Night Dragon Hack-Attacks Connected to Industrial Accidents?

We hear about industrial accidents and explosions all the time. Here is a recent example from Turkey:

At least seven people were killed and 34 injured Thursday in an apparent accidental explosion at a factory in Turkey's capital Ankara, media reports said.

The death toll was likely to rise because several people were still believed to be buried under the rubble left by the explosion....The powerful explosion is believed to have been caused by a worker's mishandling of oxygen tanks at the factory, which employed at least 80 people in manufacturing hydraulic machinery. _MAC

But such accidents begin to take on new possible meanings as knowledge about the Chinese "Night Dragon" intrusions and the Stuxnet worm become more widely known. The Stuxnet worm took control of target machines in Iranian uranium enrichment facilities, causing them to behave erratically and destroy themselves. The Chinese Night Dragon attacks and intrusions are likewise capable of taking control of target machines:

...a [Chinese] company that, according to the company’s advertisements, provides “Hosted Servers in the U.S. with no records kept” for as little as 68 RMB (US$10) per year for 100 MB of space. The company’s U.S.-based leased servers have been used to host the zwShell C&C application that controlled machines across the victim companies.

...McAfee has determined that all of the identified data exfiltration activity occurred from Beijing-based IP addresses and operated inside the victim companies weekdays from 9:00 a.m. to 5:00 p.m. Beijing time, which also suggests that the involved individuals were “company men” working on a regular job, rather than freelance or unprofessional hackers. In addition, the attackers employed hacking tools of Chinese origin and that are prevalent on Chinese underground hacking forums. These included Hookmsgina and WinlogonHack, tools that intercept Windows logon requests and hijack usernames and passwords. _Forbes

The targets of Night Dragon included oil & gas companies which operate refineries -- refineries that are subject to exploding if their controls malfunction. The same is true for many chemical plants, and other types of industrial plants. Machinery at most modern factories is networked, to allow for highly automated operation. Anyone who can hack into the network and take control of the machines can also take control of the destiny of that plant.

Industrial work is already extremely hazardous, as jobs go. But in the highly-networked age, where sensitive machinery is controlled remotely via the net, there is one more hazard to worry about.

As Obama and his allies press for a highly networked "smart grid" which is meant to grow more reliant on inherently unreliable wind power, the hazards for society at large only grow larger.

What's In It for China?

According to the report, the intruders used widely available attack methods known as SQL injection and spear phishing to compromise their targets. Once they gained access to computers on internal company networks, they would install remote administration software that gave them complete control of those systems. That made it possible for the intruders to search for documents as well as stage attacks on other computers connected to corporate networks.

In addition to their parallels to the Google attacks of last year, the intrusions resembled a Chinese-based electronic espionage network that was found in 2009 and named GhostNet. In that case, researchers at the Munk Center for International Studies at the University of Toronto uncovered an elaborate network aimed at government computers as well as those of nongovernmental organizations like the office of the Dalai Lama. The researchers concluded that the control servers of the attack system were based on the island of Hainan, which is part of China. _NYT

It is bad enough that tin-pot oil dictatorships such as Venezuela and Russa systematically lure international oil&gas companies into partnerships -- only to nationalise all of the multinational's in-country assets. Over and over again. Now China has been caught red-handed attempting to use computer hacking tools to disrupt multinational oil & gas operations. What is in it for the Chinese?

At least five multinational oil and gas companies suffered computer network intrusions from a persistent group of computer hackers based in China, according to a report released Wednesday night by a Silicon Valley computer security firm.

...Operating from what was a base apparently in Beijing, the intruders established control servers in the United States and Netherlands to break into computers in Kazakhstan, Taiwan, Greece and the United States, according to a report, “Global Energy Cyberattacks: ‘Night Dragon.’ ”

The focus of the intrusions was on oil and gas field production systems as well as financial documents related to field exploration and bidding for new oil and gas leases, according to the report. The attackers also stole information related to industrial control systems, the researchers noted, but no efforts to tamper with these systems were observed.

McAfee executives declined to name the victim companies, citing nondisclosure agreements it signed before being hired to patch the vulnerabilities revealed by the intrusions. Last year, when Google announced that intellectual property had been stolen by Chinese intruders, it expressed frustration that while it had observed break-ins at a variety of other United States companies, virtually none of the other companies were willing to acknowledge that they had been compromised. _NYT

The opportunities for western oil&gas companies seem to be expanding almost exponentially, given new drilling and exploration techniques. Oil & gas production in the US and elsewhere around the world are set to rise as a result, with much growth in exploration and production sectors.

What can China expect to gain from disrupting western and multinational oil & gas enterprises? Is is nothing more than a show of force projection, far beyond Chinese borders? Is it a warning? Or is it rehearsal and preparation for a more integrated effort to disrupt western energy supplies and critical information systems?

China is known for its industrial sabotage, its product counterfeiting, its outright theft of technologies from partners, and its iron-fisted control over information sources and expression inside its borders. Is China experimenting with similar exertion of control over global information streamways, with a hoped-for domination over energy, financial, information, and political flow of data?

Clearly, with China one must never let down his guard.

Cross-posted to Al Fin Energy

More: Brian Wang looks at China's ambitious plans for innovative -- perhaps technologically revolutionary -- change over the next decade. According to Brian, "Special emphasis is on four key areas, namely space science, information technology, energy and health." In addition, China is looking at US$ 1.5 trillion in investments into other potentially disruptive technologies.

The western world runs on high-speed information. Were China to learn to tap into, control, or largely disrupt the massive flow of information which forms the foundation of modern western prosperity, the entire global future would be up for grabs.