Chinese Hackers Target Rights Groups, Say Canadian Researchers

Chinese hackers are attacking activists, journalists and human rights groups using many of the same techniques they apply to steal state secrets and spy on corporations, a Canadian technology research group said on Tuesday.

The difference is that those groups lack resources to defend themselves against sophisticated intrusions and face greater risk from exposure, according to Citizen Lab, which researches the use of political power in cyberspace.

Asked about hacking claims, the Chinese government said it had not seen the report and denied knowledge or involvement in any attacks. China is willing to work to "jointly safeguard peace and security, openness and cooperation in cyberspace," a foreign ministry spokeswoman said.

Malware attacks against ethnic minority groups in China including Tibetans, Uighurs, and religious groups such as Falun Gong date back to at least 2002, said the report by Citizen Lab, based at the University of Toronto.

"There's no doubt about it. This is something that is, if not carefully orchestrated by the government of China, is certainly tolerated by them and they benefit from it," said Citizen Lab director Ron Deibert.

In July, Canada accused China-based operatives of hacking into a government computer network, an accusation China has denied.

(Also See: Notorious Hacktivist Shares Methods, Motives)

The Citizen Lab report analyzed the computer networks of 10 civil society groups over four years; eight specific to China and two global human rights groups.

It said there was evidence a Tibetan group was targeted and a rights group compromised by hackers from Chinese People's Liberation Army (PLA) Unit 61398. The military unit was first identified by U.S. cyber-security company Mandiant.

"They can build up capabilities against less well-defended targets and work their way up to target well-defended large companies," said Nart Villeneuve, a senior researcher at FireEye Inc, which recently acquired Mandiant.

The report said tricking targets into opening infected documents was more relevant to success than technical sophistication. Attacks focused on specific targets, persisted over a period of time, and were motivated by political objectives, it said.

© Thomson Reuters 2014