China cyberspies suspected in new caper: what has experts worried

A China-based cyberespionage gang is suspected in the hacking of a major industrial control system firm in Canada. Experts warn the theft could facilitate creation of a cyberweapon.

A China-based cyberespionage gang has been linked to the infiltration of networks belonging to Telvent Canada, a major industrial control system company, in a case that some experts warn could facilitate creation of a dangerous cyberweapon.

The cyberspies, thought to be from a gang that security researchers call the "Comment Group" or sometimes the "Shanghai group," slipped past a corporate firewall, installing malicious software on the network – then snatched project files related to one of Telvent's major software products, according to KrebsOnSecurity, a cybersecurity blog that first reported the breach Wednesday.

As cyberespionage hacks that become public go – Google created a furor when it said it had been hacked by Chinese cyber spies in early 2010 and at least some of its vital source code had been stolen – it's been a relatively low-key news event so far.

The Telvent hack became public Wednesday on the cybersecurity blog and was later confirmed by Telvent's parent, Paris-based Schneider Electric.

"Telvent is actively working with law enforcement, security specialists and its affected customers to ensure the breach has been contained," Schneider Electric said. Just this month, Telvent announced a new relationship with Foxboro, Mass.-based Industrial Defender, a control systems security company.

But some cybersecurity professionals are waving a red flag over the Telvent hack. Dale Peterson, CEO of Digital Bond, a leading industrial control systems (ICS) security company in Sunrise Fla, says the Telvent attack looks much like one fragment of a far larger campaign targeting ICS vendors, whose products run the nation's critical industrial processes: pipelines, refineries, chemical plants, factories, and the electric grid.

Typically, stolen software code might help a perpetrator to leapfrog its competition in the global marketplace. But in the Telvent case the theft could facilitate creation of highly reliable and dangerous cyberweapons, he and other control system experts agree.

The apparent target of the Telvent attack was the firm's OASyS SCADA software program, which is used to operate an array of equipment from gas pipelines to the power grid.

Telvent has a huge footprint in the oil and gas industry – and an important role in the emerging “smartgrid” that more efficiently coordinates energy distribution. Its software allows old and new software to speak to each other – and control critical systems. But if captured, the source code from such a product could be used to far more easily develop potent cyberweapons akin to Stuxnet, a hyper-sophisticated software weapon that experts say destroyed 1,000 Iranian nuclear centrifuges.

"The attackers used their presence on the Telvent network to download the customer project files for a future attack – think future Stuxnet," Mr. Peterson writes in his blog. "If an attacker were going to attack a process in a sophisticated manner they would need time and talent to study the project files and essentially reverse engineer the process."

As to the question of who did the dirty deed, China's "Comment Group" is the leading suspect, according to an analysis by Joe Stewart of Dell Secureworks, an expert in tracking cyberespionage attacks. Data from the Telvent hack appears identical in certain key respects to digital signatures left by a Chinese cyberespionage gang many call the Comment Group, but which Mr. Stewart calls the Shanghai Group.

Stewart, however, has not yet analyzed the malware that infected Telvent and other signatures. So his opinion is based on a Telvent document listing digital signatures that was provided to him by Brian Krebs, the security blogger. Among that data are signatures Stewart has, over several years, tracked back through cyberspace to the Comment Crew.

"The file names, malware families and domains listed are related to a trojan that then maps back to the Comment group," says Elizabeth Clarke, a Dell SecureWorks spokeswoman speaking on behalf of Stewart.

Other industrial control system security companies have recently been hit by so-called “spear phishing” fake e-mail attacks that, like Telvent, used malware undetectable by ordinary antivirus screening.

In June, Digital Bond was targeted by a spear-phishing e-mail that contained malware. The firm caught it, however, before it got onto the company network. Energy Sector Security Consortium, an Oregon-based nonprofit group that supports the energy industry in securing critical technology infrastructures, was also hit, Peterson says.

"They are going after the ICS energy sector, and Telvent is almost certainly not the only vendor being targeted or compromised," Peterson says.

"In fact, I would be worried if a large asset owner or vendor in the energy sector is not detecting these attacks. Little Digital Bond and nonprofit EnergySec must be rather low on the list of energy sector ICS targets."

You've read  of  free articles. Subscribe to continue.
Real news can be honest, hopeful, credible, constructive.
What is the Monitor difference? Tackling the tough headlines – with humanity. Listening to sources – with respect. Seeing the story that others are missing by reporting what so often gets overlooked: the values that connect us. That’s Monitor reporting – news that changes how you see the world.

Dear Reader,

About a year ago, I happened upon this statement about the Monitor in the Harvard Business Review – under the charming heading of “do things that don’t interest you”:

“Many things that end up” being meaningful, writes social scientist Joseph Grenny, “have come from conference workshops, articles, or online videos that began as a chore and ended with an insight. My work in Kenya, for example, was heavily influenced by a Christian Science Monitor article I had forced myself to read 10 years earlier. Sometimes, we call things ‘boring’ simply because they lie outside the box we are currently in.”

If you were to come up with a punchline to a joke about the Monitor, that would probably be it. We’re seen as being global, fair, insightful, and perhaps a bit too earnest. We’re the bran muffin of journalism.

But you know what? We change lives. And I’m going to argue that we change lives precisely because we force open that too-small box that most human beings think they live in.

The Monitor is a peculiar little publication that’s hard for the world to figure out. We’re run by a church, but we’re not only for church members and we’re not about converting people. We’re known as being fair even as the world becomes as polarized as at any time since the newspaper’s founding in 1908.

We have a mission beyond circulation, we want to bridge divides. We’re about kicking down the door of thought everywhere and saying, “You are bigger and more capable than you realize. And we can prove it.”

If you’re looking for bran muffin journalism, you can subscribe to the Monitor for $15. You’ll get the Monitor Weekly magazine, the Monitor Daily email, and unlimited access to

QR Code to China cyberspies suspected in new caper: what has experts worried
Read this article in
QR Code to Subscription page
Start your subscription today