Global EditionASIA 中文双语Français
China
Home / China / Society

US hacked sensitive China telecom networks

By CUI JIA | chinadaily.com.cn | Updated: 2022-09-27 23:42
Share
Share - WeChat
[Photo/VCG]

The United States National Security Agency gained access to China's telecommunications networks and made inquiries about a number of people with sensitive backgrounds, leading to some of their information being leaked, according to an investigation report on a cyberattack at a prominent Chinese public research university.

On June 22, Northwestern Polytechnical University, in Xi'an, Shaanxi province, which is known for its education and research programs in aeronautics, astronautics and marine technology engineering, announced that overseas hackers had been caught sending phishing emails with Trojan horse programs to teachers and students at the university in an attempt to steal their data and personal information.

The report, released on Tuesday, said that while retracing the technical features, attack weapons and paths used in the NSA cyberattack on Northwestern Polytechnical University, analysts discovered that the NSA's Office of Tailored Access Operation had infiltrated the networks of at least two telecommunication operators in China and built a "legitimate" channel for remote access to the core data.

The office then made inquiries about a number of people with sensitive backgrounds. Some of their information was sent back to the NSA headquarters via multiple jump servers, according to the report released by China's National Computer Virus Emergency Response Center and internet security company 360.

With support from partners in European and Southeast Asian countries, analysts discovered that the office has also infiltrated the telecommunications networks of at least 80 countries using the same cyberattack weapons.

The report detailed the process of the office's infiltration of the university's internal network. First, it used "FoxAcid", an intermediate attack platform, to hack into the university's internal host computer and servers, and then gained control over several key servers with remote control weapons. It controlled some important network node equipment, including the university's internal routers and switches, and stole authentication data.

Hiding in the university's operations and maintenance servers, the office stole several configuration files of network equipment that it used to "validly" monitor network equipment and internet users, according to the report.

Of the 41 types of tools used in the particular attack, 16 are identical to the office's weapons that have been exposed by the hacker group "Shadow Brokers", and 23 have a 97 percent structural similarity with those deployed by the office. Also, the remaining two types have to be used in conjunction with other cyberattack weapons from the office, it said.

The identities of 13 hackers who carried out the attack have been discovered. Their working hours, language used and behavior habits have also exposed their links with the office, the report added.

Top
BACK TO THE TOP
English
Copyright 1995 - . All rights reserved. The content (including but not limited to text, photo, multimedia information, etc) published in this site belongs to China Daily Information Co (CDIC). Without written authorization from CDIC, such content shall not be republished or used in any form. Note: Browsers with 1024*768 or higher resolution are suggested for this site.
License for publishing multimedia online 0108263

Registration Number: 130349
FOLLOW US