In the last a few months, there have been quite a few reports of Chinese cyber army attacking computer systems of different western governments to steal valuable secrets. First America, then Britain and now Germany, have all come out and publicly accused China's People's Liberation Army (PLA) of launching systematic attacks at their governmental and industrial computer networks. So, is there really an army of PLA hackers that are blatantly attacking western government's computer networks, or is this just paranoia and China bashing?
Well, I suspect that the truth is somewhere in the middle. I'm sure the PLA has some sort of electronic warfare division, and so do probably all the armies in the world. I'm also sure that some of the PLA hackers have attempted to break into other country's networks -- that's what hackers do. However, I'd be very surprised if PLA have indeed been systematically attacking foreign government's computer networks amid all these already very loud accusations.
I'm a computer scientist, and I have been running my own Linux server for several years, so let me explain why all these accusations of hacking are probably nonsense.
All the accusations so far claimed that the hackings were launched through the Internet. In other words, the attackers, if they existed, did not have physical access to the computers that they attacked. So, what exactly constitutes an Internet based cyber attack and how does one carry out such an attack? To answer these 2 questions, one has to first ask what the hacker can gain by attacking someone's computer network?
There are two fundamental goals of hacking:
- Theft: stealing the data on the victim's computer.
- Disruption: disrupting the operations carried out by the victim's computer.
Therefore, one can claim to have been cyber attacked when their private files have been accessed, or their computer has been remotely controlled by someone else, or the service provided by their computer is being inundated by malicious requests.
Let's further quantify what it means to "have your files stolen". Computer hardware and software are very very dumb, they are so dumb that they cannot understand you if you do not given them explicit instructions that they can understand. Therefore, if you unintentionally allow a file to be accessed through legal operations of your own software, then it probably will be accessed and that would not be hacking in my books.
For example, if you set up a web server on your computer, and you tell the server software that every file under the directory of "XYZ" can be accessed by your Internet users, then you should not put any of your private files in that directory.
So, if you have not unintentionally shared your private files, then how can a hacker get to them? Well, they can get to it with 3 methods:
- Trojan horse software
- Exploiting security holes of your networking software
- Remotely logging into your computer using legit user name and password combination
Your files do not have cyber legs or normal legs. They will not copy, move, change or transmit themselves without outside influences. It doesn't matter whether your file is a piece of executable code, or just some random data, or a device (for *nix systems), it will not do anything unless something else tells it to do so. Therefore, if someone wants to read your private files or copy them onto their computers, they are gonna have to use another program on
your computer to do so. However, if they are not already logged onto your computer, how can they run one of your programs?
Trojan horse software is one way for hackers to run a program on your computer. Basically, the hacker will write a malicious program and give it an exotic and tempting name and advertisement, and when you download it and run it on your computer, it will be able to do the hacker's biddings. For example, if someone tells you that their
free program allows you to watch porn, or can crack the serial number of some software that you didn't pay for, then there is a pretty good chance that their "free" program is a Trojan horse.
So, how do you protect yourself against Trojan horse attacks? It's quite simple actually: DO NOT DOWNLOAD ANY DODGY SOFTWARE FROM THE INTERNET!!!! DO NOT OPEN OR RUN ANY EMAIL ATTACHMENT FROM PEOPLE YOU DON'T KNOW!!! Now, I don't think it's very likely for the PLA hackers to attack western government computers using Trojan horse software. I mean, could you imagine senior western government officials browsing the net and downloading dodgy software during their working hours on their government computers? Well, maybe you can, but then the problem wouldn't really be the hackers, would it?
Exploiting security holes of your networking software is another method that hackers can use to run programs on your computer, and it's much harder to defend against, but luckily, it's also extremely hard to do. Like any other software, networking software (email, remote logging software, internet messaging software, etc.) is essentially a list of machine readable instructions which were written to perform a specific task. When you run such a software, some of its instructions and some of its data are stored in your RAM. A security hole is a bunch of instructions that allow the users to modify the instruction part of the program through unexpected inputs. A security hole allows malicious users to replace legit instructions with their own illegit machine instructions, and cause damage.
So, how do you defend against security holes of your networking software? Well, not much really. On the one hand, you can rely on the publisher of the software to have done sufficient testing and apply patch whenever you can. Commercial software are normally pretty bad at this, because they hide their source code from the public and nobody knows what's wrong with their software until it's too late. On the other hand, you can use a good operating system and minimize the damage that can be done by an exploited process(a "process" is a software in execution). For example, on Linux/Unix systems, each process is given a set of permissions on what they can read and write, and these permissions are enforced by the operating system and cannot not be changed unless the exploited process is being run by the system admin user. Therefore, by restricting the permissions of your software to the bare minimum, you can minimize the damage.
The more important question is then how many hackers does it take to exploit the security hole of a networking software? My answer would be ... just 1 actually. You don't need an army of hackers, you just need 1 guy who knows what he's doing. It doesn't matter how many millions of hackers you have, if there is no security hole on your networking software, they would never be able to get through. In fact, it's probably a bad idea to have more than one hacker attacking the same networking software on the same computer -- they can easily interfere with each other and corrupt each other's illegal instructions. Therefore, the idea of armies of PLA hackers launch coordinate software exploit attacks on western government networks is not really plausible.
Another type of cyber attack is the often-talked about denial-of-service (DOS) attack. How does this work? Well, suppose that you are running a web server that allows people to order flowers over the net, and then one day, a bunch of hackers come along and use multiple computers to generate millions of flower orders at your website. Since you've only got a crappy computer, the poor thing is then so swamped with all these nonsense requests that it cannot handle any legit flower orders. This type of attacks can easily render ordinary web servers useless. However, all the hackers can do is disrupting your daily operations, they cannot steal anything from you at all. This is the type of attacks that an army of hackers are mostly suitable for, but since they cannot get any information from their victims, they can only disrupt single servers. If these servers are running highly classified mission critical services that concern the national security of America, Britain and Germany, then that would be a problem for them. However, could you imagine America coordinating real time military operations using a bunch of servers that are openly accessible via the Internet? I don't think so.
So, how do you defend yourself against DOS attacks? Well, some firewalls would be a good idea. For example, you can identify the IP address of the computers that the malicious requests come from and tell your networking software/hardware to simply ignore them. That would probably get rid of the vast majority of DOS attacks ... but yes, that also means someone has to be monitoring the requests at all times, but then again, that's what system admins are for, isn't it?
Finally, the least likely but most damaging way of hacking is for a hacker to guess your user name and password combo and remotely logging into your computer. This is the dumbest way of hacking and theoretically the least likely way to succeed. Basically, it just involves someone trying to first guess your user name, then your password through some remote logging software such as SSH or Telnet or FTP.
You'd think that an army of hackers would be perfectly suitable to carry out this sort of attacks. However, let's do a bit of math. Suppose you mandate your user name and password both have to be 8 characters long and they can be numbers, punctuations, and alphabetical characters. That means each character of your user name and pass word can be an upper case letter, a lower case letter, a digit and a symbol. A quick look at my keyboard tells me that the number of choices is 26 *2 + 11 *2 = 74. So the total number of possible user name and password would be 74^8 each, and the total number of user name/password combos would be (74^8) * (74^8) = 8.085 * 10^29 which is a very very large number. Since the guessing has to be done over the Internet, there is actually a delay. Let's suppose that we have 1 million hackers each with their own computer and trying to crack the user name and password of a single victim computer, and the delay between each try is 0.1 second, it would basically take 2563898975171665 years for these hackers to crack the victim computer. Does this seem plausible to you?
So, how do you defend against people who want to guess your user name and password? Well, my recommendations are:
- Only use the most secure remote logging software, e.g. SSH.
- Have proper user names and passwords. DO NOT USE EMPTY PASSWORDS OR ALLOW GUEST LOGIN!!!
- Configure your remote logging software to disable remote logging for all known users, i.e. "root", "admin", "mail", "web", etc.
- Configure your remote logging software to use non-standard ports so that the potential intruders cannot easily know what services you are running.
- Configure your remote logging software to introduce delays between unsuccessful login attempts from the same remote host, i.e. first failure -- wait for 2 seconds, second failure -- wait for 4 seconds, etc.
- DO NOT TELL OTHER PEOPLE YOUR USER NAME AND PASSWORD! DO NOT ACCESS HIGHLY CLASSIFIED COMPUTER NETWORKS FROM DODGY INTERNET CAFES!
Of course, there are many other forms methods of electronic intrusion, however, they don't fit the western government's accusations.
Now, let's have a look at exact what was described by the computer experts from the governments that accused the PLA. According to the following reuters article (http://www.reuters.com/article/internetNews/idUSL2225757020071022?sp=true):
"In our view, state Chinese interests stand behind these digital attacks," said Hans Elmar Remberg, vice president of the German Office for the Protection of the Constitution, the country's domestic intelligence agency.
"Supporting this view is the intensity, structure and scope of the attacks, and above all the targets, which include (German) authorities and companies," he told a conference on industrial espionage in Berlin.
In August German media reported that computer hackers believed to be linked to the Chinese army had infected German government ministries with spying programs. Beijing denied the allegation and said all "hacking" behavior was prohibited.
....
The attacks often rely on "Trojan horse" email programs or the hacking of Web sites, he said.
Well, maybe Mr.Remberg was not allowed to reveal more information on these attacks, but from what he said, there is precisely 0 solid proof of any PLA involvement. It's perfectly possible to trace the source of the attacks to specific IP addresses, therefore the attacker's cities, countries and Internet service providers. However, unless the PLA not only openly advertises their military subnet addresses but also foolishly launches these attacks from computers on these same subnets, there would be no evidence to link anything to the PLA. It seems that Mr.Remberg couldn't actually confirm the offending IP addresses actually belonged to the PLA ... well, that didn't stop him from accusing the PLA anyway.
Furthermore, it was also mentioned that "computer hackers believed to be linked to the Chinese army had infected German government ministries with spying programs". Well, as I explained before, there is no way for anyone to infect your computer with spying programs unless you actively download and run these programs yourself. So, could it be that the German ministries employees "accidentally" installed Trojan horse software on their work computers when they were browsing unsavory websites, and they just blamed the PLA to cover up their own dirty deeds?
Anyway, in conclusion, it is of my opinion that:
- Every military, PLA included, has electronic intrusion divisions which often hack other government's computer networks.
- None of the attacks described by the accusing western government are remotely plausible by any army of hackers.
- None of the reports of the attacks provide any solid proof of PLA involvement.
- If one just observes the most basic common sense in computer network safety, it would be very unlikely for your network to be breached by Internet based attacks.
Feel free to let me know what I've missed.