Chinese hackers broke into NSA, service chiefs’ comps

More than 200 computers belonging to top-ranking government officials, including the three service chiefs and former national security advisor (NSA) MK Narayanan, were compromised in the hacking operation that originated in China on December 15, it has emerged. Security agencies now believe that the operation was bigger in scale than earlier believed.

In a shocking revelation, sources close to the security agencies probing the matter have revealed that computers of cabinet secretary KM Chandrashekhar and former deputy NSA Shekhar Dutt were also penetrated. The agencies claim that the hacked computers were not part of a secure data and communication network used by the top officials.

The agencies have culled more than 200 internet protocol (IP) addresses — a unique number assigned to a particular computer attached to a network — which were accessed by the Chinese after penetrating the computers.

Sources disclose that the computer of at least one service chief was totally compromised as he opened the malicious mail sent with a PDF document carrying a hidden ‘trojan’ spyware.

The mail was sent from a dormant ‘.nic.in’ email account belonging to a retired ministry of external affairs official that was hacked at the first instance. However, when the attack was detected, cyber experts from National Technical Research Organisation (NTRO) and National Informatics Center (NIC) swung into action. They mapped all the links of the hacking operation which ultimately led them to China.

According to the sources, there is a strong possibility that the hackers behind the December 15 operation had some kind of government support since all the email accounts hacked are of top officials. These are official email accounts and are hosted on the servers of the NIC (that’s why they end with ‘.nic.in’).  Sources in security agencies also tell that Indian official servers have long been the target of hacking operations, especially from China as India tops the list of its rivals. This time, Chinese hackers used botnet servers based in Russia to launch the attack on computers of government officials.