Titan Rain: Three Years Inside NASA, Lockheed Martin and Sandia Labs

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

Titan Rain was the U.S. government's designation for a coordinated series of cyberattacks first detected in 2003 and known to have continued for at least three years. Intruders reached defense contractor networks, NASA, Lockheed Martin, Sandia National Laboratories, Redstone Arsenal and the Defense Intelligence Agency. Unlike the noisy malware of the time, such as the ILOVEYOU virus, the Blaster worm and SQL Slammer, the campaign was an advanced persistent threat built to stay hidden: entry through spear phishing and unpatched edge servers, data moved during business hours wrapped in ordinary HTTP traffic, lateral movement between machines and spare back doors. The U.S. government traced the attacks to Guangdong, China, and attributed them to People's Liberation Army Unit 61398. The Chinese government has consistently denied any involvement.

Alan Paller, research director of the SANS Institute, said the attackers showed "intense discipline" and that no other organization could do it if it were not a military. No classified information was reported stolen. Instead the attackers collected large volumes of unclassified data, including from the home computers of employees and contractors, which under the intelligence concept known as mosaic theory can be combined to reveal supply chains, hierarchies and human weak points. The campaign spread to the United Kingdom, where the Ministry of Defence was targeted and, in 2006, part of the House of Commons computer system was shut down; the UK said Chinese hackers had attacked its government offices. The scale of the intrusions led other nations, including Russia, to assume their own networks might be compromised.

• Network security of the era followed a castle-and-moat model that trusted traffic once it was inside the firewall.
• The attackers never encrypted drives, demanded ransom or sold stolen data, which pointed away from a criminal motive.
• Knowing who was on vacation and how a department was organized could tell attackers exactly whom to impersonate in a spear phishing email.
• The intrusions pushed governments toward internal network segmentation instead of perimeter-only defense.
• Two-factor authentication, VPN rules and zero trust architecture trace back to the lessons of Titan Rain.