US Vs. China - A Different Kind of Cyberwar

The potential for cyberwarfare between the United States and Russia is openly discussed and, if not actually defined, is well understood.  But few people talk about China and cyberwar. The reason is simple. China is already engaged in its own form of cyberwarfare, but one that does not readily fit into the West’s perception of war and peace. 

China, the world’s oldest surviving civilization, is taking the long view which, it always tends to do. It has no interest in winning short-term battles; its focus is on winning the long-term war.

The USSR was not defeated by the might of the US military, but the power of the US economy. In striving to keep up or surpass the military strength of the West, the USSR was effectively bankrupted into dissolution. China sees a greater likelihood of success against the West by similar means than by open warfare, whether that be kinetic or cyber.
In front of the same Senate Judiciary Committee, assistant attorney general John Demers described the Chinese economic policy as ‘rob, replicate, and replace’. “The playbook is simple,” he said. “Rob the American company of its intellectual property. Replicate the technology. And replace the American company in the Chinese market and one day in the global market.”

It has been alleged that this playbook is visible in the histories of Canadian telecommunications company Nortel and China firm Huawei. Nortel had been a successful global company. But in 2004, senior security adviser Brian Shields discovered Nortel’s systems had been comprehensively hacked. This started in 2000 and continued for ten years.

Shields believes the hacking was undertaken by Chinese government hackers on behalf of Huawei. “This kind of thing is not done by just average hackers. I believe this is nation-state activity," he later said. 

There is no proof that Huawei was involved in or profited from the Nortel hacks. The fact remains, however, that Huawei rapidly prospered on the world stage while Nortel declined and filed for bankruptcy protection in January 2009. If Shield’s suspicions are correct, this would be a perfect example of ‘rob, replicate, and replace’.

The China version of Cyberwar
The battle for economic supremacy is primarily if not entirely being fought in cyber. Given the West’s promise of retaliation for anything that meets its definition of cyberwarfare, China is largely avoiding the sort of destructive activity more usually ascribed to Russia, such as the attack on France’s TV5Monde and Ukrainian power companies, and North Korea’s attack on Sony, and WannaCry.

Since the aim is economic supremacy, and since the state controls everything that is done in China, it would be reasonably accurate to describe Chinese cyber activity as different aspects of a single overall campaign motivated and controlled by China Inc. To defend against this campaign, it is important to understand how China seeks to advance its economy, and how effective Chinese hackers have become.

Understanding China Inc and its cyber priorities is an important first step in defending against Chinese cyberattacks. This requires an understanding of the legal framework underlying China’s approach to cyber operations, the quality of Chinese cyber operators, and the targets and reasons for specific cyber operations.

The Legal Framework

VerSprite’s geopolitical risk team explains the legal framework. “Several pieces of legislation govern China’s cyber operations,” it told SecurityWeek. “The 2015 National Security Law was an initial comprehensive piece of legislation to articulate China’s overall strategy. The 2017 National Intelligence Law specifically empowered the two parts of the secret police apparatus, the Ministry of National Security (guoan) and Internal Security Bureau of the Ministry of Public Security (guobao).”

However, to these activities we must add the operations of the People’s Liberation Army (PLA; that is, the Chinese military). It was Mandiant’s 2013 report on APT1 that first awoke the US to the severity of Chinese hacking operations. Mandiant is now part of FireEye. 

Although the report initially met with both cynicism and criticism, its veracity was later confirmed when the US government indicted five Chinese officers from Unit 61398 of the Third Department of the PLA.

China’s Cyber Expertise

In 2012, Trend Micro published an opinion piece titled, Peter the Great Versus Sun Tzu. Although it nowhere specifies this refers to Russia versus China, it created an impression that Russian hackers have greater expertise than Chinese hackers. The impression that Chinese hackers are not very clever has lingered, but needs to be revisited.

VerSprite points out that comparisons are odious, or at least onerous, noting that sophistication is not always necessary to achieve a required end. “The low-tech Twitter and Facebook misinformation campaigns, attributed to Russia, which took advantage of both platforms’ glaring vulnerabilities, were enough to achieve basic goals of spreading disinformation and causing confusion.”

But it also points out that China has a stated goal of wanting to close the gap with the US in terms of cyber capabilities. The implication is that China is aware of any shortcomings and has a project to improve its cyber ability.

Examples of major hacks attributed to China include that of the US Office of Personnel Management (OPM) in 2015, with the loss of detailed information on more than 21 million federal employees and federal employment applicants; and the more recent hack of Marriott hotels leading to the loss of details on 383 million individuals. While in both cases China Inc is the primary suspect, there is no absolute proof. Accurate attribution in cyber is very difficult, and there are undoubtedly false flags left by hackers to confuse forensic analysis. 

China Inc’s targets

China does not wish to provoke open conflict with the US; either cyber or kinetic. But in order to be stronger than the US economically, it must first close the gap in both business technology and military technology. This means that its cyber operations must be sophisticated, targeted and non-destructive.

Critical Infrastructure

China Inc is unlikely to do anything too overt or dramatic with US critical infrastructure, that would interfere with its long-term strategy. But it would be naïve to think it is doing nothing. “At a minimum, we must expect that China is seeking to map, model, and understand how to attack US critical infrastructure. Doing so requires some level of reconnaissance,” comments TruSTAR’s Kurtz.

This is likely standard practice for every cyber-advanced nation in the world that accepts it has potential adversaries.
However, there are less dramatic elements to critical infrastructure than nuclear facilities, power grids and water supplies.

In Summary

While the West worries about the potential for cyberwar with its traditional foe, Russia, it fails to realise that cyberwar with China is already happening. But this is cyberwar conducted on China’s terms, it is not the traditional view of warfare. China Inc is conducting a low and slow cyberwar, attempting to stay under the radar of recognition in the same way that individual hackers use low and slow techniques to remain hidden.

If this analysis of the long-term goal of China Inc is correct, then the threat from Chinese cyber operations is more dangerous and insidious than commonly thought. The policy is not one of direct confrontation but more designed to slowly maneuver the global economy until dominance shifts from the US to China.

It benefits China Inc if the world continues to believe it has only low-level cyber expertise. “It is important for companies, information security professionals, and network defenders,” says Moriuchi, “to move beyond this stereotype of second-rate Chinese state-sponsored cyber operations and realize the scope, capabilities, and true threat in order to successfully defend their networks.”

Security Week:
   
You Might Also Read:

China’s Hackers Have Stolen EU, US & Global Secrets:

British Telecom Is Stripping Huawei Out Of Its Network:

 

« Blockchain Transforms The Internet of Things
Google Search Results Spoofed To Create Fake News »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Cylance Smart Antivirus

Cylance Smart Antivirus

An antivirus that works smarter, not harder, from BlackBerry. Lightweight, non-intrusive protection powered by artificial intelligence. BUY NOW - LIMITED DISCOUNT OFFER.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

City Security Magazine

City Security Magazine

City Security magazine helps promote best security practices and keep businesses informed on a wide variety of security-related issues.

CYBERPOL

CYBERPOL

CYBERPOL's mission is to facilitate the widest possible mutual assistance between all cyber crime law enforcement authorities to help mitigate global cyber threats.

edgescan

edgescan

edgescan is a cloud-based continuous vulnerability management and penetration testing solution.

Achtwerk

Achtwerk

Achtwerk manufacture the security appliance IRMA for critical infrastructures and networked automation in production plants.

TorGuard

TorGuard

TorGuard is a Virtual Private Network services provider offering secure encrypted access to the internet.

Sternum

Sternum

Sternum provides reliable and effective endpoint security for any IoT device, using robust technology and seamless integration.

Arceo

Arceo

Arceo enables insurers and brokers to better assess, underwrite, and manage cyber risks using curated security data for accuracy and AI for advanced risk assessment.

Kasada

Kasada

Kasada provides bot detection and mitigation for enterprise web applications. Stop the bots before they reach your site and web applications.

drie

drie

drie is an end-to-end cloud services company based in Bahrain, Dubai and London. We enable businesses to adopt, scale on and build for cloud.

Security Management Partners (SMP)

Security Management Partners (SMP)

Security Management Partners (SMP) is a trusted partner to financial services, healthcare and businesses that need to manage their information, securely.

Revere Technologies

Revere Technologies

Revere Technologies is a pure-play cyber security solutions and services provider in Sub-Saharan Africa.

Node4

Node4

Node4 provide advanced, cloud-led digital transformation solutions, delivered with technical expertise, innovation and exceptional service to drive your business forwards.