Wall Street Journal says it has also been hacked
A day after the New York Times revealed that its network and the computers of 53 of their employees have been compromised by hackers believed to be based in China, the Wall Street Journal disclosed that it has, too, been targeted by what could well be the same or affiliated group of attackers.
The Journal shared that the attackers managed to infiltrate its global computer system by initially targeting the journalists and the chief of its Beijing bureau. As with the NYT intrusions, the attackers weren’t after customer data or information that would help them gain commercial advantage.
Ever since the intrusion was first spotted, the Journal has been working with the authorities and outside security specialists to boot out the attackers and to secure its networks against future attacks. The effort took some time, but it was finally completed on Thursday, stated Paula Keve, a spokeswoman for Journal publisher Dow Jones.
Following these disclosures, a number of other media corporations such as Bloomberg LP and Thomson Reuters shared stories of attempted and successful intrusions into their networks in the past year, definitely confirming that the attacks against NYT weren’t isolated, but a part of a greater strategy.
“The Communist Party really fears information and they can see their control unraveling as people read about corruption and officials with huge bank portfolios,” commented cybersecurity advisor James Lewis. “Information is an existential threat to these regimes.”
Richard Bejtlich, CSO of Mandiant, says that the Chinese want to know what the West thinks of them first, but they also want to know who are the sources tapped by foreign journalists.
He also noted that the group that attacked the NYT is only one of the many APT groups whose activities they have been following.
The NYT’ attack and the news outlet’s willingness to publicly share details about it has been welcomed by security experts. They already know that intrusions by organized and persistent attackers such as these are difficult to avoid, and this sharing will hopefully be a wake up call for many.
The one thing that has definitely been proved true is that these types of attacks can’t be stopped unless the targets set up multilayered defenses. Commercial AV solutions – especially those relying mostly on signature-based detection – can’t be counted on detecting custom malware that is often used by these type of attackers.