Global miner BHP Billiton Ltd’s boss, Marius Kloppers, confirmed he had harboured concerns about Chinese and competitor espionage on his business, citing it as a reason behind his push for market pricing of key commodities.
Mr Kloppers, who runs the world’s biggest miner, once offered to trade intelligence on China with Washington after telling a US diplomat about the extent of Chinese surveillance of his firm, reports claimed said this week.
The Sydney Morning Herald, citing diplomatic cables obtained from WikiLeaks, said Mr Kloppers had confessed his concerns to the Australia-based envoy in 2009, at a time when he was pushing Chinese customers to switch from closed-door annual price negotiations to more market-based pricing.
Asked on Wednesday to confirm whether he was concerned about espionage from China and from competitors such as rival miner Rio Tinto , Kloppers told an earnings briefing: “I would rather like to put that in a positive.”
“One of the reasons we have pushed so hard for market-clearing prices is so that these sorts of things are not a concern, because if you sell your product at the market-clearing price, that everybody can read off screens, it minimises any impact of differential information that the one party or the other may hold,” he said.
“So you produce at full capacity and you sell at the market price and you should, from those comments, really understand why we have pushed so hard to get the market-clearing price.”
Mr Kloppers led a successful battle over the past two years to move pricing of iron ore sales away from annual negotiations, despite resistance from Chinese steel mills which buy more than $US25 billion ($A24.9 billion) of the raw material a year from Australia alone.
Negotiators involved in the annual talks – a system now replace by quarterly market-based pricing – relied heavily on good industry intelligence to strike the best annual bargain, and the negotiations were often tense and full of intrigue.
Tensions peaked in 2009 when Chinese steel producers failed to clinch an annual pricing deal and a Shanghai court jailed four Rio Tinto Ltd employees, including Australian citizen Stern Hu, for stealing commercial secrets and taking bribes.
The arrest of Mr Hu and three Chinese colleagues at the height of fraught iron ore price negotiations strained ties between Australia and China, and shocked the Chinese steel industry.
Experts say the absence of dividing lines between the state and corporations in countries such as China, coupled with digital technology that can make it easy to steal huge volumes of information, increases the risks companies face.
Last month, French President Nicolas Sarkozy’s office asked French intelligence to probe suspected industrial espionage at car giant Renault with a possible Chinese link, a government source told Reuters. China denies involvement .
Renault is far from the only suspected case. US cables released by WikiLeaks show diplomats blaming China for hacking into Google systems that prompted the Internet giant to pull back from mainland China.
Some analysts also suspect information theft may be helping China close the gap faster than expected as it builds a “stealth fighter” to rival Lockheed Martin’s F-22.
E-mail is still the top attack method for targeted and espionage attacks, says Mikko Hypponen, chief research officer at security firm F-Secure.
Chat, instant messaging and web-based attacks are still in the minority, he told delegates at the RSA Conference 2011 in San Francisco.
The reason espionage is increasingly moving online, he said, is simply that most information is now stored digitally, and it is possible to steal information without necessarily gaining access to the target organisations.
Typically these are targeted attacks, where an individual within an organisation will receive an e-mail that appears to come from someone they know.
The e-mails also typically have a document attached that makes sense and is relevant to the recipient that is often a copy of actual documents used by the supposed sender’s organisation.
The recipient views the document, but is totally unaware that malware is being installed in the background that creates a backdoor, said Hypponen.
“This backdoor not only gives the attacker access to the victim’s system, but also to everything on the network that they are authorised to access,” he said.
Even though Word and other document types are used, PDF is the most common document used for targeted attacks.
“Attackers exploit vulnerabilities in Adobe Reader to install the malicious code on the victim’s machine,” said Hypponen.
In the face of these types of targeted espionage attacks, businesses should make employees aware of the tell-tale signs.
If documents take longer than usual to appear, it could be that a backdoor is being installed before a fake document is displayed, said Hypponen.
A difference in the name of the attached file and the file that is eventually displayed, is also an indicator of a potential targeted attack.
Anyone who suspects that e-mail may be illegitimate should check with the supposed sender to see if they did indeed send the e-mail in question, preferably before they open the attachment, he said.
Businesses can also better detect targeted attacks by monitoring the sites to which employee computers are connecting, said Hypponen.
In addition to several well-known malicious sites, businesses can monitor for sites that use variations on the spelling of legitimate sites.
“If an employee’s computer is connecting to a site like www.kabspersky.com, it is likely to be a malicious site,” said Hypponen.
It is important for businesses to ensure security patching is always up to date and they are monitoring all connections made from corporate computers, he said.
Hypponen also recommends businesses use an alternative PDF reader than the product from Adobe. His reasoning is that other readers do not have the same install base and are therefore less targeted.
HERRIMAN, Utah (ABC 4 News) – Someone could be eavesdropping on you using something as simple as a $99 baby monitor.
In just three hours wandering the streets of Herriman, we picked up 15 video and audio signals. We used just two brands of monitors.
At one house, we knocked on the door and invited Ranie to come see for herself. “Does that look familiar?” I asked pointing at a picture of a crib on a small black and white TV. “Yes,” Ranie answered, “That’s my crib.”
“It is very scary because I don’t even have the receiving monitor on right now, I just happened to forget to turn off the camera part and you have it on your monitor … so that makes me scared.”
We had picked up her signal more than a block away and had knocked on only one other door before finding the right house.
Ranie said she got the monitor as a baby gift. She likes it because it provides a measure of safety and peace of mind. “If you hear a sound, you don’t have to come in to see how he’s doing.”
Prior to our visit, she had no idea that when the crib camera was on neighbors or even strangers could be watching and listening. Still, when she thought about it, she remembered a family story that should have been a warning to her. “My sister, actually, heard her neighbors having an argument through a monitor.”
It’s not all that hard. In a block and a half of another street, we picked up three signals showing empty cribs.
Patrea and Shaun actually have cameras in two of their kids’ rooms. They were surprised to see the pictures of both rooms on our monitor. All we had to do was flip a switch on the back to change channels. “You would think they (the manufacturers) would try to make it a little more secure so maybe you have a certain frequency that maybe only yours would pick up.”
Another father, Brett, wondered, “How would you block that so that nobody’s watching your kid sleeping and doing whatever else?
Blocking the signal is really not practical, but parents do have options to secure their baby monitors:
– The best way is the most expensive. Use security cameras that can be routed through an encrypted, home wifi network. The cost of such systems start around $500.
– For about $300, parents can buy a digital baby monitor. Their signals are more secure than the cheaper analog models we used in our investigation.
– To be 100-percent secure, ditch the broadcast signal. Instead, hardwire a camera to a monitor with coaxial cable. It is a hassle, especially if you want to hide the cable, but there is no signal to be intercepted.
– The cheapest option is to keep the gear you have, just make sure you turn off your camera when you take your baby out of the crib. That would not stop a video voyeur, but would limit the exposure.
Speaking of the options, Ranie said, “I’m thinking about it!”
That is the point of this investigation. Most of the parents we talked to had no idea their cameras broadcast a signal well beyond their homes let alone that it could be easily picked up.
Now that they know their cameras are not secure, Ranie and others can make informed decisions that balance privacy and peace of mind.
Preventing cyberattacks is impossible, but governments and businesses can and should be able to stop attackers from stealing data, a computer security specialist says.
There is “nothing in the world you can do” to prevent attacks such as the one that penetrated computer systems in three Canadian federal government departments, said Stephen Northcutt, president of the SANS Technology Insitute, a security training facility in Bethseda, Md.
If a hacker penetrates the security of a computer system, “that’s bad, but it’s not terminal,” Northcutt says.
“Until the data actually gets out of your organization and into the hands of your adversary, you haven’t lost.”
Unfortunately, in the case of the recent attack, hackers are believed to have stolen sensitive government information.
Northcutt applauded the Canadian government for responding to the attack, which was detected in January, by disconnecting its computers from the internet.
He said that is a good move if you believe your system has been successfully compromised and the attack is ongoing.
The next step is to bring in experts who can find the malware responsible for the attack and help figure out where the data is headed.
Northcutt added that most organizations never even detect when a cyberattack is underway. Partly, that is because security systems tend to monitor data entering rather than leaving the system.
“It’s a big part of the problem,” he said. But he added that people are starting to recognize that and install software to monitor data leaving the system through strange routes like unsecured ports.
Organizations should, of course, also be trying to prevent attackers from getting in to begin with, he said.
He recommends implementing software that only allows a certain “whitelist” of approved programs to be installed on computers or tracks the programs that are installed, in order to prevent malicious software from taking root.
Adam Wosotwosky, principal engineer for internet security firm McAfee, said its not unusual for organizations loosen company-wide security measures for a select group of executives — something he recommends against.
“When you open up a back door like that, you’re opening a back door to all your hackers.”
Wosotowsky also suggests keeping web browser software up to date to minimize the chance that browsers will automatically download malware from malicious websites that employees have been lured to visit.
Companies can also ban their email system from transferring any executable files — the form that a lot of malware takes.
“There are other ways to transfer executable files,” Wosotowsky said.
Both he and Northcutt said that, in addition to technological defences, it’s important to educate employees to prevent successful phishing.
For example, Wosotowsky said, they need to know that all the text in an email can be “made up,” and that the person it appears to be from may not have sent it.
Northcutt said a number of U.S. government organizations, including the New York State government, have started “inoculation” campaigns that educate employees about security threats and hold occasional drills.
“From time to time, we need to send a note to ourselves — and see how many people fall for it,” he said.
He estimated that only five per cent of organizations actually do that.
But both he and Wosotowsky also acknowledge that technological measures to detect attacks are crucial even when employees are educated.
“We can’t get every single employee to do the right thing,” he said. “Humans make errors.”
The head of mining giant BHP Billiton (Hamburg: BHP1.HM – news) has confirmed he harboured concerns
about Chinese and competitor espionage on his business, citing it as a
reason behind his push for market pricing of key commodities.
Marius Kloppers, BHP’s chief executive, made his comments after the Sydney
Morning Herald said it saw Wikileaks cables that suggested Mr Kloppers
had offered to share intelligence about China with US authorities.
Asked on Wednesday to confirm whether he was concerned about espionage from
China and from competitors such as rival miner Rio Tinto (Berlin: CRA1.BE – news) , Kloppers told an
earnings briefing: “I would rather like to put that in a positive.”
“One of the reasons we have pushed so hard for market-clearing prices is
so that these sorts of things are not a concern, because if you sell your
product at the market-clearing price, that everybody can read off screens,
it minimises any impact of differential information that the one party or
the other may hold,” he said.
According to the Herald , Mr Kloppers said he would exchange information
with US diplomats in 2009, as he detailed the high level of surveillance
that Chinese authorities had on his company. China is BHP’s largest
customer.
Rival mining groups were also accused of spying on BHP’s activities. “Clearly
frustrated, Kloppers noted that doing business in Melbourne is like ‘playing
poker when everyone can see your cards’,” Michael Thurston, US
consul-general to Australia, said in a cable.
Mr Kloppers “complained that Chinese and industrial surveillance is
abundant and went so far as to ask consul-general [Thurston] several times
about his insights into Chinese intentions, offering to trade confidences,”
the cable said. BHP declined to comment on the report.
Price negotiations between China and mining companies were particularly
fraught in 2009 as commodity prices recovered from the credit crunch. This
led to the collapse of price discussion relating to iron ore, a vital
ingredient in steel making.
Four Rio Tinto negotiators were eventually convicted of stealing commercial
secrets given long jail sentences, including Australian national Stern Hu.
Objections from Chinese steel mills also contributed to BHP and Rio abandoning
their proposed iron-ore joint venture in the Pilbara region of Western
Australia last year.
The revelations come as BHP, the world’s largest mining company, unveiled
a 72pc surge in first-half profit .
Rising commodity prices have seen the company’s cash coffers swell and
investors are demanding the group announces plans for its cash mountain.
Some investors have complained that they want a substantial amount of cash
returned, but it is believed that Mr Kloppers is keen to make an acquisition
following the group’s failed $40bn bid for PotashCorp last year.
