Regular readers of these ramblings will remember that we first reported about the nefarious activities of the Chinese hacking outfit APT10 way back in April 2017 after its activities were brought to public attention through brilliant work by PwC, BAE Systems and (the obviously silent(ish) partner) the UK National Cyber Security Centre (NCSC).
To recap, the story went something like this: In a totally planned, brilliantly executed series of cyber programmes, APT10 acting on behalf of, instructed by, and paid by (you get the picture) the Chinese Government allegedly, infiltrated companies the world over to steal their Intellectual Property in order to advance the Chinese economy without having to do the hard yards (the research, the sweat, the toil).
A key facilitator in this epic hack was the use of third-party providers which could then be used to ‘hop’ into the provider’s managed service customers, set up a VPN back to Beijing, sorry base and syphon off the blueprints.
Unsurprisingly, many of the big managed service types kept their heads down and hands in their pockets throughout this and subsequent announcements, the most recent of which was in April this year. We did say: ‘What will almost certainly turn out to be the thin end of this wedge…..’
In between April 2017 and this glorious London Summer’s day, we have seen the most proficient, efficient, ‘we are not worthy’ work of the aforementioned terracotta army building, paper inventing, explosives pioneering Nation.
When you think about it, we really shouldn’t be surprised, should we? This is after all a country that killed all of the sparrows (and other feathered friends besides) by ‘encouraging’ the (sizeable) population to, amongst other things, keep them flying by scaring them until they simply fell from the sky. Ironically that plan spectacularly backfired because the number of bugs (and insects) caused carnage. Will history repeat itself?
So we have been banging this drum (away from nature) for some time and have often been accused of being paranoid, possibly in the tinfoil hat brigade (do watch that video, the toilet roll is amongst the most awkward items on the desk). What we needed was a ruthless, detailed and credible (so far) journalistic team to tell it like it is.
Step forward the esteemed Mr Jack Stubbs and colleagues who have released a very comprehensive report which details at least some of the scope of the APT10 activity.
It turns out that our tin helmets and dread warnings about the sky falling on your heads were not wasted.
According to Reuters not only HPE and IBM (the original suspects) but also Fujitsu, Tata Consultancy Services, NTT Data, Dimension Data, Computer Sciences Corporation and DXC Technology (the new/old HPE, so boring) were compromised by APT10 and then used to harvest the Intellectual Property goodness of pretty much everyone.
Wowser. If you were writing a science fiction novel about a culture trying to progress rapidly by appropriating the hard work of the enemy, sorry friendly neighbours, you would probably struggle to imagine or describe the scale of this larceny.
This week it was widely reported that ‘Hackers infiltrated the networks of at least ten cellular telcos around the world, and remained hidden for years, as part of a long-running tightly targeted surveillance operation’. Although we do like to hand out a prize, we won’t be giving one out for guessing which outfit has been fingered for this dastardly activity!
So what do you think, should we build critical national infrastructure including 5G using Huawei equipment? We think you know what our survey says.
The trouble with this sort of infiltration and subsequent exfiltration is that it is so very hard to spot, let alone get rid of. It keeps coming back.
ITC has fought these fires from detection, through removal, to protection against the very same miscreants of which we speak. We would be more than happy to share our experiences with you and help you have a good look at your environment. Of course less subtle actors lurking on your stuff would be identified and dealt with, probably before we engaged the big guns.
If you are anxious, intrigued or would just like to discuss this massive heist, do contact us at: [email protected] or call 020 7517 3900. If you are at or going to Glasto, leave it a week or so or wear your tin hat.
