Unit 61398 - China's Computer Commandos

It's possibly the most successful unit in China's Peoples Liberation Army.   Unit 61398 is believed to have hacked hundreds of terabytes of data from targets in Canada, the U.S. and Britain.

The report, by [U.S. security company] Mandiant, identified the People's Liberation Army's (PLA) Shanghai-based Unit 61398 as the most likely perpetrators of the hacking. The company said it believed the unit had carried out "sustained" attacks on a wide range of industries.

"The nature of Unit 61398's work is considered by China to be a state secret; however, we believe it engages in harmful computer network operations," Mandiant said. "It is time to acknowledge the threat that is originating in China, and we wanted to do our part to arm and prepare security professionals to combat that threat effectively."

 Unit 61398 is based in the Pudong district, China's financial and banking hub, and is staffed by perhaps thousands of people proficient in English as well as computer programming and network operations, the report said.

It said the unit had "stolen hundreds of terabytes of data from at least 141 organisations across a diverse set of industries beginning as early as 2006". Most of the victims were located in the US, with smaller numbers in Canada and Britain. The information stolen included details on mergers and acquisitions and the emails of senior employees, the report said.

Among the information China is believed to have stolen are big chunks of computer code and other contractor data for the F-35 joint strike fighter.   Chinese hackers reportedly made repeated forays into the computers of Lockheed and its British partner, BAE.

What Are The Hackers After Next? Maybe Your Pacemaker.

There are hundreds of thousands of people who are kept alive by pacemakers, heart defibrilators, brain stimulators and implanted drug pumps that may be vulnerable to hacker attacks.

The vulnerability comes from wireless connectivity that enables doctors to monitor patients' vital signs or revise treatment programmes.

...like any wireless connection, there's now a risk that such devices could be vulnerable to attack. And unlike with PCs when a wireless hack means someone obtaining your personal details, the worse case scenario here is that an attacker - or money grabbing relative - could kill a victim by instructing an implantable device to deliver lethal doses of medication or electricity.

To try and protect people wearing the devices the boffins have come up with a new system, which uses a second transmitter to jam unauthorised signals in an implant's operating frequency. In short this means that only authorised users will be able to communicate with it. This is because the jamming transmitter, rather than the implant, would handle encryption and authentication. And its good news for existing users as the bods claim that the system could work even with existing implants.

Known as a "shield  " the jamming transmitter will be small enough to be disguised in a necklace or watch. It would be paired with a device authorized to access the implant, which would send encrypted instructions to the shield, which would decode and relay them.

However, they won't be built into the device as this could cause problems if there is an emergency. And whether medical-device companies will invest in these or if patients will be willing to carry shields around with them depends on how grave they consider the threat of attack to be.

 Great, just f--king great!  What's next?

Has Israel Unleashed a Cyber-Monster?

It's a computer superworm called Stuxnet.  It's apparently capable of causing nuclear power plants or pipelines to blow up and it's believed to have been created by Israel to disable Iran's nuclear programme.

Stuxnet, however, may have a blowback effect and it's got top computer security wizards in knots.  According to National Public Radio, Stuxnet was the hot topic at yesterday's Virus Bulletin conference in Vancouver.   The conference was organized by Symantec (Norton antivirus) whose experts have been analyzing Stuxnet for weeks:

Eric Chien, technical director at Symantec's Security Response Unit, says he and his colleagues have been stunned by what they've found.  "I've been dealing with malicious code threats for 15 to 20 years now, I've seen every large sort of outbreak, and we've never seen anything like this," Chien says. "It's fundamentally changed our job, to be honest."

That's because studying a computer worm designed to sabotage a power plant or gas refinery is a far cry from thinking about some virus engineered by a lone hacker.

"It changes the urgency at which we have to analyze these threats and understand them and make sure that people who are affected know they are affected and how to get themselves cleaned up," Chien says.

The Symantec researchers say the Stuxnet worm was designed by a well-funded, well-organized group, perhaps affiliated with a government. They're convinced it was meant to target facilities in Iran. The worm was apparently designed to penetrate and take over the computerized control system used in nuclear plants there.

But it's becoming clear that the repercussions may go far beyond Iran.

"Now that it's released, numerous other people will take that and go, 'aha,' " says Stephen Spoonamore, a veteran cybersecurity consultant who has spent years pursuing hackers. He thinks some other group may now be able to take the Stuxnet computer code and modify it slightly to create its own cyber superweapon.

Spoonamore says it probably would have been better if Israel had simply bombed Iran's nuclear facilities.   "Compared to releasing code that controls most of the world's hydroelectric dams or many of the world's nuclear plants or many of the world's electrical switching stations? I can think of very few stupider blowback decisions."