Tracking GhostNet: Investigating a Cyber ... - Nart Villeneuve

JR02-2009 Tracking GhostNet - FOREWORD
March 29, 2009
Foreword
Cyber espionage is an issue whose time has come. In this second report from the Information Warfare
Monitor, we lay out the findings of a 10-month investigation of alleged Chinese cyber spying against
Tibetan institutions.
The investigation, consisting of fieldwork, technical scouting, and laboratory analysis, discovered a lot more.
The investigation ultimately uncovered a network of over 1,295 infected hosts in 103 countries.
Up to 30% of the infected hosts are considered high-value targets and include computers located
at ministries of foreign affairs, embassies, international organizations, news media, and NGOs. The
Tibetan computer systems we manually investigated, and from which our investigations began,
were conclusively compromised by multiple infections that gave attackers unprecedented access to
potentially sensitive information.
But the study clearly raises more questions than it answers.
From the evidence at hand, it is not clear whether the attacker(s) really knew what they had
penetrated, or if the information was ever exploited for commercial or intelligence value.
Some may conclude that what we lay out here points definitively to China as the culprit. Certainly
Chinese cyber-espionage is a major global concern. Chinese authorities have made it clear that they
consider cyberspace a strategic domain, one which helps redress the military imbalance between
China and the rest of the world (particularly the United States). They have correctly identified
cyberspace as the strategic fulcrum upon which U.S. military and economic dominance depends.
But attributing all Chinese malware to deliberate or targeted intelligence gathering operations by
the Chinese state is wrong and misleading. Numbers can tell a different story. China is presently
the world’s largest Internet population. The sheer number of young digital natives online can more
than account for the increase in Chinese malware. With more creative people using computers, it’s
expected that China (and Chinese individuals) will account for a larger proportion of cybercrime.
Likewise, the threshold for engaging in cyber espionage is falling. Cybercrime kits are now available
online, and their use is clearly on the rise, in some cases by organized crime and other private actors.
Socially engineered malware is the most common and potent; it introduces Trojans onto a system,
and then exploits social contacts and files to propagate infections further.
Furthermore, the Internet was never built with security in mind. As institutions ranging from
governments through to businesses and individuals depend on 24-hour Internet connectivity, the
opportunities for exploiting these systems increases.