Operation Titan Rain: China's Cyber Espionage Against the DOD

Introduction

Over the last several years, cyber espionage has become a major problem affecting a wide variety of organizations. Hackers and organized groups are actively seeking to exploit vulnerabilities in security networks. Evidence of this can be seen in attack statistics illustrating the motivations and targets of intrusions. These figures show that cybercrime and espionage are areas that are continually being exploited. What makes this particularly troubling is that organized groups can target specific infrastructure projects that are vulnerable. When this happens, classified information is stolen that could be used to shut down entire networks and infrastructure. The close relationship between private contractors and governmental entities only increases these risks further. ("Cyber Attack Statistics," 2012)

In the case of China, the country has been aggressively involved in a number of cyber attacks against military, public, and civilian targets. One of the most damaging examples is the operation known as Titan Rain. To fully understand what occurred, this paper focuses on three areas: the different aspects of the attack, how it was conducted, and an examination of how the attack could have been prevented. Together, these elements highlight the way such incidents threaten national security and point toward possible strategies for mitigating them.

The threat of cyber espionage is increasing exponentially, driven by dramatic improvements in technology and coding techniques. Over time, nation states have used these advances as tools to steal illicit information from military, government, and private contractors' computers. Recent evidence of this trend can be seen in comments from Jonathan Evans, the Director General of Britain's MI5, who stated: "The amount of hostile activity being generated by foreign states in cyberspace is astonishing. We have investigated threats across the Internet; our personnel are discovering industrial-scale processes involving many thousands of people lying behind both state-sponsored cyber espionage and organized cybercrime." (Blitz, 2012)

Moreover, the Pentagon observed in a report that this threat is becoming increasingly challenging, particularly because one of the primary countries conducting these activities is China. The report noted: "China will continue to be an aggressive and capable collector of sensitive U.S. technological information, including that owned by defense-related companies, and represented a growing and persistent threat to U.S. national security." (Blitz, 2012)

Background: The Rise of State-Sponsored Cyber Espionage

The case involving Titan Rain began in 2003. The Chinese government formed tens of thousands of cyber militias across the country, through which the People's Liberation Army (PLA) recruited part-time civilian hackers to identify vulnerabilities in U.S. and European networks. The basic strategy was to use these individuals to continually target security flaws, exploit them, and steal classified information without being detected. (Witman, 2011)

The way Titan Rain operated was to seek out vulnerabilities using a scanner program that searched for weaknesses inside Department of Defense (DOD) systems. This was accomplished by identifying individual computers that were the most susceptible. After completing the scan, a list of targets was compiled, and hackers would return to steal information without being detected. This process was repeated continuously, targeting any computer deemed vulnerable. The attacks were typically conducted during the night and early morning hours, when the operator was more likely to be away from the machine — giving hackers several hours to go through files. (Thornburgh, 2005)

The following are some of the most significant targets attacked on November 21, 2004:

10:23 PM: The U.S. Army Information Systems Engineering Command at Fort Huachuca, Arizona.

1:19 AM: Defense Information Systems Agency in Arlington, Virginia.

3:25 AM: Naval Ocean Systems Center, a defense department installation in San Diego, California.

4:46 AM: United States Army Space and Strategic Defense installation in Huntsville, Alabama. (Thornburgh, 2005)

How the Titan Rain Attacks Were Conducted

For nearly two years, this group was able to anonymously attack hundreds of DOD computers, gaining access to select amounts of classified information on various operating procedures. Once obtained, such data could be used to exploit future vulnerabilities or to completely shut down entire networks. (Thornburgh, 2005)

As described above, these attacks were conducted using a single scanner program that targeted vulnerabilities on individual computers inside the DOD. This allowed the hackers to compile an updated list of the most susceptible machines. In addition, the program was customized to focus on specific IP addresses, enabling the group to search targeted categories when probing for weaknesses. Once a computer system appeared on the list, hackers would return within one to two days and begin quickly exploiting those weaknesses, stealing as many documents as possible over the course of several hours.

The reason these attacks were conducted was to provide the PLA with information about DOD operating procedures. Individual computers had limited security controls and could provide access to a range of documents. Armed with this information, the hackers could conduct more coordinated attacks in the future. Evidence of this comes from Maj. Gen. William Lord, Director of the Air Force's Office of Warfighting Integration and Chief Information Officer, who stated: "China has downloaded 10 to 20 terabytes of data from the NIPRNet (DOD's Non-Classified IP Router Network). They're looking for your identity so they can get into the network as you. Chinese hackers had yet to penetrate DOD's secret, classified network. This is a nation-state threat by the Chinese." (Onley, 2006)

These comments illustrate a concentrated effort to steal the identities of U.S. military personnel and use them to access classified information. Although the group had not yet succeeded in accessing top-secret material, the probability of achieving that objective only increased over time. (Onley, 2006)

Since Titan Rain, similar attacks have increased in frequency. A notable example was the 2007 attack on Britain's Ministry of Defense computers, which briefly shut down the House of Commons network. In that case, too, individual computers were exploited for their vulnerabilities, and the information collected was then used to conduct subsequent, more devastating attacks. This pattern illustrates how simple scanner programs are effective precisely because they identify and exploit potential weaknesses quietly, during periods of low detection risk. (Taylor, 2007)

These coordinated attacks are designed to steal information and identities that can then be leveraged to gain access to more classified material. Over time, this cycle has led to continuous refinement of attack techniques. Once established at the DOD level, the attacks expanded to target U.S. allies and contractors. In many respects, the simplicity of the techniques — combined with the persistence of system vulnerabilities — is what has made them so successful.

Conclusion

Clearly, cyber espionage is a major threat to the national security of the United States. Rogue and quasi-friendly nations are conducting coordinated attacks targeting DOD systems, government agencies, critical infrastructure, law enforcement, and defense contractors. Over time, these groups have grown increasingly brazen in their efforts.