Israeli cyberexpert detects China hack in Ottawa, warns against using Huawei 5G

SHANGHAI CHINA – NOVEMBER 1, 2016: China Telecom. China Telecom is is an integrated information full services operator in China. (TK Kurikawa / Shutterstock.com)

OTTAWA — A Chinese telecommunication company secretly diverted Canadian internet traffic to China, particularly from Rogers subscribers in the Ottawa area, says an Israeli cybersecurity specialist.

The 2016 incident involved the surreptitious rerouting of the internet data of Rogers customers in and around Canada’s capital by China Telecom, a state-owned internet service provider that has two legally operating “points of presence” on Canadian soil, said Yuval Shavitt, an electrical-engineering expert at Tel Aviv University.

Shavitt told The Canadian Press that the China Telecom example should serve as a caution to the Canadian government not to do business with another Chinese telecommunications giant: Huawei Technologies, which is vying to build Canada’s next-generation 5G wireless communications networks.

“It’s too dangerous to let them in,” Shavitt said. “You can just imagine how Chinese companies are co-operating with the Chinese government.”

The Trudeau government is still deciding whether Huawei will be permitted to supply equipment and services to Canadian companies seeking to build the networks expected to serve everything from smartphones to autonomous cars.

That has become a politically charged decision with massive geopolitical implications since Canada arrested Huawei’s chief financial officer last month at the request of the U.S. It sparked a diplomatic crisis with the People’s Republic that has seen the jailing of two Canadian men working in China, and a death sentence imposed on a third man previously convicted of drug charges.

Shavitt’s warning comes as the U.S. Justice Department this week revealed the scope of its fraud and theft case against Huawei’s Meng Wanzhou. On Monday, the department unsealed 13 criminal counts of conspiracy, fraud and obstruction against Meng, while her company’s U.S. branch was accused of stealing trade secrets and equipment from cellphone provider T-Mobile USA.

Huawei has denied that it co-operates with Chinese intelligence or ever would, saying that could be fatal to the company.

The 2016 Ottawa area incident that included Rogers was part of an attack in which Canadian internet data bound for South Korea was rerouted to China over a six-month period. The diversion of the South Korean data was first documented in a report last fall co-authored by Shavitt and Chris C. Demchak of the U.S. Naval War College.

The report described how China Telecom uses two points of presence in Canada and eight in the United States to take “information-rich” internet traffic crossing its network — part of the ordinary working of the internet, in which packets of data pass through numerous servers on the way to their destinations — and reroute it through China with no noticeable effect on customers.

China Telecom did not respond to a request for comment.

Rogers declined comment and referred the matter to the Public Safety Department. Public Safety did not respond to requests for comment.

A spokesman for Global Affairs Canada said the government “takes very seriously threats to Canada’s national and economic security,” exchanges information regularly with private internet companies and has meetings with China on the subject, too.

“Canada raises such issues with China regularly,” Guillaume Berube said in an email. “The topic of cyber hacking will be a priority when the Canada-China National Security and Rule of Law Dialogue meets next.”

The Shavitt-Demchak report called internet points of presence the “perfect scenario for long-term espionage” because local alarm bells won’t be raised “about the long-term traffic detours.”

The Canada-South Korea diversion was discovered by a company Shavitt co-founded called BGProtect that monitors internet routing infrastructure and sells services to protect countries and corporations from internet hacks. He said he used some of his company’s data to write the academic paper with Demchak.

Shavitt described how hundreds of his company’s agents around the world monitor movements in the digital world. He said that could involve focusing on “a certain installation, an IP or server. We pick up locations around the world, and monitor the traffic and look for anomalies.

“In this case the anomaly was from Canada.”

In a followup email, Shavitt provided further details: “Our software agent was indeed at Ottawa, but the attack had affected the entire Rogers network (at least) and its customers in the entire region.”

Shavitt said his company’s monitoring of Canada “was not dense enough” at the time of the attack to assess its full scope.

In the case of national network like Rogers’ in a large country such as Canada, the attack might affect only a “portion of the network, (but) usually still quite large ones — it depends how routing is configured.

For example in our case, it may affect only Ontario and Quebec, but not the western regions of Canada,” Shavitt explained.

“I should say that the effect of the hijack is not only on Rogers’s direct customers (home and businesses) but also smaller networks in the affected regions that depend on Rogers for transit.”

A hijack attack can be used in many ways, including for espionage by “extracting important information from communication,” said Shavitt.

The attack can also be part of what is known as man-in-the-middle attacks, he said.

A man-in-the-middle attack can neutralize an organization’s internet security measures because it involves the insertion of a “bad actor” between a sender and the desired recipient, says the Shavitt-Demchak report.

When the internet traffic is rerouted into an adversary’s hands, “the attacker can learn enough to impersonate trusted sources” and “can allow the malicious attacker to harvest passwords,” the report says.

“With those keys to the victim’s network in hand, attackers can distort, disconnect or destroy any part of the company’s network accessible from the internet, increasingly to include critical financial and physical systems and their backups.”

The Chinese government steadfastly denies engaging in cyberattacks.

In 2014, the federal government blamed a sophisticated state-sponsored Chinese entity for a breach that caused a shutdown of the National Research Council’s systems in Ottawa. China called that accusation reckless.

In 2016, the Canadian Security Intelligence Service, or CSIS, warned that China and Russia were targeting Canadian government officials and information systems as well as classified information and advanced technology.

Without naming any countries, David Vigneault, CSIS’s new director, said in a December speech that “hostile foreign intelligence services” were targeting the “corporate secrets” and “intellectual property” of Canadian companies.

Vigneault said those state actors posed a greater threat to national security than terrorists do.

“It’s not that the Chinese are bad, or doing bad things in the U.S.,” Shavitt noted. “I’m sure that the U.S. and Canada are trying to do the same also to China. It’s a spying game that everybody’s trying to play.”