FBI: Chinese Military Hackers Charged In Equifax Breach Intrusion That Affected Nearly Half Of All Americans

The FBI released the below information:

During a February 10, 2020 press conference at the Department of Justice in Washington, D.C., FBI Deputy Director David Bowdich joined other officials in announcing charges against four Chinese military-backed hackers in connection with the 2017 cyberattack against Equifax.

Today, the U.S. Department of Justice announced charges against four Chinese military-backed hackers in connection with carrying out the 2017 cyberattack against Equifax, a consumer credit reporting agency. The intrusion led to the largest known theft of personally identifiable information ever carried out by state-sponsored actors.

Investigators had previously discovered and announced the type of malware that allowed the hackers to harvest addresses, birth dates, Social Security numbers, and other data on approximately 145 million Americans. Today’s indictment charges that members of the People’s Liberation Army—the armed forces of the People’s Republic of China—were behind that malware attack. 

According to the indictment, Wu Zhiyong, Wang Qian, Xu Ke, and Liu Lei exploited a vulnerability in the dispute resolution website within the Equifax system. From that initial access point, the hackers used a number of techniques to force their way into the company’s network and back-end databases.

In announcing the charges, U.S. Attorney General William Barr said the Equifax intrusion is among other efforts by the Chinese government to steal the personal data of Americans. The Justice Department believes the Chinese were also responsible for breaching systems controlled by the Office of Personnel Management, Marriott hotels, and the health insurance company Anthem.

“This data has economic value, and these thefts can feed China’s development of artificial intelligence tools as well as the creation of intelligence-targeting packages,” Barr said. “In addition to the thefts of sensitive personal data, our cases reveal a pattern of state-sponsored computer intrusions and thefts by China targeting trade secrets and confidential business information.”

To uncover the actors behind the Equifax theft, a broad and multinational investigative team led by the FBI’s Atlanta Field Office tracked the crime’s digital breadcrumbs back to the four co-conspirators—who allegedly used servers in multiple countries and approximately 40 different IP addresses to disguise the origin of the attack.

FBI Deputy Director David Bowdich said today’s announcement is “a testament to the hard work and determination of everyone involved in this investigation.”

Bowdich also said that although these types of breaches have become disturbingly common, businesses cannot become complacent about protecting data and consumers. “And as American citizens, we cannot be complacent about protecting our sensitive personal data,” Bowdich emphasized. “We in law enforcement will not let hackers off the hook just because they’re halfway around the world. We’ve got to do everything we can to keep people safe, secure, and confident online.”

You can find additional information about the Equifax data breach through the Federal Trade Commission at ftc.gov/equifax. 

Learn more about protecting your personal and business systems and reporting cyber-enabled crime at the FBI’s Internet Crime Complaint Center. 

‘Terabyte Of Death’ Cyberattack Against DoD Looms, DISA Director Warns

Lisa Ferdinando at the DoD News offers the below piece:

ARLINGTON, Va., Jan. 11, 2018 — The vast, global networks of the Defense Department are under constant attack, with the sophistication of the cyber assaults increasing, the director of Defense Information Systems Agency said here today.

Army Lt. Gen. Alan R. Lynn, who is also the commander of the Joint Force Headquarters, Department of Defense Information Networks, described some of the surprises of being in his post, which he has held since 2105.

Lynn spoke at a luncheon of the Armed Forces Communications and Electronics Association’s Washington Chapter.

“We do an excellent job of defending the [Department of Defense Information Networks], but the level of attacks that we’ve seen actually was really truly surprising and it still continues to surprise me just how robust the attacks have become,” he said.

‘Terabyte of Death’ Attack: A Matter of When, Not If

A few years ago, getting a 1-gigabyte or 2-gigabyte attack at the internet access point was a big deal, he said. “Now, we get 600-gig attacks on the internet access points and unique, different ways of attacking that we hadn’t thought of before,” he added.

The Defense Department is fortified against even larger attacks, he said.

“There’s now, we would call it the ‘terabyte of death’ – there is a terabyte of death that is looming outside the door,” he said. “We’re prepared for it, so we know it’s coming.”

He noted, “It’s just a matter of time before it hits us.”

Scale of DoD Networks ‘Massive’

Lynn, who retires next month, said the size of the DoD network is something else that surprised him. He described it as a “massive,” 3.2 million-person network that he has to defend or help support in some way.

“There’s something happening every second of every minute globally that you can’t take your eye off of,” he said. 

The department needs agile systems for the warfighter to stay ahead of an adversary that is evolving and moving, he pointed out.

There are challenges to finding solutions that scale to the DoD Information Networks, he said. A commercial solution that works for a smaller operation might not translate into something that is effective for the worldwide DoD networks, he explained.

DISA, he pointed out, is a combat support agency responsible for a multitude of networks. He cited as examples the networks between the drones and the drone pilots, or the F-35 “flying mega-computer” that needs a lot of data and intelligence, or the “big pipes” that connect various entities to missile defense.

He explained how commercial mobile platforms have been modified for warfighters to accommodate secret or top secret communications.

“Anywhere they are globally, if they’ve got to make a serious decision right now and it means seconds, that’s there and available to them,” he said, adding that mobile platforms are becoming “more and more capable as we go.” 

Warfighting, which now includes streaming drone video feeds, is happening on mobile devices, he said. “It’s pretty cool to watch,” he remarked.

While acknowledging DISA does do “a lot of cool IT stuff,” Lynn said all of the efforts support a singular focus. “At the end of the day, it’s about lethality,” he said.