It came as a shock to just about no one in the cybersecurity industry that China has a cyberwarfare unit, which was acknowledged by the government there this week.
While the Chinese government has long denied attacking U.S. targets, U.S. businesses and government agencies have complained for years about attacks originating from China.
The Chinese government noted the existence of the country’s cyberwarfare unit in “The Science of Military Strategy,” a publication put out by a research institute of the People’s Liberation Army, according to news reports this week. The U.S. military has acknowledged its own cyberwarfare capabilities for over a decade.
The reaction of the U.S. cybersecurity industry was a collective, “That’s obvious.”
“China confirming it has a cyberwarfare unit is the equivalent of scientists coming out today and saying the Earth is not flat,” Brett Fernicola, CISO at cybersecurity vendor Stealthbits Technologies, said by email.
In many cases, attacks from China are not sophisticated, Fernicola said, but U.S. businesses still need to defend their systems. “Everyone needs to stay on their toes,” he added. “If you leave your backdoor unlocked you can bet someone from some foreign nation is going to walk in.”
It’s “naive” to think countries aren’t developing cyberwarfare capabilities, said Ken Westin, security analyst at Tripwire, a cybersecurity vendor. China appears to employ what Westin called “cybermercenaries” focused on economic espionage in addition to more official teams, he said by email.
There’s some disagreement about the sophistication of China-based attacks, with some complex schemes attributed to hackers from the country. Last May, the U.S. Department of Justice charged five supposed members of the People’s Liberation Army with hacking into computers and stealing trade secrets from six U.S. organisations in the nuclear power, steel and solar industries.
Back in early 2010, Google accused the Chinese government of sponsoring attacks against it and several other tech vendors.
The Chinese also appear to have their hands in several more recent attacks, said Rich Barger, Chief Intelligence Officer at ThreatConnect, another cybersecurity vendor. Recent attacks on health care vendors Anthem and Premera Blue Cross appear to have the fingerprints of Chinese hackers, he said by email.
“No one is surprised to discover China’s cyberwarfare capabilities because even non-governmental organisations are able to unofficially attribute incidents to Chinese advanced persistent threats with nation state ties, given they have the right technology, methodology and collaboration,” he added.
The U.S. government needs to step up its game against attacks from China and other nations, said John Gunn, Vice President of Vasco Data Security.
“The U.S. must develop the capability to launch both preemptive and retaliatory attacks to establish a meaningful deterrent,” he said by email. “Private investment in cybersecurity is important, but we also need the equivalent of ‘boots on the ground’ in our battle against foreign cyberterrorists and hacking organisations.”
