GREG WESTONForeign hackers attack Canadian government
Computer systems at 3 key departments penetrated
By Greg Weston, CBC News
Posted: Feb 16, 2011 8:59 PM ET
Last Updated: Feb 17, 2011 1:05 PM ET
An unprecedented cyberattack on the Canadian government also targeted Defence Research and Development Canada, making it the third key department compromised by hackers, CBC News has learned.
The attack, apparently from China, also gave foreign hackers access to highly classified federal information and also forced the Finance Department and Treasury Board — the federal government's two main economic nerve centres — off the internet.
Defence Research and Development Canada works to assist in the scientific and technological needs of the Canadian Forces. It is a civilian agency of the Department of National Defence.
The cyberattack, first detected in early January, left Canadian counter-espionage agents scrambling to determine how much sensitive government information may have been stolen and by whom.
Highly placed sources tell CBC News the cyberattacks were traced back to computer servers in China.
They caution, however, that there is no way of knowing whether the hackers are Chinese, or some other nationality routing their cybercrimes through China to cover their tracks.
So far, officials in Prime Minister Stephen Harper's government have been all but mum on the extraordinary breach of security.
The government initially issued a terse statement, passing it all off as merely an "attempt to access" federal networks. It has refused to release any further information.
Finance, Treasury Board
The hackers apparently managed to take control of computers in the offices of senior government executives as part of a scheme to steal the key passwords that unlock entire government data systems.
It is unclear whether the attackers were able to compromise other departmental computer networks, including those that contain Canadians' sensitive personal information such as tax and health records.
Michel Juneau-Katsuya, a security analyst and former CSIS intelligence officer, told CBC News on Thursday "all indications point at China" as the origin of the attempted cyber espionage.
He added that any such attack would have some connection to the government in China, which is also known for producing so-called "patriotic hackers" devoted to targeting institutions or governments perceived as threatening to the government at home.
Juneau-Katsuya said he believed Canada is seen by China as "a land of opportunity to get natural resources that they need so, so much."
The Chinese Foreign Ministry denied on Thursday that the Chinese government was responsible for the attack.
Once the attack was detected in early January, Canadian government cybersecurity officials immediately shut down all internet access at the Finance Department and the Treasury Board, in an attempt to stop stolen information from being sent back to the hackers over the net. In an earlier attack, Defence Research and Development had to shutdown access to one of its servers for two months.
The move left thousands of public servants without internet access, although officials in both affected departments report service has slowly been returning to normal since the attack.
While the government is trying to keep the embarrassing security breach under tight wraps, even from its own employees, a number of sources involved in the investigation agreed to speak to CBC News on condition of anonymity.
This extraordinary tale of the Canadian government being targeted in cyber warfare actually began in 2009 with an international investigation by a group of Canadian techno-gurus whose findings shook the security world.
The group, called the Information Warfare Monitor, reported that an electronic spy network based mainly in China had hacked into almost 1,300 government computers in 103 countries.
They called the massive and now-infamous cyberspying operation GhostNet.
While many countries immediately moved to strengthen their defences against potential cyberattacks, it wasn't until the fall of 2010 that the Canadian government went on high-alert against potential electronic intruders.
Leading that task was the Communications Security Establishment Canada (CSEC), a little-known branch of National Defence, and the country's only electronic eavesdropping agency.
Sources say the agency went hunting for any signs the federal government networks might have been compromised.
Turns out they had.
At least two departments, Finance and Treasury Board, and the DND agency, had been compromised the same way the China-based hackers behind GhostNet had penetrated more than 100 other governments around the world.
How it was done
In the world of cybercops, it is called "executive spear-phishing."
Here's how it worked:
Sources say hackers using servers in China gained control of a number of Canadian government computers belonging to top federal officials.
The hackers, then posing as the federal executives, sent emails to departmental technical staffers, conning them into providing key passwords unlocking access to government networks.
'There is nothing particularly innovative about (phishing). It's just that it is dreadfully effective.'—Computer expert
At the same time, the hackers sent other staff seemingly innocuous memos as attachments.
The moment an attachment was opened by a recipient, a viral program was unleashed on the network.
The program hunts for specific kinds of classified government information, and sends it back to the hackers over the internet.
One source involved in the investigation said spear-phishing is deadly in its simplicity: "There is nothing particularly innovative about it. It's just that it is dreadfully effective."
Effective indeed, especially against a government cybersecurity system that has long been described as a sieve.
Auditor-General Sheila Fraser, for one, first raised the alarm in 2002 when she warned "there are weaknesses in the system.
"There are access controls that need to be fixed; there are a whole series of minimum security issues that are not being dealt with. There are vulnerabilities. Government needs to fix them."
Three years later, Fraser checked again and found not much had changed.
"It is important that these things be dealt with and be fixed — the government is vulnerable to attacks."
Evidently, it still is.
Top News Headlines
- 2 men jailed in Dominican wedding fight return to Canada
- Two Canadian men who were detained in the Dominican Republic for nearly three weeks after a post-wedding fight broke out at a resort have returned to Toronto, the latest step in a drama that the wife of one of the men said was "like a scene from the movies." more »
- Senators call for 'zero tolerance' on harassment in RCMP
- The RCMP should amend its code of conduct to explicitly define and prohibit harassment, a Senate committee is recommending in a newly tabled report. more »
- Are e-cigarettes safe to puff?
- As electronic or e-cigarettes grow in popularity, some health advocates want them to be regulated. more »
- Most groups don't want return of Trudeau speaking fees
- Most of the 17 charitable and other organizations that have paid speaking fees to Liberal Leader Justin Trudeau during his time as an MP say they aren't interested in having their fees returned, despite Trudeau's offer on the weekend to reimburse any organization unhappy with his services. more »
Latest Technology & Science News Headlines
- Huge ancient city at Angkor Wat revealed by lasers
- Airborne laser technology has uncovered a network of roadways and canals, illustrating a bustling ancient city linking Cambodia's famed Angkor Wat temple complex. more »
- Google pledges to rid the web of child pornography
- If any one company could conceivably stop the sexual exploitation of children online, Google would be a likely contender - but not even the web's most ubiquitous search engine can tackle such a widespread problem without help. more »
- iPad helps break down barriers for deaf student
- A U.S. pilot study is examining how mobile technology might support the deaf and hard-of-hearing at college. more »
- Experts search Lake Michigan for 17th century shipwreck
- French and U.S. experts searching for the 17th century ship Griffin, which they believe sank in Lake Michigan in 1679. more »
Bob McDonald's Blog
- After Hadfield, who's the next Canadian in space? Jun. 13, 2013 12:01 PM Canada's singing astronaut announced his retirement this week, leaving Jeremy Hansen and David Saint-Jacques to fill his space boots. But there is no date set for when the next Canadian will fly in space.
Quirks & Quarks
- June 15: Quirks Question Roadshow from Halifax Jun. 14, 2013 3:53 PM You provided the questions, and we have the answers on our annual award-winning, brain-teasing, audience-pleasing, Google-seizing Quirks Question Roadshow - this year from Halifax.
- Canadians in Dominican wedding fight freed from jail
- Huge ancient city at Angkor Wat revealed by lasers
- Montreal mayor resigns amid corruption charges
- TV chef Nigella Lawson's husband cautioned by police for assault
- Disabled woman's care before dying on bus still a mystery
- Student with bullied past, 'The Doorman,' graduates
- Parents of son 'brutally beaten' playing hockey want charges
- 'Standing man' inspires new, silent protests in Turkey
- G8 leaders agree to 7-point plan on Syria as summit wraps