From The Telegraph, April 4:
Investigation into US State Department hack lays bare fears over quantum advances
A cyber security official at the US State Department had noticed something unusual. An internal IT security system, nicknamed “Big Yellow Taxi”, had flagged unusual activity on its corporate Microsoft account.
The tech team quickly raised its concerns to Microsoft, hopeful that the alert was just a false positive.
What rapidly emerged, however, was that a Chinese government hacking group – codenamed Storm-0558 – had compromised the emails of hundreds of US government officials.
An official US government post-mortem included one frightening possibility: that China had developed a quantum supercomputer, capable of cracking all Western encryption and rendering cyber defences useless.
Victims of the hack, discovered on 15 June last year, included Gina Raimondo, the US commerce secretary, the US Ambassador to China, and dozens of high ranking officials and politicians across America and the UK.
A secret quantum computer developed by a rival power would “absolutely be a nightmare scenario”, putting critical private information at risk of being stolen, says Sebastian Weidt, chief executive of Brighton-based start-up Universal Quantum....Nine months later and experts at Microsoft and US officials at CISA – the US cyber defence agency – are still unpicking what happened. China’s hackers had been able to steal or forge a digital key – the “cryptographic equivalent of crown jewels”, US officials said in a report.
This key could be used to unlock crucial parts of the US government’s digital infrastructure, cracking open email accounts belonging to high-ranking officials around the world. The hackers stole 60,000 emails from the State Department alone, although it is still unclear how this was achieved.
On June 26, 10 days after the US government discovered the Chinese hack, Microsoft launched an “all-hands-on-deck” investigation that ran overnight, uncovering the loss of the secret key.
“Microsoft developed 46 hypotheses to investigate,” the CISA report said, “including some scenarios as wide-ranging as the adversary possessing a theoretical quantum computing capability to break public-key cryptography.”
The CISA report adds: “As of the date of this report, Microsoft does not know how or when Storm-0558 obtained the signing key.”
Another possibility raised in the government report is that an insider stole the information years ago. A Microsoft spokesman declined to comment.
Cyber security sources note that a quantum-powered hack would be the “least likely” scenario. One industry source says the probability China has cracked such a huge technical problem is less than zero. Given the catastrophic nature of the attack, experts say Microsoft had to rule out a range of possible causes.
In a March blog post, Microsoft said: “Our leading hypothesis remains that operational errors resulted in key material leaving the secure token signing environment.”
But the disclosures by US officials shows how seriously the threat of China’s quantum advances are being taken by the world’s most valuable technology company.
