China May Be Reading Your Emails

A recent academic report claims that China has been routinely and systematically hijacking internet traffic from the United States, Canada, Europe and other countries through security flaws in the deep structure of the internet. 

To put it simply, somebody in Beijing may be receiving and reading your emails before you do, as well as capturing your passwords and other personal data from websites you visit.

China’s Maxim – Leave No Access Point Unexploited: The Hidden Story of China Telecom’s BGP Hijacking,” by Chris C Demchak of the US Naval War College and Yuval Shavitt of Tel Aviv University. 

The report alleges that a voluntary US-China 2016 agreement, which aimed to stop military forces from hacking commercial enterprises for economic gain, has appeared to reduce Chinese Internet theft against western targets. 

However, as the report also notes, China’s technological development still continues to be “dependent on massive expropriation of foreign R&D.”

An ‘innocuous player’

As Chinese companies such as Huawei and ZTE are viewed with suspicion in the West, the Chinese government has chosen what the researchers call “a seemingly innocuous player” to reroute, or hijack, internet traffic. The so-called “innocuous player” is state-owned China Telecom, a telecoms giant with close to 300,000 employees.

To understand how China Telecom has been able to divert internet traffic to China and copy it, as the report claims, it is necessary to delve briefly into the obscure world of the internet’s foundational infrastructure.

Essentially, China Telecom has numerous Points of Presence (PoP) in the US and Europe. Think of a PoP as a delivery system that ensures that “packages” sent via the internet reach their intended destinations as efficiently as possible. They are delivery services that connect all the smaller networks that comprise the overall internet.

The small networks are called autonomous systems and could be anything from banks and tech giants to your local Internet Service Provider.

On the other hand, overseas telecoms are barred from operating PoPs in China. The country has just three gateways, in Beijing, Shanghai and Hong Kong. This protects China’s domestic traffic from foreign hijacking.

Meanwhile, enter Border Gateway Protocol (BGP), the key Internet routing protocol for connecting the innumerable autonomous systems that comprise the internet.

Insecure protocol

“BGP is a notoriously insecure protocol used to route internet traffic,” comments Cory Doctorow, a respected technology pundit. Doctorow continues: “By design it is dynamic and responsive, moving traffic away from congested routes and onto those with more capacity: this flexibility can be exploited to force traffic to route through surveillance chokepoints.”

BGP was developed in 1989 – when the internet was generally perceived as an emergent technology bringing the world closer together. It was also the same year that the internet first began to be used in China. In fact, the country did not start to fully implement the internet, and on a negligible scale, until 1994, when China was still widely regarded as a benign backwater.

China is rightly no longer regarded as benign or a backwater, and its hijacking activities are difficult to detect. China Telecom has multiple points of presence (PoPs) in North America and Europe and rerouting traffic via ultra-fast fiber-optic cables causes delays to be almost unnoticeable.

All the same, the report is not exactly news. BGP exploits are probably more common than is largely realised and are probably used by all state players capable of doing so, notably Russia.

But China is regarded as a particularly egregious player. In 2010, for example, the US-China Economic and Security Commission reported to the US Congress on such “hijacks” in a 300-page report that included information on an incident in which 15% of global Internet traffic suddenly started to pass through Chinese servers en-route to its intended destinations, according to Ars Technica, a technology-focused news website.

Malicious Intent 

This would be less problematic if all internet traffic were highly encrypted. Unfortunately, some of it is not. But as the researchers also note: “If diverted and copied for even small amounts of time, even encrypted traffic can be broken.”

In the meantime, the attacks continue and will likely continue to do so. The researchers describe the hijacks as “repetitive,” suggesting “malicious intent.”

Events documented by the report include a six-month period from February 2016, when traffic from Canada to South Korea was “hijacked by China Telecom and routed through China” and a similar incident in which traffic from several locations to the US to “a large Anglo-American bank headquarters in Milan, Italy was hijacked by China Telecom to China.”

If there is any key takeaway from reports such as this, it is that the internet, which has revolutionised modern life, was built on trust. We now live in untrusting times.

Asia Times:

You Might Also Read:

China Compromises Tech Companies With Malicious Microchips

« Why Has The US Not Been Hit With A Devastating Cyber Attack?
China Has “taken the gloves off” In Hacking Attacks »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

Watch this webinar to hear security experts from Amazon Web Services (AWS) and SANS break down the myths and realities of what an NGFW is, how to use one, and what it can do for your security posture.

Pyramid Computer

Pyramid Computer

Pyramid Computer provides custom enterprise solutions for Industrial PC, Imaging, Network, Security, POS, Indoor Positioning and Automation.

Georgia Cyber Center

Georgia Cyber Center

Georgia Cyber Center is dedicated to training the next generation of professionals through education and real-world practice while also supporting innovation in new technologies for online defenses.

Virtru

Virtru

Virtru's Data Protection platform protects and controls sensitive information regardless of where it's been created, stored or shared.

Greensafe IT

Greensafe IT

Greensafe offer various onsite and offsite data erasure services, aimed at increasing data security whilst reducing any risk of data loss during transit.

Hut Six Security

Hut Six Security

Train, test and track your Information Security culture through information security awareness training and customised phishing simulation campaigns.

Yellow Brand Protection

Yellow Brand Protection

Yellow Brand Protection operates 24/7 to protect brands' Intellectual Property (IP) from infringements on all kinds of online distribution channels.

Diateam

Diateam

Diateam is an R&D company specializing in computer security. Diateam develops highly innovative cyber range platforms and Industry-leading systems for cybersecurity training and testing labs.

Binary Defense

Binary Defense

Binary Defense protect businesses of all sizes through advanced cybersecurity solutions including Managed Detection and Response, Security Information and Event Management and Counterintelligence.

LTIMindtree

LTIMindtree

LTIMindtree is a new kind of technology consulting firm. We help businesses transform – from core to experience – to thrive in the marketplace of the future.

Kinetic Investments

Kinetic Investments

Kinetic Investments is a venture capital firm dedicated to early-stage companies that are transforming the digital landscape.

Defscope

Defscope

Defscope is an Azerbaijani company entirely focused on cybersecurity offering training, security consulting, and other professional services.

CyberAcuView

CyberAcuView

CyberAcuView is a company dedicated to enhancing cyber risk mitigation efforts across the insurance industry.

NexGen Cyber

NexGen Cyber

NexGen Cyber helps customers in commercial SMB markets with IT security, security integration, service management, outsourced service transition, and transformative security solutions.

Paperclip

Paperclip

Paperclip provides paperless solutions while enabling compliance and security for the exchange of critical content.

EPAM Systems

EPAM Systems

Since 1993, EPAM Systems has leveraged its advanced software engineering heritage to become a leading global digital transformation services provider.

Frontier Technology Inc. (FTI)

Frontier Technology Inc. (FTI)

Frontier Technology Inc provides the technology and deep data expertise to drive the best defense and intelligence solutions.