Chinese hackers prompt Navy college site closure

[falcon]

Chinese hackers prompt Navy college site closure

By Bill Gertz
THE WASHINGTON TIMES
November 30, 2006

Chinese computer hackers penetrated the Naval War College network earlier this month, forcing security authorities to shut down all e-mail and official computer network work at the Navy's school for senior officers.

Navy officials said the computer attack was detected Nov. 15 and two days later the U.S. Strategic Command raised the security alert level for the Pentagon's 12,000 computer networks and 5 million computers.

A spokesman for the Navy Cyber Defense Operations Command, located in Norfolk, said "network intrusions" were detected at the Newport, R.I., military school two weeks ago.

"The system-network connection was terminated and known affected systems were removed and are being examined for forensic evidence to determine the extent of the intrusion," said Lt. Cmdr. Doug Gabos, the spokesman.

"The Naval War College computer system-network is used by students at the war college and contains Navy Professional Reading Program and other materials, all of which are unclassified information."

The FBI and Naval Criminal Investigative Service are investigating the breach, another official said.

The Naval War College trains senior officers, conducts war games and carries out some classified research such as studies of future warfare. The college's Web site was not accessible yesterday.

Adm. Michael Mullen, chief of naval operations, recently directed the war college's Strategic Studies Group to begin work to develop concepts for waging cyber-warfare, a Navy spokesman said.

"The Naval War College is where the Navy's Strategic Studies Group is planning and practicing cyber-war techniques, and now they don't even have e-mail access," one U.S. official said.

U.S. defense officials said intelligence reports indicated that the cyber-attack on the college came from China, which a recent congressional report said has begun a series of computer network attacks against defense and military systems in the United States code-named "Titan Rain."

Retired Air Force Maj. Gen. Richard Goetze, a Naval War College professor, told a class Monday in Washington that Chinese computer hackers were behind the network attack. Gen. Goetze told students that communications were hobbled because the Chinese "took down" the entire Naval War College computer network.

Students and professors at the college now have to use private e-mail from home, raising security questions.

Cmdr. Gabos declined to comment on the origin of the attack. "The nature and extent of intrusion are operational issues," he said. "I can tell you it was an isolated incident and did not affect other elements of Department of Defense."

However, the U.S. Strategic Command, which is in charge of Defense Department computer warfare and defenses, issued a directive about the time the attack was detected ordering all defense computer users to heighten security by changing passwords.

The Strategic Command directive stated that the "information condition" was to be raised Nov. 17 from Infocon 5 to Infocon 4, or heightened alert against attack.
Alan Paller, a computer security specialist with the private SANS Institute, said the Chinese network attack against the war college is "the tip of the iceberg."

"The depth of the penetration is more than anybody is even admitting," he said in an interview. "People are trying to hide this because they're embarrassed."

Mr. Paller said the Chinese military's doctrine calls for waging cyber-warfare against computer networks. "Part of it is gathering data and part is leaving a back door so they can get in [to military computers] in the future," he said.

The annual report by the U.S.-China Economic and Security Review Commission, released Nov. 16, stated that there are "clear examples of computer network penetrations coming from China," including those linked to Titan Rain.

The report said the Chinese military has "information warfare units [that] are developing viruses to harm the computer systems of its enemies."

www.washtimes.com/national/20061130-103049-5042r_page2.htm

[American Patriot]

Aftermath of Chinese Network Attack
Strategypage ^ | 12/11/06



The U.S. Naval War College (NWC) is still trying to repair the damage caused by a massive hack attack last month. The full extent of the penetration, and damage, is not yet known. The forensics people aren't sure when they'll be finished. What they do known so far is that the attack came from China, although the Chinese deny any involvement.


Oddly enough, the attack targeted a part of the navy that did not contain a lot of current secrets. When it comes to developing new strategy, the NWC is pretty much out-of-the-loop. Very few of the CNOs (Chief of Naval Operations, what the commander of the navy is called) in the past 30 years was even an NWC grad. Most current admirals never went. Sea duty and mandatory specialist schooling seriously cut into the education options of naval officers during the Cold War and the '90s. Remember, the Navy was always deploying, while most of the Army and Air Force, and a major chunk of the Marine Corps, were essentially in garrison, during those years.



The NWC students are headed for important staff and support jobs, not the key command positions. The NWC is a wonderful repository of historical information on American naval operations and planning. Even then, most of those documents are not in electronic form. Then again, it is believed that the Chinese hackers went after the NWC because their probes indicated that the cyber defenses there were weaker than at other U.S. Navy installations. That makes sense, as the navy deploys its Internet experts and security capabilities to where they will do the most good (and protect the most valuable information.) What this attack will do, however, is provide a lot of useful information, to American security experts, on the state of the art within China's Cyber War forces.

[Ryan Ruck]

National Defense University Hacked

Computers and information networks at the National Defense University (NDU), the Joint Chiefs military education school at Fort McNair in Washington, were hacked and damaged by unknown attackers, defense officials said.

The attacks, described by officials only as "malicious activity," caused the university to shut down all its network servers and replace laptop computers after the activity was detected last month. The costs were high, officials said.

Officials close to the situation said the computer intrusions were identified during routine maintenance and led to suspicions that the hackers had planted clandestine "trap doors" into the system that would allow them future access, or would facilitate computer attacks.

The only way to ensure the security of the systems was to replace them, we are told.

The shutdown forced the university's faculty and students to rely on personal e-mail and laptops, limiting work at the school.

NDU spokesman Dave Thomas declined to comment when asked about the hacking but said some laptops were replaced for faculty members.

Officials would not say where the attacks originated, but the shutdown of the entire computer network at NDU lasted from Dec. 18 until earlier this week. Official suspicions are focused on Chinese hackers, based on similar attacks on Pentagon and military computer networks.

Chinese-origin computer attacks, most likely government-sponsored action by hackers, crippled information systems at the Naval War College in Rhode Island in November and forced a similar college wide shutdown.

Chinese hackers also were involved in the electronic theft in 2005 of hundreds of evaluation reports on Air Force officers, ranging from generals to captains. The information in the reports would be valuable to Chinese intelligence for its targeted agent recruitment efforts.

The U.S. Strategic Command, which is in charge of Defense Department computer security, issued an alert Nov. 17, calling for raising the security alert level for about 12,000 Pentagon computer networks and 5 million computers.

[samizdat]

This is a major event.

Gen. Goetze told students that communications were hobbled because the Chinese "took down" the entire Naval War College computer network.