New York Times computer network breached by Chinese hackers, paper says
The computers of 53 employees were accessed and several email accounts were compromised, the paper reported
IDG News Service - Hackers from China breached the computer network of The New York Times and stole passwords that allowed them to gain access to computers and email accounts for a period of four months, the newspaper reported late Wednesday.
The initial intrusion happened sometime around Sept. 13 while the Times reporters were working on a story about the multibillion-dollar fortune accumulated by relatives of China's Prime Minister Wen Jiabao, the Times report said.
It's not clear how hackers originally gained access to the Times' network, but computer forensics experts from IT security firm Mandiant, which was contracted to investigate the incident, believe that the organization's employees might have been targeted via spear phishing -- an attack technique that involves sending specifically crafted email messages with malicious links or attachments.
The hackers' activity on the network increased after the story about the Chinese prime minister's relatives and their wealth was published in late October, the Times said. The newspaper was aware of warnings from Chinese officials that investigating Wen's relatives would have consequences, the Times said.
AT&T was asked by the Times to monitor its computer network for suspicious activity and started seeing behavior consistent with cyberattacks believed to be associated with the Chinese military on Oct. 25. After learning of this activity, the Times briefed the FBI and tried to eliminate the attackers from its systems.
However, on Nov. 7 it became clear that the hackers still had a foothold on some of the systems and the newspaper contracted Mandiant. This marked the beginning of a larger investigation that involved monitoring how the attackers moved around the network for several months in order to learn their habits and discover all backdoors they might have installed.
The Mandiant investigators established that the hackers had stole usernames and password hashes for all Times employees from the network's domain controller and used them to gain access to the computers of 53 employees.
The hackers were also able to access the email accounts of David Barboza, the Times' Shanghai bureau chief who wrote the story about Wen Jiabao's relatives, and Jim Yardley, the Times' South Asia bureau chief in India.
The main target of the attackers appears to have been Barboza's email correspondence and documents related to the investigation he performed for that story, the Times report said. Marc Frons, the Times' chief information office, said that the hackers could have wreaked havoc on the organization's systems, but they were not interested in doing that.
Mandiant's investigators believe the attackers are part of a known Chinese hacker group specialized in APT (advanced persistent threat) attacks that previously targeted other Western organizations and American military contractors. The group routed their attacks through compromised computers owned by universities in North Carolina, Arizona, Wisconsin and New Mexico, as well as computers owned by small U.S. companies and Internet service providers.
- Step Out of the Bull's-Eye Learn about the evolution of targeted attacks, the latest in security intelligence, and strategic steps to keep your business safe.
- Using Cyber Insurance and Cybercrime Data to Limit Your Business Risk This paper examines the challenges of understanding cyber risks, the importance of having the right cyber risk intelligence, and how to use this...
- 5 Tips to Secure Small Business Backdoors in the Enterprise Supply Chain This paper examines the insecurity of the small businesses in the supply chain and offers tips to close those backdoors into the enterprise.
- Comprehensive Advanced Threat Defense The hot topic in the information security industry these days is "Advanced Threat Defense" (ATD). This paper describes a comprehensive, network-based approach to...
- Live Webcast Security Vulnerabilities Associated With Having Local Administrator Privileges Viewfinity will demonstrate how removing admin rights and granularly managing privileges at the application level reduces the attack surface.
- Security Vulnerabilities Associated With Having Local Administrator Privileges Viewfinity will demonstrate how removing admin rights and granularly managing privileges at the application level reduces the attack surface.
- Keep Servers Up and Running and Attackers in the Dark An SSL/TLS handshake requires at least 10 times more processing power on a server than on the client. SSL renegotiation attacks can readily... All Cybercrime and Hacking White Papers | Webcasts