Chinese Hackers Could Have Disrupted The New York Times Publishing System
AFPOne thing stands out about Nicole Perlroth's report on how Chinese hackers infiltrated the computer systems of The New York Times to steal information from journalists covering the Wen Jiabao scandal: It could have been much worse.
The attacks — which experts said started from the same university computers used by the Chinese military to attack United States military contractors — could have disrupted the newspaper’s electronic or print publishing system.
“They could have wreaked havoc on our systems,” Marc Frons, the Times’s chief information officer, said. “But that was not what they were after.”
Security experts told the Times that the hackers "stole the corporate passwords for every Times employee" and "installed 45 pieces of custom malware" over three months, but were only seeking information related to the reporting on the Wen family.
Perlroth notes that the attacks "appear to be part of a broader computer espionage campaign against American news media companies that have reported on Chinese leaders and corporations" that began in 2008.
Mandiant, the computer security company hired by The Times, found evidence that Chinese hackers have stolen e-mails, contacts and files from more than 30 journalists and executives at Western news organizations while maintaining a “short list” of journalists whose accounts they repeatedly attack.
The fact that the hackers could potentially disrupt The Paper of Record's ability to publish — combined with the fact the attacks sometimes lasted from morning until midnight — indicates that China may have the ability to severely disrupt the flow of information in the West.
“This is not the end of the story,” said Bejtlich of Mandiant. “Once they take a liking to a victim, they tend to come back.”
The Times story, which Wen Jiabao's lawyers deny, stated that Wen's extended family had more than $2.7 billion in hidden assets and that his wife was notorious as China's "diamond queen".
Read the full Times article here >