Pierluigi Paganini November 26, 2013

U.S.-China Economic and Security Review Commission reported for the first time that cloud computing “represents a potential espionage threat.”

U.S.-China Economic and Security Review Commission reported for the first time that cloud computing “represents a potential espionage threat.” , Chinese hackers are a persistent collector of sensitive information, their action is incessant and represent a serious threat for principal internet services.

According a congressional commission Chinese hackers are increasing targeting high profile companies, including Google, Microsoft and Apple to spy on US.

Last week the U.S.-China Economic and Security Review Commission stated in its annual report to Congress that the Chinese government wages “a large-scale cyber espionage campaign” and “has successfully targeted the networks of U.S. Government and private organizations,”

“Our focus has been on making sure that Defense Department or State Department data, or other government information, is secure,” “To the extent those entities use the cloud as well, we think that they need to get a better grip on who’s actually providing their services and where their data is going.” “If you allow a Chinese entity to provide cloud services then you’re entrusting them with your data,” “That creates with it certain risks.” said William Reinsch, chairman of the commission.

The situation is very concerning, cloud computing paradigm raises security issues related to the way data are managed by service providers,  clouds also provide to attackers powerful platforms for attacks against strategic targets.

The principal concerns are related to the possible exploit made by Chinese hackers of zero-day vulnerabilities present is the cloud architectures, Cloud computing technology could be abused for cyber attacks against military and government networks ensuring anonymity to the attackers.

The US Government is aware of the constant menace moved from China-based hackers, President Obama’s administration has also tried a diplomatic resolution to request Chinese Government in Beijing to adopt necessary measures to stop cyber-attacks originated from its country and that are estimated to cost the US economy as much as $300 billion a year.

The report of the commission wrote that China’s Ministry of State Security, which is the country’s main foreign intelligence collection agency, is “closely connected” to a special cloud-computing zone in the city of Chongqing, of course all the Western companies that use could computing services locate in the area are exposed to the concrete risk that their data are syphoned by Chinese intelligence agencies.

“Developments in cloud computing in China may present cybersecurity risks for U.S. users and providers of cloud computing services. The relationship between China’s Ministry of
State Security and the Chongqing Special Cloud Computing Zone represents a potential espionage threat to foreign companies that might use cloud computing services provided from the
zone or base operations there. In addition, the plan to link 21Vianet’s data centers in China and Microsoft’s data centers in other countries suggests the Chinese government one day
may be able to access data centers outside China through Chinese data centers states the document.”

In a first time the report explicitly referred Microsoft as possible victims of cyber espionage operated by the Chinese government because the US cloud provider has licensed its products to 21Vianet Group Inc. A Beijing-based company selling online data center services.

It seems that Microsoft licenses its Windows Azure and Office 365 products to 21Vianet, but the commission on Nov. 19 backed away from that assertion because it was based on an incorrect report called Red Cloud Rising written by private U.S. Intelligence and security company, Defense Group Inc., based in Vienna, Virginia.

In reality the Chinese company 21Vianet, the Chinese company doesn’t have access to “services and datacenters operated by Microsoft outside of China,” according Doug Hauger, the Microsoft’s general manager for China commercial cloud services.

The commission recommends in its report that Congress direct the Obama administration “to prepare an inventory of existing federal use of cloud computing platforms and services and determine where the data storage and computing services are geographically located.” The inventory should be prepared annually, it said.

The opinion on the report are divided, is security and intelligence specialists fear Chinese cyber threats IT manager believe that the commission’s report could damage a growing industry in China.

China’s cloud computing industry will continue to grow despite the strict control of Internet operated by the government of Beijing and be valued at $163 billion by 2015, Many experts believe IT industry will not be able to seize the opportunity also in terms of security.

Pierluigi Paganini

(Security Affairs –  China, Cloud computing)