Tracking GhostNet: Investigating a Cyber ... - Nart Villeneuve

More documents

Recommendations

Info

JR02-2009 Tracking GhostNet - PART ONE 15 traffic using a simple IP lookup. 34 The control servers were then probed and web-based control interfaces were identified on four control servers, which allowed us to view and control the network. The system was actively monitored for two weeks, which allowed us to derive an extensive list of infected systems, and to also monitor the systems operator(s) as the operator(s) specifically instructed target computers. The data collected during both phases was integrated in Palantir, a data visualization and analysis tool. The Palantir platform provides a data fusion and visualization environment that enhances analytical capabilities. 34 We looked up the associated Internet Protocol (IP) address in all five Regional Internet Registries in order to identify the country and network to which the IP address is assigned. We then performed a reverse Domain Name System (DNS) look-up on each IP address. DNS is the system that translates domain names into IP addresses; reverse DNS is a system that translates an IP address into a domain name. This can potentially provide additional information about the entity that has been assigned a particular IP address. If we discovered a domain name, we then looked up its registration in WHOIS, which is a public database of all domain name registrations and provides information about who registered the domain name.
PART TWO: Tracking GhostNet
Page 1 and 2: JR02-2009 Tracking GhostNet: Invest
Page 3 and 4: JR02-2009 Tracking GhostNet - FOREW
Page 5 and 6: JR02-2009 Tracking GhostNet - TABLE
Page 7 and 8: JR02-2009 Tracking GhostNet - SUMMA
Page 9 and 10: JR02-2009 Tracking GhostNet - INTRO
Page 11 and 12: PART ONE: Context and background
Page 13 and 14: JR02-2009 Tracking GhostNet - PART
Page 15: JR02-2009 Tracking GhostNet - PART
Page 47 and 48: PART THREE: Investigating GhostNet:
Page 51 and 52: PART FOUR: About Information Warfar
Page 53: 52 2. Open Source Trend Analysis. W

Tracking GhostNet: Investigating a Cyber ... - Nart Villeneuve

Create successful ePaper yourself

Delete template?

Save as template?