Clues in Marriott hack implicate China - sources

[Swordsmyth]

Hackers behind a massive breach at hotel group Marriott International Inc <MAR.O> left clues suggesting they were working for a Chinese government intelligence gathering operation, according to sources familiar with the matter.Marriott said last week that a hack that began four years ago had exposed the records of up to 500 million customers in its Starwood hotels reservation system.
Private investigators looking into the breach have found hacking tools, techniques and procedures previously used in attacks attributed to Chinese hackers, said three sources who were not authorized to discuss the company's private probe into the attack.
That suggests that Chinese hackers may have been behind a campaign designed to collect information for use in Beijing's espionage efforts and not for financial gain, two of the sources said.
While China has emerged as the lead suspect in the case, the sources cautioned it was possible somebody else was behind the hack because other parties had access to the same hacking tools, some of which have previously been posted online.
Identifying the culprit is further complicated by the fact that investigators suspect multiple hacking groups may have simultaneously been inside Marriott computer networks since 2014, said one of the sources.
The Chinese Embassy in Washington did not return requests for comment.


Marriott spokeswoman Connie Kim declined to comment, saying "We've got nothing to share," when asked about involvement of Chinese hackers.
Marriott disclosed the hack on Friday, prompting U.S. and UK regulators to quickly launch probes into the case.
Compromised customer data included names, passport numbers, addresses, phone numbers, birth dates and email addresses. A small percentage of accounts included scrambled payment card data, said Kim.
Marriott acquired Starwood in 2016 for $13.6 billion, including the Sheraton, Westin, W Hotels, St. Regis, Aloft, Le Meridien, Tribute, Four Points and Luxury Collection hotel brands, forming the world's largest hotel operator.
The hack began in 2014, shortly after an attack on the U.S. government's Office of Personnel Management (OPM) compromised sensitive data on tens of millions of employees, including application forms for security clearances.
White House National Security advisor John Bolton recently told reporters he believed Beijing was behind the OPM hack, a claim first made by the United States in 2015.
Beijing has strongly denied those charges and also refuted charges that it was behind other hacks.
Former senior FBI official Robert Anderson told Reuters that the Marriott case looked similar to hacks that the Chinese government was conducting in 2014 as part of its intelligence operations.
"Think of the depth of knowledge they could now have about travel habits or who happened to be in a certain city at the same time as another person," said Anderson, who served as FBI executive assistant director until 2015.
"It fits with how the Chinese intelligence services think about things. It's all very long range," said Anderson, who was not involved in investigating the Marriott case and is now a principal with Chertoff Group.
Michael Sussmann, a former senior Department of Justice official for its computer crimes section, said that the long duration of the campaign was an indicator that the hackers were seeking data for intelligence and not information to use in cyber crime schemes.
"One clue pointing to a government attacker is the amount of time the intruders were working quietly inside the network," he said. "Patience is a virtue for spies, but not for criminals trying to steal credit card numbers."
FBI representatives could not immediately be reached for comment on the evidence linking the attack to China. A spokesperson said on Friday that the agency was looking into the attack, but declined to elaborate.

More at: https://www.yahoo.com/news/exclusive...--finance.html

[AZJoe]

In light of the Wikileaks Vault 7, Vault 7, and project Marble revelations - the hack implicates the NSA and CIA left clues to implicate China.

The source code released reveals Marble contains test examples in Chinese, Russian, Korean, Arabic and Farsi.

“This would permit a forensic attribution double game, for example by pretending that the spoken language of the malware creator was not American English, but Chinese, but then showing attempts to conceal the use of Chinese, drawing forensic investigators even more strongly to the wrong conclusion,”
Wikileaks: Marble

--------------------------

From ActivitPost:

With each release from these Vault 7 leaks, it becomes more apparent that everything we thought the CIA might get in this 1984-esque world — they already have. ...

Over the course of the last 4 months, the deep state has claimed — without evidence — that Russia has interfered in US elections. With this technology, the CIA could theoretically present the evidence it needs to “prove” Russian meddling. ...

the CIA could create a virus that would potentially devastate entire systems — and then blame it on anyone they want.

As Leak of Nations reports, in the second batch of ‘Vault 7’ documents, WikiLeaks released a user guide for Sonic Screwdriver – an implant on the Apple Thunderbolt-to-USB converter that allows code to be booted onto an attached device, even if the device is password-protected. What this means is that the CIA can infect the firmware of Macs at the core of the system with a trojan horse. Having a proverbial ocean of computers to choose from, the CIA could then pick one of those infected computers, launch an attack, use Marble to cover it up and blame it on whomever they wish.

It is no wonder Ubuntu founder Mark Shuttleworth called this “a trojan horse of monumental proportions.”

For now, however, the only one to be caught hacking US elections is the Department of Homeland Security. As the Free Thought Project previously reported, the Department of Homeland Security, under the Obama administration, attempted to hack the Indiana State electoral system nearly 15,000 times.

Prior to the hacks in Indiana, it was the State of Georgia to expose DHS meddling in their elections. ...
http://www.activistpost.com/2017/03/...n-chinese.html

--------------------

Our National Police State.
Slay the Monster: http://ronpaulinstitute.org/archives...-police-state/

the power of the Deep State is even more forbidding – and seemingly invincible – than anyone knew. Joyful anticipation because, for the first time,... it is dawning on the most unlikely people that we are, for all intents and purposes, living in a police state. …

The material in “Vault 7” is extensive: it ranges from examining the ways in which a Samsung television set that is seemingly turned off can be – and no doubt has been – used to spy on the conversations and activities of a room’s occupants, to the various ways in which our spooks infiltrate and subvert common electronic devices, such as the iPhone, in order to gather information. “Infected phones,” we are told in the introduction to the material, “can be instructed to send the CIA the user’s geolocation, audio and text communications as well as covertly activate the phone’s camera and microphone.” The CIA is even working on remotely controlling the electronic steering systems installed in cars – a perfect route to pulling off an assassination that looks like an “accident.” Not that the intelligence services of the “leader of the Free World” would ever consider such an act. ...

As these viruses and other invasive programs are unleashed on an unsuspecting public, they fall into the hands of a variety of bad actors: foreign governments, criminals, and teenagers on a lark ... This plague is being spread over the Internet by a veritable army of CIA hackers: “By the end of 2016 … the CIA’s hacking division, which formally falls under the agency’s Center for Cyber Intelligence (CCI), had over 5000 registered users and had produced more than a thousand hacking systems, trojans, viruses, and other ‘weaponized’ malware.” The inevitable end result: a world infected with so much malware that computers become almost useless ... In short, a war that made us less safe. ...

[CIA/NSA False Flag Hacking and Spying] the CIA’s Remote Devices Branch’s “Umbrage group,” ... “collects and maintains a substantial library of attack techniques ‘stolen’ from malware produced in other states including the Russian Federation.” The idea is to mask the Agency’s cyberwar operations … The process of attribution, WikiLeaks explains, is “analogous to finding the same distinctive knife wound on multiple separate murder victims. The unique wounding style creates suspicion that a single murderer is responsible. As soon one murder in the set is solved then the other murders also find likely attribution.” … It simply draws on computer code used by its adversaries ... and inserts it into its own handcrafted malware and other invasive programs, thus leaving Russian (or Chinese, or North Korean) fingerprints on the handiwork of CIA hackers. … So now we learn that the CIA has perfected the art of imitating its rivals, mimicking the Russians – or whomever – in a perfect setup for a “false flag” scenario. ...

We have created a monster, a Deep State with such unchecked power, armed with such Orwellian technology, that it represents a clear and present danger to our constitutional republic. This threat is underscored not only by the latest WikiLeaks revelations, but also by the intelligence community’s intervention in our domestic politics, which has been documented in the headlines of the nation’s newspapers for the past few months. … Accelerated by our foreign policy of perpetual war, the national security bureaucracy has accumulated immense power, and our elected leaders have neglected to provide any oversight. Indeed, they are at its mercy. ...

Either we slay the monster or it will enslave us.



--------------------

[euphemia]

The Starwood group (think Sheraton) was the group the Chinese were bidding on when Marriott bought it. I don’t remember all the details, but the announcement was made, then another announcement came out saying it wasn’t definite until the Chinese signed off. Finally they did, so it doesn’t surprise me that this would be the portion of Marriott properties that was hacked.