US security firm links China to vast hacking