The Washington Post reports today that Chinese hackers have recently targeted computers of the Commerce Department's Bureau of Industry and Security.
Here's how the Post describes the latest break-in:
A source familiar with the security breach said the hackers had penetrated the computers with a "rootkit" program, a stealthy form of software that allows attackers to mask their presence and then gain privileged access to the computer system. The attacks were traced to Web sites registered on Chinese Internet service providers, Commerce officials said. "We determined they were owned by the Chinese," a senior Commerce official said. He did not say who in China was responsible or whether officials had even been able to identify the culprits. Although bureau employees were informed of the problem in July, commerce officials declined to say when the attacks were discovered and how long they had been going on. Only over time did bureau officials realize the extent of the damage from the breach.
According to the Post, the State Department confirmed in July that it had experienced similar break-ins both in Washington and in overseas offices, and "Last year, U.S. officials reported that the Defense Department and other U.S. agencies were under relentless attack from unidentified computers in China."
This fits with something I recently heard from somebody who has long worked in Washington's China policy circles. A number of his contacts in various U.S. government agencies have recently been receiving e-mails that appeared to be sent from his e-mail address, including cleverly-labeled attachments with titles indicating subject matter that he might actually be inclined to share or discuss with these people. Except that they weren't from him - whoever sent them was spoofing his address, and the attachments contained malicious software that would enable somebody to take remote control of the computer of whoever was unfortunate enough to open the attachment....
So if you happen to be one of those people who follow China for a living, watch out for attachments even if they seem to come from people you know well and trust. If you weren't expecting them to send you an attachment, it's best to e-mail the person back and check to make sure they really did send the e-mail, and that the attachment really came from them.
Another good reason to get a Mac...