Posted on Leave a comment

Software developer sues China – is reprimended with an unrelenting string of cyberattacks against his company

image thumb1521

China vs. United States (US) cyber warWe have breaking news for you – a China vs. United States war is already taking place.  And it’s occurring in the commercial workspaces of U.S. based companies as we speak. A remarkable story has developed regarding Solid Oak Software Inc.’s battle against the People’s Republic of China over Solid Oak Software’s controversial CyberSitter software that China reportedly “stole” from the company.  The case was filed at the U.S. District courthouse in Santa Ana.  Brian Milburn, owner of Solid Oak Software, never received a single communication from the Chinese nor received a single communication from their lawyers.  Instead, he claims that he received a healthy dose of cyberattacks and cyber harassment from a team of Shanghai-based hackers, with documented ties to the Chinese military, who had previously been implicated in a string of sensitive national security-related breaches going back several years.

According to BusinessWeek:

“The attack began less than two weeks after Milburn publicly accused China of appropriating his company’s parental filtering software, CYBERsitter, for a national Internet censoring project. And it ended shortly after he settled a $2.2 billion lawsuit against the Chinese government and a string of computer companies last April.”

The pirated software was spotted after University of Michigan researchers examined China’s state-sponsored web-filtering software called Green Dam Youth Escort, software that is required to be installed on every computer sold in the country.  The researchers spotted thousands of lines of code that exactly matched Milburn’s Cybersitter code.  They even discovered a CyberSitter upgrade notice that was accidentally left embedded in the pilfered code.

Room full of Chinese hackers in ChinaMilburn struggled to keep his eight-person family owned business afloat while battling the cyber attacks which included having his web, email, and firewall servers knocked offline, monitoring of keystrokes on the company machines, penetration of server security to gain access to sensitive files, and at least one case of the hackers spying on employees through their personal webcams.  Manufacturers of the failing software and hardware products were stumped and could offer little to no assistance to the troubled company.

Milburn explained to BusinessWeek the purpose behind the attacks:

“If they could just put the company out of business, the lawsuit goes away. They didn’t need guys with guns or someone to break my kneecaps.”

Milburn did indeed come close to losing his business as he battled night and day to keep the company’s network and servers online.  At first he noticed that his company, and the law firm that represented his case, began receiving malware embedded in corporate email.  At the request of Bloomberg, he had the malware analyzed by SecureWorks who identified the responsible hackers as the Chinese based “Comment Group”, a group of national security hackers who have been linked to China’s military via leaked classified cables. The malware, when activated, embedded itself deeply in Windows code and automatically uploaded additional rooting tools to Milburn’s machines giving the hackers total control over Solid Oak Software’s infrastructure.

At the suggestion of security experts, Solid Oak Software began using their own counter-espionage techniques to help hide from the Chinese attack. Legal documents were exchanged using one-time Dropbox accounts that were immediately deleted after use.  Emails were exchanged using a rotating set of temporary email accounts. Phone calls were made using multiple cellular devices operated from remote locations far from the company’s headquarters.  They even carefully examined the physical infrastructure of the company in an attempt to locate hidden spy hardware. Still, the attacks continued unabated.

… and as suddenly as they began, the attacks stopped – the day after Milburn settled the lawsuit with the Chinese government.

Note: in the interest of fair “reporting” (heh, don’t laugh), we have to point out that Milburn’s company is noted for launching other lawsuits against competing entities (e.g. Google). In addition, the CyberSitter software has received less than stellar reviews in the past so a revenue decline could be a result of other factors.  In other words, let’s not draw the “good vs. evil” line too sharply.

Sources: Bloomberg BusinessWeek, Solid Oak Software, CNET, PC Magazine, Wikipedia