Brian Krebs 2 February 2013 (krebsonsecurity)
Source: Washington Post Also Broadly Infiltrated By Chinese Hackers in 2012The Washington Post was among several major U.S. newspapers that spent much of 2012 trying to untangle its newsroom computer networks from a Web of malicious software thought to have been planted by Chinese cyberspies, according to a former information technology employee at the paper.
On Jan. 30, The New York Times disclosed that Chinese hackers had persistently attacked the Gray Lady, infiltrating its computer systems and getting passwords for its reporters and other employees. The Times said that the timing of the attacks coincided with the reporting for a Times investigation, published online on Oct. 25, that found that the relatives of Wen Jiabao, China’s prime minister, had accumulated a fortune worth several billion dollars through business dealings.
The following day, The Wall Street Journal ran a story documenting similar incursions on their network. Now, a former Post employee is coming forward with information suggesting that Chinese hacker groups had broadly compromised computer systems within the Post’s newsroom and other operations throughout 2012.
According to a former Washington Post information technology employee who helped respond to the break-in, attackers compromised at least three servers and a multitude of desktops, installing malicious software that allowed the perpetrators to maintain access to the machines and the network.
“They transmitted all domain information (usernames and passwords),” the former Post employee said on condition of anonymity. “ We spent the better half of 2012 chasing down compromised PCs and servers. [It] all pointed to being hacked by the Chinese. They had the ability to get around to different servers and hide their tracks. They seemed to have the ability to do anything they wanted on the network.”
The Post has declined to comment on the source’s claims, saying through a spokesman that “we have nothing to share at this time.” But according to my source, the paper brought in several computer forensics firms – led by Alexandria, Va. based Mandiant - to help diagnose the extent of the compromises and to evict the intruders from the network. Mandiant declined to comment for this story.
Update, Feb. 2, 7:42 a.m. ET: The Post has published its own story confirming my source’s claims.
The former Post employee also noted that experts from the National Security Agency and Defense Department took one of the Post’s servers for forensic analysis.FullBlogWall Street JournalwsjBillions in Hidden Riches for Family of Chinese Leader
