When it comes to covert cyber attacks on government networks, it somehow seems that they can always be traced back to servers in China.

It is always acknowledged that that doesn't mean that the Chinese government is behind them or has sanctioned them, since attribution of such attacks is practically impossible in this age when one can route one's efforts through servers located anywhere in the world. But, it also doesn't mean that the Chinese government isn't behind the attacks.


The revelation that two Canadian government networks have been breached in January and that the hackers - who have apparently managed to steal sensitive information - used servers located in China to do it invites just this kind of speculation.

Saying that China sees Canada as a land of opportunity to get natural resources that it needs so much, security analyst and former CSIS intelligence officer Michel Juneau-Katsuya seems to think it's quite likely that the perpetrators of the attacks are, in fact, backed by the Chinese government.

The Canadian Prime Minister and the government have yet to confirm that the attacks have happened, but sources inside the government have shared what they know about the incident with CBC News.

Apparently, the attacks were spotted in January and the computer systems of the Finance Department and Treasury Board had been shut down in order to prevent the data getting to the hackers.

Since that move cut a great number of public servants off the Internet, there had to be some formal explanation. At the time, the government merely said there was an "attempt to access" government networks.

But according to these sources, the attackers were successful. To what extent, it is still unknown. What is known is that they managed to access and gain control of computers belonging to a number of high-ranking officials by using the very effective practice of social engineering through spear phishing.

Posing as those same officials, they e-mailed the departments' technical staff and tricked them into giving up passwords needed for access to the networks. While all this was happening, they also sent e-mails to the rest of the staff containing malicious attachments camouflaged as innocuous memos.

The malware in those attachments did all the work. It earched for the needed information and documents and - if the shutting down of the compromised networks came too late - delivered them to the attackers.