(Stock sunset photo, via Pexels.com)
To look at the photo, you wouldn't know anything was off. Just another sunset, like a million other photos taken every evening by #nofilter-loving amateur photographers.
But this particular sunset photo held an explosive secret: woven throughout the code of the digital image was a hidden tranch of data -- secrets related to cutting edge turbine engines.
At least that's the allegation laid out in court documents against GE engineer Xiaoqing Zheng.
Zheng, a 56-year-old U.S. citizen of Chinese descent, stands accused of siphoning off proprietary data related to the optimization of turbine engines, encrypting it on his GE computer, burying it in code of the photo of the sunset -- after editing the photo to add text that said "Happy Fourth of July" -- and emailing it from his GE email address to his personal one. The entire process took less than 10 minutes.
"A person tasked by GE with routine e-mail monitoring would have seen the digital photograph in Zheng's GE e-mail, but unless he/she knew where to look within the binary code of the digital photograph, he/she would only have seen a photograph of a sunset," according to a criminal complaint filed against Zheng Wednesday and posted online by The Daily Gazette of Schenectady, New York. "Zheng's use of encryption and steganography techniques are both uncommon and serve no apparent purpose but for concealing his activities from his employer."
Steganography is the aforementioned process of hiding data inside otherwise innocuous images, videos or audio tracks.
As the cybersecurity firm McAfee noted in a threat report in 2017, "the term steganography is derived from the Greek words stegos, meaning 'cover,' and grafia, meaning 'writing.' Thus 'covered writing.'"
It wasn't the alleged stenography that got Zheng caught, but his use of a third party encryption program on his work computer that caught GE's eye. The complaint says the company grew suspicious and secretly installed monitoring programs that allowed security officers to monitor Zheng's every digital move.
The complaint alleges that the FBI interviewed Zheng the same day as his arrest, during which time he admitted to taking files via stenography -- and had done it five to 10 times in the past as well. The complaint does not accuse Zheng of attempting to sell the information, but noted there is a lucrative market in China for such proprietary technological information.
Zheng's arrest comes a week after the National Counterintelligence and Security Center published a report detailing China's "multipronged" strategy for stealing U.S. technological secrets.
"We believe that China will continue to be a threat to U.S. proprietary technology and intellectual property through cyber-enabled means or other methods," the NCSC report says. "If this threat is not addressed, it could erode America’s long-term competitive economic advantage."
Read More: Spying 2.0: How China Targets US Tech From All Sides (RealClearLife)
[Like what you see and read on Code and Dagger? Become a Patreon and help keep the lights on. Do you have a tip or question? Reach out at CodeAndDagger@protonmail.com.]