China claims the US NSA hacked its National Time Service Center by exploiting staff phone flaws since March 2022, stealing sensitive data.
China’s Ministry of State Security announced it has found “irrefutable evidence” that the US National Security Agency (NSA) conducted cyberattacks on its National Time Service Center, reports Bloomberg.
The China National Time Service Center (NTSC) is a research institute under the Chinese Academy of Sciences (CAS) that is responsible for maintaining and distributing the official national time standard for China. It offers precise time services for sectors like telecom, finance, energy, transport, mapping, and defense, and provides key data for global time standards.
According to China’s Ministry of State Security’s statement, since March 25, 2022, the NSA allegedly exploited vulnerabilities in employees’ mobile phones to steal sensitive data and monitor communications.
“Recently, China’s national security authorities uncovered a major U.S. cyberattack case, obtaining irrefutable evidence that the U.S. National Security Agency (NSA) conducted cyber intrusions into China’s National Time Service Center, thwarting U.S. attempts to steal secrets and sabotage systems, and safeguarding the security of “Beijing Time.”” reads the statement.
Below is the timeline of the attack, according to Beijing’s investigation:
Beginning March 25, 2022, the NSA allegedly exploited a flaw in a foreign SMS service to hack and control staff phones, stealing sensitive data.
On April 18, 2023, it reportedly used stolen credentials to access the center’s computers and study its network.
Between August 2023 and June 2024, the NSA is said to have launched a new cyber warfare platform, deploying 42 cyber tools to attack internal systems, target a precision timing system, and plant disruptive code.
The attacks occurred late at night (Beijing Time) via VPNs in the U.S., Europe, and Asia. Hackers used forged certificates and encryption to hide. China claims it gathered evidence, stopped the attacks, and strengthened defenses.
China says global private servers were used to hide the source of attacks and that protective and preventive measures have been implemented at the time center.
“The Ministry of State Security emphasizes that it legally prevents and combats cyber-espionage, providing counterintelligence guidance and inspections for domestic institutions and enterprises.
Operators of critical infrastructure must assume primary responsibility for counter-espionage, train personnel in cybersecurity, and implement technical safeguards to prevent foreign attacks and data theft.” concludes the statement. “Citizens and organizations are urged to report suspected cyber-espionage activities via the 12339 hotline, the official website (www.12339.gov.cn), or the Ministry’s WeChat public account, or by contacting local state security bureaus directly.”
The NSA did not immediately comment on the claims.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, NSA)
