SHANGHAI — A massive cyberattack that lasted up to five years infiltrated computers and stole data from the United Nationsand a wide range of governments and American corporations, according to a report released Wednesday by security experts in the United States.
The American security company McAfee called it a highly sophisticated cyberattack that appeared to have been operated by a government body. But McAfee, which was recently acquired by Intel, declined to say which country it believed was behind the attack.
“We’re not pointing fingers at anyone but we believe it was a nation-state,” Dmitri Alperovitch, McAfee’s vice president of threat research and the lead author of the report, said in a telephone interview Wednesday.
While there have been suspicions that China has been behind many attacks like this one, McAfee decided not to name or suggest potential culprits.
Of the targets of the attacks, organizations in the United States represented 49 of the 72, McAfee said, while governments, companies, and organizations in Canada, Japan, South Korea, Taiwan, Switzerland and Britain were also targets multiple times.
“After painstaking analysis of the logs, even we were surprised by the enormous diversity of the victim organizations and were taken aback by the audacity of the perpetrators,” Mr. Alperovitch wrote in the 14-page report.
Among the few targets mentioned by name in the report are the International Olympic Committee and the World Anti-Doping Agency. The report comes after high-profile cyberattacks aimed at the International Monetary Fund, Sony and the Lockheed Martin Corporation, America’s largest military contractor.
McAfee said it released the report to coincide with the start of the annual Black Hat technical security conference in Las Vegas. Briefings at the conference are scheduled to be delivered Wednesday and Thursday.
The company said that it had alerted victims of the attacks and that it had informed law enforcement agencies, which are investigating the intrusions.
However, Mark Adams, a spokesman for the International Olympic Committee, said: “We are unaware of the alleged attempt to compromise our information security claimed by McAfee. If true, such allegations would of course be disturbing.”
He added, “The I.O.C. is transparent in its operations and has no secrets that would compromise either our operations or our reputation.”
Spokesmen for the United Nations and the World Anti-Doping Agency could not be reached for comment.
In its report, McAfee said it learned of the hacking campaign last March, when it discovered logs of attacks while reviewing the contents of a server it had discovered in 2009 as part of an investigation into security breaches at defense companies.
It dubbed the attacks Operation Shady RAT — RAT stands for remote access tool, a type of software used to access computer networks.
The earliest breaches dated from mid-2006, though McAfee said there might have been other intrusions still undetected. The duration of the attacks ranged from a month to what McAfee said was a sustained 28-month attack against an Olympic committee of an unidentified Asian nation.
What was done with the data “is still largely an open question,” Mr. Alperovitch wrote in the report. “However, if even a fraction of it is used to build better competing products or beat a competitor at a key negotiation (due to having stolen the other team’s playbook), the loss represents a massive economic threat.”
Asked why McAfee decided not to identify most of the corporations that were targets in Operation Shady Rat, the company said on Wednesday that most corporations were worried about being identified and alarming shareholders or customers.
Cyberattacks have heightened concerns among government officials and corporate executives, who are being warned about the sophistication of the attacks and the ability of hackers to access sensitive corporate and military secrets, including intellectual property.
In some attacks, the culprits are believed to be professional hackers engaged in disrupting an organization’s operations for the sheer pleasure of it, or seeking revenge.In mid-May, the Obama administration proposed creating international computer security standards with penalties for countries and organizations that fell short. The strategy calls for officials from the State Department, the Pentagon, the Justice Department, the Commerce Department and the Department of Homeland Security to work with their counterparts around the world to come up with standards aimed at preventing theft of private information and ensuring Internet freedom.
Obama administration officials said privately at the time that the hope was that the initiative would prod China and Russia into allowing more Internet freedom, cracking down on intellectual property theft and enacting stricter laws to protect computer users’ privacy.
There are also growing concerns that some of the cyberattacks are being carried out by nation-states, particularly after Google said last year that Chinese hackers stole some of the company’s source code. Many security experts say the Chinese government has built up a sophisticated cyber warfare unit and that the government may be partnering with professional hackers.
In February, a Canadian federal cabinet minister said hackers, perhaps from China, compromised computers in two Canadian government departments in early January, leaving bureaucrats with little or no Internet access for nearly two months. The minister, Stockwell Day, the president of the Treasury Board, called the attack a “significant one” that went after financial records.
Also in February, McAfee released a report saying that at least five multinational oil and gas companies had suffered computer network attacks by a group of hackers based in China. Beijing has strongly denied any role in cyberattacks, and insisted it has been a frequent victim of cyberattacks. On Wednesday, China’s Foreign Ministry did not respond to requests for comment about allegations of Chinese links to cyberattacks after the McAfee report.
But last month, at a regularly scheduled news conference in Beijing, the Foreign Ministry spokesman, Hong Lei, said, “The Chinese government opposes hacking in all its manifestations.”
He added: “Hacking is an international issue, with which China also falls victim. China is willing to conduct international cooperation in this regard. We are dissatisfied with some people’s irresponsible remarks that link hacker attacks with the Chinese government.”