Vast Electronic Spying Operation Discovered

homesalad writes "Researchers in Toronto have discovered a huge international electronic spying operation that they are calling 'GhostNet.' So far it has infiltrated government and corporate offices in 103 countries, including the office of the Dalai Lama (who originally went to the researchers for help analyzing a suspected infiltration). The operation appears to be based in China, and the information gained has been used to interfere with the actions of the Dalai Lama and to thwart individuals seeking to help Tibetan exiles. The researchers found no evidence of infiltration of US government computers, although machines at the Indian embassy were compromised. Here is the researchers' summary; a full report, 'Tracking "GhostNet": Investigating a Cyber Espionage Network' will be issued this weekend." A separate academic group in the UK that helped with the research is issuing its own report, expected to be available on March 29. Here is the abstract. They seem to be putting more stress on the "social malware" nature of the attack and ways to mitigate such techniques.

Comments

Target operating system?

[transporter_ii]

Infection happens two ways. In one method, a userâ(TM)s clicking on a document attached to an e-mail message lets the system covertly install software deep in the target operating system. Alternatively, a user clicks on a Web link in an e-mail message and is taken directly to a âoepoisonedâ Web site.

Unless I missed it, I don't see Windows mentioned...but I'm going to go out on a limb here and figure the targeted OS is Windows.

Transporter_ii

Commenters ?

[Anonymous Coward]

Im wondering how many posts here are submitted on behalf of the Chinese Government?
They can join and influence our conversations but we can never join theirs..

Russian Crooks are already there

[PineHall]

"What Chinese spooks did in 2008, Russian crooks will do in 2010 and even low-budget criminals from less developed countries will follow in due course," the Cambridge researchers, Shishir Nagaraja and Ross Anderson, wrote in their report, "The Snooping Dragon: Social Malware Surveillance of the Tibetan Movement."

I would guess that the Russian crooks are doing it today with very targeted attacks. We just have not discovered it, or if discovered the financial institutions attacked have covered it up.

Re:From TFA

[chill]

the abstract mentions that the attack was done using malwares. Firstly, I expected Chinese hackers (read govt.) smarter than this.

Considering how effective it was, why use a different technique? I mean if they get something really super-hot, they would save it for more critical times. Until every copy of Windows is patched, firewalled, run thru Tor, buried in peat and recycled as firelighters, why bother?

Skype Monitoring

[Anonymous Coward]

It is definitely not only China that employs some monitoring techniques on its citizens' Skype accounts. Last year during Myanmar's Saffron Revolution, my Burmese roommate organized information sessions and candle light vigils on our small, liberal arts school's campus, taking care to remain anonymous or using my name as a proxy for his actions. The only Burmese contact he had at the time was Skyping with his ex-girlfriend, a student at a nearby liberal arts school who organized protests of greater scope on her campus. After about 3 days he mysteriously received a call from his mother who sounded scared (remember, most non-satellite phone lines were all but taken down during the protests) assuring him that she was OK but he needed to stop everything he was planning on campus. My roommate had no choice but to stop his involvement in the protests.

Re:Bankrupt them

[Runaway1956]

Uhhhh - the Chinese are smarter than that. They know they can't come over here and take what they want using military power. That is the very reason they are attacking us asymmetrically. Google around for Assasin's Mace. China has been at war with the US for years already, and the US is to stupid to know it, let alone defend itself. But, Sun Tzu was more akin to the Communist Chinese than to any Americans, so they understand him better than we do.

Re:Sanctions overdue

[u38cg]

Hi. This is reality calling, ding-dong. If you increase tariffs against China, you will (a) immediately increase the prices of all goods, (b) you will seriously increase your tax rates, because your government will no longer be able to fund its debt by selling its Treasuries to China (because China will have no more greenbacks coming in). You won't have a domestic industry to take up the slack, because you will have destroyed domestic demand. Seriously, buy a copy of the Wealth of Nations, for the love of God. Oh, not to mention the risk of provoking a war with China; and if you think that's going to be an easy fight, I have more bad news for you.

Re:From TFA

[lgw]

The most secure US government network I've seen (datacenter for a Three Letter Agency) used a mix of NetWare servers and a mainframe. While client machines can be compromised, I suspect someone was thinking along these lines when it came to the servers. Linux and Mac aren't particularly obscure or uncommon, but the US governemtn probably has the address of every programmer who ever worked on the NetWare kernel. I don't know what OS the mainframe was running, but there are several where, like NetWare, the total number of humans worldwide with kernel hacking knowledge is "dozens".

Target the OS with the back door?

[transporter_ii]

I wonder how much Microsoft's Malicious Software reporting tool would be to help in targeting specific systems?

Botnet fighters have another tool in their arsenal, thanks to Microsoft. The software vendor is giving law enforcers access to a special tool that keeps tabs on botnets, using data compiled from the 450 million computer users who have installed the Malicious Software Removal tool that ships with Windows.

See: http://www.infoworld.com/article/08/04/29/Microsoft-botnet-hunting-tool-helps-bust-hackers_1.html

Microsoft had not previously talked about its botnet tool, but it turns out that it was used by police in Canada to make a high-profile bust earlier this year.

Someone care to expand on the above??? I've googled some but came up with nothing so far.

 

Is anyone's computer 100% secured?

[h00manist]

How can you be sure your computer is 100% secure, and not infiltrated? Even in a fresh-installed, never-connected OS (any OS), how to be sure all executables on the CD don't have some hidden code in them, even when first released, that was somehow slipped in? What OS do they use in embassies, military, etc? What security measures, products, procedures?