Introduction to Cyber-Warfare - Proiect SEMPER FIDELIS

130 7. WHY CYBER ESPIONAGE IS A KEY COMPONENT OF CHINESE STRATEGYexamining their contents. Once the data were positioned on the staging servers, the hackersprepared it for exfiltration. First, they compressed the data into archive files and encryptedthem. Compression has obvious benefits—reducing the file size to ensure that the transfer proceedsmuch faster. The encryption of the data was an interesting additional step that couldserve multiple purposes. One reason for encryption (as with any data transfer) is that thehackers could be reasonably assured that a third eavesdropping party could not steal the data.A further aspect of encryption is its effect of covering up Team 2’s tracks. Assuming CompanyY would eventually analyze the traffic of the stolen data, it would have no way to know exactlywhat was stolen—making post-incident consequence management very difficult. It is also noteworthythat each of the compressed files was 650 MB in size—suggesting that the hackers werepreparing to copy the stolen data to recordable CDs. Finally, Team 2 renamed the archived filesto resemble innocuous Windows system files in an attempt to avoid detection through casualscans of network traffic and thus alerting system administrators.Exfiltration of the Stolen DataWith the data prepared on the staging servers, the Team 2 hackers were ready to commencewith the portion of Operation X where they assumed the most risk—exfiltration ofthe data. Due to the large amounts of data the attackers wished to steal, this part of the operationwould require them to spend a relatively long time connected to the servers—potentially exposing their actions to security professionals. Forensic analysis of the operationindicates that Team 2 took numerous precautions to ensure that this part of the operationwould go as smoothly as the previous parts. These precautions typically took the form of testruns, checks to ensure that they had adequate bandwidth, and connectivity checks to externalmachines. There is also some indication that Team 2 hackers also rehearsed a portion of theexfiltration task.The Team 2 hackers’ main goal was to upload the information from Company Y’s networksto external Web servers—most likely under control of the hackers—located within the UnitedStates—at least one of which was associated with a U.S. university. There is some forensicevidence that suggests the hackers moved large amounts of the data from the staging serversto “exfiltration hosts” internal to the company—these would be used to forward the stolendata to the external Web servers.The data were uploaded to the external Web servers using a common piece of softwareknown as file transfer protocol or FTP. Initially, Team 2 used a custom-built piece of FTP software(which provided an additional layer of encryption), but this ultimately failed and theyresorted to a standard piece of FTP software. It seemed that the large size of the files hadcaused too many failures, which is why the hackers had to forgo the custom software. It issomewhat ironic that a group skilled enough to penetrate into a large company’s private networkand remain undetected while exfiltrating large amounts of documents, is unable towrite a secure FTP client. Perhaps, this reflects that the level of expertise of the hackers onTeam 2 was not on par with the other team. Perhaps, if they were more highly skilled, theattack would have never been discovered by Company Y.Multiple, redundant file upload sessions were utilized—sending redundant copies of aparticular file of stolen data to multiple hosts. This was most likely done to maximize the