Tracking GhostNet: Investigating a Cyber ... - Nart Villeneuve
Tracking GhostNet: Investigating a Cyber ... - Nart Villeneuve
Tracking GhostNet: Investigating a Cyber ... - Nart Villeneuve
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
JR02-2009 <strong>Tracking</strong> <strong>GhostNet</strong> - PART TWO<br />
32<br />
The four control servers are:<br />
• xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx, Hainan-TELECOM, CN<br />
• xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx, US<br />
• xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx, CHINANET-GD, CN<br />
• xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx CHINANET-SC, CN<br />
The six control/command servers are:<br />
• xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx, CHINANET-HI, CN<br />
• xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx, CUHKNET, HK<br />
• xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx, CHINANET-GD, CN<br />
• xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx, CHINANET-SC, CN<br />
• xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx, CHINANET-JS, CN<br />
• xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx, CHINANET-SC, CN<br />
The data obtained from WHOIS records concerning domain name registration reveals that most<br />
of the domains are traceable to the same individual. However, the attacker(s) could have simply<br />
stolen the domains from someone else, or compromised the servers hosting these domains.<br />
Table 1: Domain name registration information<br />
xxxxxxxxxxxxx<br />
xxxxxxxxxxxxx<br />
xxxxxxxxxxxxx<br />
xxxxxxxxxxxxxxxxxxxxxxxxxxxx 25/04/06<br />
xxxxxxxxxxxxx<br />
xxxxxxxxxxxxx<br />
xxxxxxxxxxxxx<br />
xxxxxxxxxxxxx<br />
26/11/07<br />
xxxxxxxxxxxxx<br />
xxxxxxxxxxxxxxxxxx<br />
xxxxxxxxxxxxxxxxxx<br />
xxxxxxxxxxxxxxxxx<br />
xxxxxxxxxxxxxxxxxxx<br />
20/06/08<br />
xxxxxxxxxxxxxxxxxx<br />
xxxxxxxxx<br />
xxxxxxxxxxxxxxxxxx<br />
03/09/08<br />
List of infected computers (see Fig. 8 - p. 33)<br />
The Server List interface provides information on each computer infected by the attacker(s)’<br />
malware, indicating the name given to the computer (by its owner/operator), its IP address, when<br />
it was first infected, when it last called home (i.e. the control server), and how many times it<br />
has called home. Each infected computer is assigned a unique identification number so that the<br />
infected computer can be tracked even when its IP address changes. The page also features a link<br />
to the Send Command interface, through which the attacker(s) sends instructions to the infected
Change language