Tracking GhostNet: Investigating a Cyber Espionage Network
Researchers at the Information Warfare Monitor uncovered a
suspected cyber espionage network of over 1,295 infected hosts in 103
countries. This finding comes at the close of a 10-month investigation
of alleged Chinese cyber spying against Tibetan institutions that
consisted of fieldwork, technical scouting, and laboratory analysis.
Close to 30% of the infected hosts are considered high-value and
include computers located at ministries of foreign affairs, embassies,
international organizations, news media, and NGOs. The investigation
was able to conclude that Tibetan computer systems were compromised by
multiple infections that gave attackers unprecedented access to
potentially sensitive information, including documents from the
private office of the Dalai Lama.
Who is ultimately in control of the GhostNet system? While our
analysis reveals that numerous politically sensitive and high value
computer systems were compromised in ways that circumstantially point
to China as the culprit, we do not know the exact motivation or the
identity of the attacker(s), or how to accurately characterize this
network of infections as a whole. One of the characteristics of
cyber-attacks of the sort we document here is the ease by which
attribution can be obscured.
Regardless of who or what is ultimately in control of GhostNet, it
is the capabilities of exploitation, and the strategic intelligence
that can be harvested from it, which matters most. Indeed, although
the Achilles’ heel of the GhostNet system allowed us to monitor and
document its far-reaching network of infiltration, we can safely
hypothesize that it is neither the first nor the only one of its kind.
As Information Warfare Monitor principal investigators
Ron Deibert
and Rafal Rohozinski say in the foreword to the report, “This report
serves as a wake-up call. At the very least, a large percentage of
high-value targets compromised by this network demonstrate the
relative ease with which a technically unsophisticated approach can
quickly be harnessed to create a very effective spynet…These are
major disruptive capabilities that the professional information
security community, as well as policymakers, need to come to terms
with rapidly.”
The full report can be
downloaded
here
The report has been co-timed for release with an exclusive story by
the New York Times' John Markoff. Download
the New York Times story here
[Source: Information Warfare Monitor]
Ron Deibert is director of the Citizen Lab,
Munk Centre for International Studies, University of Toronto. Rafal
Rohozinski is a principal of the SecDev Group, Ottawa. They are
co-founders and principal investigators of the Information Warfare
Monitor Project. Their report, Tracking GhostNet, can be downloaded at
http://www.infowar-monitor.net/ghostnet
