public awareness on this vital issue.