[ad_1]
A cyber-espionage campaign blamed on China was more sweeping than previously thought, with suspected state-backed hackers operating a device meant to bolster internet security to break into the computers of critical US entities .
Among the suspected targets was the Metropolitan Water District in Southern California, which supplies water to 19 million people and operates some of the largest treatment plants in the world.
The Pulse Connect Secure network device hack was revealed in April, but its scope isn’t starting to become clear until now. The Associated Press has learned that the hackers are targeting telecommunications giant Verizon, and security analysts say dozens of other high-value entities that have yet to be named have also been targeted in connection with the violation of Pulse Secure, which is used by many businesses and governments. for secure remote access to their networks. News broke earlier this month that New York’s subway system, the country’s largest, had been breached.
MWD said it found a compromised Pulse Secure device after an alert about the hacking campaign was issued in April by the Department of Homeland Security’s Cybersecurity & Infrastructure Security Agency, or CISA. MWD spokesperson Rebecca Kimitch said the compromised device was immediately taken out of service and none of the agency’s systems or processes were affected.
Kimitch said there had been no known data exfiltration.
It is not known what sensitive information, if any, was accessed as part of the widespread hacking campaign, which security analysts said targeted targets in several areas, including finance, technology and defense companies. , as well as municipal governments. Some targets were in Europe, but most were in the United States
The Chinese government has denied any role in the Pulse Secure hacking campaign, and the U.S. government has made no formal attribution. The new details of the hack come amid growing tension between Washington and Beijing. Biden has made verifying China’s growing influence a top priority, including during his current tour to meet with European and NATO leaders, and said the country’s ambition to become the nation’s top nation. richest and most powerful in the world would not come true under my watch.
Some of the targets of the Pulse Secure hack said they saw no evidence of data theft. This uncertainty is common in cyber espionage, and it can take months to determine the loss of data, if ever it is discovered. Ivanti, the owner of Utah-based Pulse Connect Secure, declined to comment on affected customers.
Even if sensitive information was not compromised, experts say it is worrying that hackers have managed to gain a foothold in networks of critical organizations whose secrets may be of interest to China for trade and national security reasons.
Threat actors were able to gain access to high-profile organizations, some very well-protected, said Charles Carmakal, chief technology officer of Mandiant, whose company first announced the hacking campaign in April.
The Pulse Secure hack went largely unnoticed as a series of headline-grabbing ransomware attacks exposed cyber vulnerabilities in U.S. critical infrastructure, including one on a major fuel pipeline that triggered widespread shortages at gas stations. The US government is also still investigating the fallout from the SolarWinds hacking campaign launched by Russian cyber-spies, which infiltrated dozens of private companies and think tanks as well as at least nine US government agencies and left behind. continued for most of 2020.
China has a long history of using the Internet to spy on the United States and presents a prolific and effective cyber-espionage threat, the Office of the Director of National Intelligence said in its latest annual threat assessment.
Six years ago, Chinese hackers stole millions of federal government employee background check files from the Bureau of Personnel Management. Last year, the Justice Department indicted two hackers who it said worked with the Chinese government to target companies developing COVID-19 vaccines and stole hundreds of millions of dollars in intellectual property and trade secrets to companies around the world.
In the Pulse Secure campaign, security experts said sophisticated hackers were exploiting never-before-seen vulnerabilities to break in and were extremely diligent in trying to cover their tracks once inside.
The capacity is very strong and difficult to defend, and the profile of the victims is very important, said Adrian Nish, cyber manager at BAE Systems Applied Intelligence. This is a very targeted attack against a few dozen networks that are all of national importance in one way or another.
In its April hack alert, cybersecurity agency CISA said it was aware of compromises affecting a number of US government agencies, critical infrastructure entities and other industry organizations. private. The agency has since said that at least five federal agencies have identified signs of potential unauthorized access, but it has not named the five.
Verizon said it found a Pulse-related compromise in one of its labs, but was quickly isolated from its core networks. The company said no customer data or information was accessed or stolen.
We know the bad actors are trying to compromise our systems, Verizon spokesperson Rich Young said. This is why internet operators, private companies and all individuals must be vigilant in this space.
Get the latest Los Angeles Times news, surveys, analysis and more signature journalism delivered to your inbox.
Enter e-mail address
Sign me up
You may occasionally receive promotional content from the Los Angeles Times.
New York’s Metropolitan Transportation Authority said it had found no evidence that valuable data or customer information was stolen. This violation was first reported by The New York Times.
Nish, BAE’s security expert, said hackers could have broken into networks but not immediately stolen data for a number of operational reasons. He compared it to a criminal breaking into a house but stopping in the hallway.
It’s still bad enough, Nish said.
Mandiant said he found signs of data mining on some of the targets.
At least one large local government has disputed that it was the target of the Pulse Secure hack. Montgomery County, Maryland, said it was informed by CISA that its Pulse Secure devices had been attacked. But county spokesman Scott Peterson said the county had found no evidence of a compromise and told CISA it was a bogus report.
CISA did not respond directly to the county’s statement.
[ad_2]
picture credit