Hacking group previously linked to hacks on US defence contractors steals detailed missile schematics
A Chinese hacking group has been accused of stealing data from Israel’s billion-dollar Iron Dome missile system.
The state-sponsored Comment Crew hacking group, thought to operate out of China, was responsible for attacks from 2011 onwards on three Israeli defence technology companies Elisra Group, Israel Aerospace Industries (IAI) and Rafael Advanced Defense Systems (Rads) all involved with the Iron Dome project.
The Iron Dome is Israel’s advanced anti-missile defence system – part funded to the tune of $1bn by the US government. It fires missiles to intercept rockets and artillery shells fired from between 2.5 miles and 43 miles away into populated areas, commonly described as a missile shield.
The revelation comes as cyber attacks against Israel have intensified during its current conflict with Palestine, including recent attacks defacing Israel Railways and hospital websites and denial of service attacks which slow Israeli’s internet connections, according to Dina Beer, managing director of the Israeli Internet Association, talking to Bloomberg.
'We transferred this technology to them, and they coughed it all up'
The hacks occurred between 10 October 2011 and 13 August 2012, according to security firm Cyber Engineering Services (CES), talking toindependent security researcher Brian Krebs, which tapped into the secret communications of the hackers and discovered that they had stolen over 700 files from IAI.
CES said that the majority of the data was intellectual property and that the 700 files likely represented only a small proportion of the data stolen from the three defence companies.
Among the documents stolen from IAI were detailed schematics and specifications for the US-designedArrow 3 missile, which is restricted under the International Traffic in Arms Regulations and a key component of Iron Dome, as well as drones and other rockets.
“Most of the technology in the Arrow 3 wasn’t designed by Israel, but by Boeing and other US defence contractors,” Joseph Drissel, founder and chief executive of US-based CES, told Krebs. “We transferred this technology to them, and they coughed it all up. In the process, they essentially gave up a bunch of stuff that’s probably being used in our systems as well.”
'The information was reported to the appropriate authorities'
The hackers had access to the corporate networks to some of the Israeli defence companies for over a year, and stole confidential emails from top executives at the companies.
An IAI spokeswoman brushed off the hacking allegations as “old news”.
“At the time, the issue was treated as required by the applicable rules and procedures,” IAI’s Eliana Fishler told Krebs. “The information was reported to the appropriate authorities. IAI undertook corrective actions in order to prevent such incidents in the future.”
Meanwhile Rafael Advanced Defense Systems denied knowledge of the attacks.
"Rafael does not recall such an incident," said Amit Zimmer, corporate spokesperson for Rads told the Guardian. "Rafael's data bases, including its air defence data bases, are extremely well protected to the highest standards."
“The real victims here are the people on the other end who are put in harm’s way because of poor posture on security and the lack of urgency coming from a lot of folks on how to fix this problem,” said Drissel. “So many companies have become accustomed to low-budget IT costs. But the reality is that if you have certain sensitive information, you’ve got to spend a certain amount of money to secure it.”
The CES report on the attacks has not yet been publicly released, but the Comment Crew is thought to be associated with the Chinese People’s Liberation Army (PLA), which was accused of stealing large amounts of data from US defence companies.
People’s Liberation Army Unit 61398
Security firm Mandiant identified the Comment Crew as PLA unit 61398 in February 2013, while the United States Department of Justice charged five members of the hacking group with various cybercrime and espionage offences in May.
China is not the only country attacking Israeli through cyber channels. Israel counted 44m attacks on government sites during Israel's eight-day conflict with Hamas in 2012, with the majority originating from Palestinian territory.
'It’s terrorism, designed mostly to frighten'
Social media feeds and websites of news organisations have also been hit, including a TV channel that was hacked to display a Hebrew message in July urging Israeli mothers to call their sons home from the country’s military or see them killed or captured.
Domino's Israel had its Facebook page taken over by hackers posting messages, including one that stated that, “today will strike deep in Israel, Tel Aviv, Haifa, Jerusalem, Ashkelon, Ashdod more than 2000 rockets. We’ll start at 7. Counting back towards the end of Israel … Be warned!”
“The attacks aren’t sophisticated; they just give the feeling that someone else is in control,” said Beer. “It’s terrorism, designed mostly to frighten: ‘See, we can control your sites and do things you don’t want us to do.’ And it works.”
Elisra Group had not responded to comment at the time of publication.
No comments:
Post a Comment