Google Hack Traced to Chinese Schools

(Feb. 19) -- Investigators examining the cyber-attack on Google and some 30 other U.S. companies have traced the hack to two educational institutions in China -- one of which has close ties to the People's Liberation Army (PLA). The new evidence, published in The New York Times today, is likely to add to mounting suspicion that the attack was ordered by the Chinese government.

The paper also revealed that the companies' computers might have been infiltrated as early as last April. As Google only discovered the "highly sophisticated" cyber-attack -- designed to snatch corporate secrets and messages from human rights activists' e-mail accounts -- in December and went public about it a month later, hackers could have had access to the search giant's systems for up to eight months.

China has yet to comment on these new allegations, although it has previously denied any involvement in the attack. But the hack has led Google to threaten to stop censoring results on its Chinese search engine -- a move seemingly designed to embarrass Beijing, as the Communist Party would almost certainly respond to such a move by shutting down the free Web portal.

According to the anonymous sources quoted by the Times, the so-called Project Aurora assault appears to have involved computers at Shanghai Jiaotong University and the Lanxiang Vocational School in the eastern Shandong province. Investigators had previously traced the attacks only to servers in Taiwan.

The Lanxiang school was founded with military support and is known to be a training facility for PLA computer scientists. When contacted by U.K. daily The Guardian, a spokeswoman for the college denied any involvement in the attack. "Our students are middle school graduates, and we train them to use software like Photoshop," she said. "If our students are so skilled they can hack Google, then what are they here for?"

Jiaotong, meanwhile, is widely regarded as one of the world's best computer studies centers. Earlier this month, students from the college beat rivals from Stanford and Moscow State University to win a prestigious Battle of the Brains programming contest held by IBM in Harbin, China.

On hearing of the college's alleged connection to the hack, the head of the Communist Party's propaganda department at Jiatong told the Times it would start its "own investigation" if the accusation of a link to the school is confirmed.

A professor at Jiaotong's School of Information Security Engineering also told the paper he would not be "surprised" to discover his students had taken part. "Actually, students hacking into foreign Web sites is quite normal [here]," he said. But the professor -- who refused to reveal his name out of fear of reprisal -- added that it was quite possible the attack had merely been rerouted through the college's computers.

Tricks like that could prevent investigators from ever identifying the hack's true source. "All we know is that this computer was involved -- we don't know if there was a human in front of the keyboard," Bruce Schneier, chief security technology officer at BT Group, told The Wall Street Journal. "It doesn't mean it began there."

Indeed, it's common practice for hackers to use multiple sets of computers around the world as intermediaries. Zombie PCs can be controlled with viruses and other tools, allowing attackers to mask their true identity and location.

And these sorts of Web attacks are growing in sophistication and scope all the time. On Thursday, computer security firm NetWitness revealed that computers at 2,500 companies and government agencies around the world had been hacked into by cybercriminals based in Europe and China. The so-called "Kneber botnet" allowed the hackers to make off with everything from intellectual property to credit card transactions.

"While Operation Aurora shed light on advanced threats from sponsored adversaries, the number of compromised companies and organizations pales in comparison to this single botnet," said NetWitness CEO Amit Yoran. "These large-scale compromises of enterprise networks have reached epidemic levels."