Analysis: Lockheed hack highlights cyber-blame snags

WASHINGTON Mon May 30, 2011 6:48pm EDT

The F-35 Lightning II, also known as the Joint Strike Fighter (JSF), planes arrive at Edwards Air Force Base in California in this May 2010 file photo. REUTERS/Tom Reynolds/Lockheed Martin Corp/Handout

The F-35 Lightning II, also known as the Joint Strike Fighter (JSF), planes arrive at Edwards Air Force Base in California in this May 2010 file photo.

Credit: Reuters/Tom Reynolds/Lockheed Martin Corp/Handout

Related Topics

WASHINGTON (Reuters) - Past patterns may point to China, but top investigators say they will never know for sure who mounted a "significant" cyberattack against Lockheed Martin Corp, the Pentagon's No. 1 arms supplier.

Lockheed, which is also the government's top information technology provider, said on Sunday it was a "frequent target of adversaries around the world."

The company has not disclosed which of its business units was targeted, but people with experience plugging holes after such strikes said that cyberspies likely sought trade secrets or weapons-related data.

The Bethesda, Maryland-based company did not respond to a request to clarify whom it deemed adversaries, and whether it suspected a foreign state in the digital assault it said it had detected "almost immediately" on May 21.

Lockheed said it had countered with stepped-up security measures and that no customer, program or employee personal data has been compromised in the "significant and tenacious attack" on its information systems network.

China has generally emerged as a prime suspect when it comes to keyboard-launched espionage against U.S. interests, although the Pentagon says more than 100 foreign intelligence groups have been trying to pierce U.S. networks.

"China's government, the Chinese Communist Party, and Chinese individuals and organizations continue to hack into American computer systems and networks as well as those of foreign entities and governments," the bipartisan U.S.-China Economic and Security Review Commission said in its 2010 annual report to Congress.

The body was created by the Congress in 2000 to advise it on implications of trade with China. It said in its report the methods used in suspected Chinese-launched attacks were growing more sophisticated and increasingly piggy-backing on social networking tools.

BEIJING DISMISSES CHARGES

Beijing, at odds with the United States over Taiwan and other issues, has "laced U.S. infrastructure with logic bombs," a cyberweapon, former U.S. National Security Council official Richard Clarke wrote in his 2010 book "Cyber War."

Beijing steadfastly dismisses such charges.

"I'd say it's just irresponsible to arbitrarily link China to such cyber hacking activities in each and every turn," Wang Baodong, the Chinese Embassy spokesman in Washington, said in an email to Reuters. "As a victim itself, China is firmly against hacking activities and strongly for international cooperation on this front".

Pinning down responsibility for an attack like that reported by Lockheed is "incredibly difficult" given the sophisticated ways that an attacker may misdirect, said Anup Ghosh, a former senior scientist at the Pentagon's Defense Advanced Research Projects Agency, or DARPA.

Encoded clues in the Stuxnet virus that may have slowed progress on Iran's nuclear program, for instance, seemed designed to point to Israel.

But "it is impossible to know if these are red herrings or genuine," said Ghosh, who worked on securing military networks for DARPA from 2002 to 2006 and who now runs Invincea, a software security company.

Eugene Spafford, who heads the CERIAS cybersecurity research facility at Purdue University in Indiana, said the digital residue of an attack would not suffice to lead to a person or place.

"Records may show a network address where those bits came from, and that network address may tie to a machine in a country, but that is only the address of the most recent 'hop'," he said in an email interview.

"It is always possible that it is a system that itself was compromised, by another system that was compromised," and so on and so on, Spafford said. In addition, one could never rule out the possibility that a given cyberstrike might be launched by someone in the pay of yet a third party, no matter where it originated.

Spafford, whose CERIAS lab has partnered with a dozen major companies and national laboratories, including defense contractors and Fortune 500 companies, said the bottom line is that "we likely never really will know who did it."

Investigators first look for hard evidence -- searching for stolen data that may be traveling across the Internet or seeking out people looking to sell information culled in a cyber attack. They typically rely heavily on circumstantial evidence, including whether the attack details match known methods from a suspect and if the targets are consistent with a group's perceived interest.

It is also possible that the U.S. intelligence community, using its vast electronic eavesdropping and other spying capabilities, may make a judgment about the origin independent of forensic analysis, but that too would be subject to doubt.

(Editing by Mohammad Zargham)

FILED UNDER:
We welcome comments that advance the story through relevant opinion, anecdotes, links and data. If you see a comment that you believe is irrelevant or inappropriate, you can flag it to our editors by using the report abuse links. Views expressed in the comments do not represent those of Reuters. For more information on our comment policy, see http://blogs.reuters.com/fulldisclosure/2010/09/27/toward-a-more-thoughtful-conversation-on-stories/
Comments (6)
mgunn wrote:
Because of proxies anyone can attack from anywhere at any time. Past patterns are totally misleading as all those were by conjecture too which then feeds onto itself and catches a life of its own. Kinda like the Iraq WMD thing, we say it enough and we all start to believe it. In fact, if I were a hacker I would purposely make it look like it emanated the from china or russia just to divert attention.

May 30, 2011 9:28pm EDT  --  Report as abuse
China_Lies wrote:
The world isn’t that naive….of course it was the chinese.

Who else has the proven capability, the proven desire, and the proven history of military and economic cyber-espionage?

Sorry, but the cards are stacked against china.

Take it one step further:

a few weeks ago, the world found out that the US possesses some pretty amazing military technology. Pakistan stalls for three weeks before returning a portion of the helicopter to the US. This gives them enough time to invite their chinese friends in for an inspection. As soon as the inspection is complete, they realize they need more details. So, what do they do? They go after the source by hacking into Lockheed’s network.

It doesn’t take a rocket scientist to put the pieces of this puzzle together.

Come on!!!

May 30, 2011 10:06pm EDT  --  Report as abuse
blinded1 wrote:
To say the least, Pentagon has hands on creation of Stuxnet virus.

May 30, 2011 10:07pm EDT  --  Report as abuse
This discussion is now closed. We welcome comments on our articles for a limited period after their publication.