The Chinese hacking group, known as “Chimera,” operated undetected within one of the world’s largest semiconductor manufacturers, NXP, for an extended period. NXP, a prominent Dutch company, specializes in creating chips for various sectors, including automotive, industrial, and communication. The breach might have gone undetected if not for the investigation of another Dutch company following a cyberattack. While inside the network, the hackers sought intellectual property, potentially including NXP chip designs.
NXP stands as a global semiconductor manufacturing giant, offering a diverse array of advanced electronics solutions. Their product portfolio encompasses microcontrollers, sensors, chips, and automotive electronics. As a publicly traded company, they have a significant market presence.
The revelation by NRC regarding NXP’s security lapse in allowing Chinese hackers prolonged access to their internal network was indeed a major surprise. The shock intensified as details emerged about the breach methodology. The attackers exploited regular employee accounts through simple brute force techniques. Leveraging information from previous data breaches on social media sites, the hackers successfully guessed passwords. Although NXP had implemented multi-factor authentication as a preventive measure, the attackers circumvented it by altering phone numbers.
According to NRC’s investigation, the hackers stole NXP mailboxes and specifically targeted chip designs
The assailants quietly elevated their access rights within the system and covered any traces they left behind. Their chosen method of exfiltration involved leveraging cloud storage solutions. They used a process that entailed compressing, encrypting, and subsequently exfiltrating files through platforms such as Google Drive or viable alternatives. Yes, these straightforward techniques were able to breach the system of a multi-billion-dollar company.
The cybersecurity firm Fox-IT came into the spotlight when called upon to investigate a breach within Dutch airline Transavia. Fox-IT addressed and uncovered the vulnerability that allowed the attackers to steal information from over 80,000 Transavia passengers. Notably, the firm traced malicious network traffic to an IP address near NXP’s headquarters.
Upon hearing the news, NXP enlisted the expertise of Fox-IT to conduct a thorough investigation. The result confirmed that a breach had transpired. NXP has maintained quiet regarding specific details, acknowledging only “a hack.” Luckily, Fox-IT has exposed some information, claiming that intellectual property was indeed compromised, albeit without a precise estimate of the extent.
In the fiercely competitive chip industry, where China plays a prominent role, significant investments have been made to retain chip manufacturing within its borders. Companies consider chip designs invaluable assets, so they take great care to protect their technological secrets. Chimera, a Chinese backed group, has previously targeted several Taiwanese semiconductors with similar intentions of stealing chip designs. There are clear indications of a trend wherein China is trying to gain a competitive edge over its semiconductor competitors.