Tracking GhostNet: Investigating a Cyber ... - Nart Villeneuve
Tracking GhostNet: Investigating a Cyber ... - Nart Villeneuve
Tracking GhostNet: Investigating a Cyber ... - Nart Villeneuve
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
JR02-2009 <strong>Tracking</strong> <strong>GhostNet</strong> - PART TWO<br />
44<br />
Table 2: Selected infections (cont’d)<br />
Organization Confidence Location Infections<br />
Taiwan Government Service Network, Taiwan H TW 1<br />
Tibetan Government in Exile, India H IN, US 4<br />
Trade and Industry Department, Government of Hong Kong H HK 1<br />
Infection timeline<br />
The earliest infected computer called home to the control server on May 22, 2007. The most recent<br />
entry in our sample is March 12, 2009. On average, the amount of time that a host was actively<br />
infected was 145 days. 49 While 90 infected computers were only infected for one day, 145 were<br />
infected for over 400 days. The longest infection span was 660 days. In total, 422 hosts checked in<br />
March 1-12, 2009; 373 of these computers were infected in 2008. The data indicates that despite a<br />
reduction in new infections, the network continues to be operational. (See Fig. 13 - p. 45)<br />
There are significant spikes in infection rates in December 2007 and August 2008.<br />
There were 320 infections in December 2007 spread across 56 countries. However, 113 were located<br />
within Taiwan and the majority of these infections occurred within a single organization: the<br />
Taiwan External Trade Development Council. During this same period, computers at the Embassies<br />
of India in Belgium and Zimbabwe were infected as were the Embassies of Indonesia and the<br />
Republic of Korea in the People’s Republic of China. In addition, computers at the Ministry of<br />
Foreign Affairs in Iran were infected as were several computers at the Tibetan Government-in-Exile.<br />
The spike in August 2008 totalled 258 infections spread across 46 countries. The OHHDL computer<br />
was infected during one of these spikes in August 2008 (It last checked in to the control server<br />
in September 2008). This spike included the Chinese Embassy in the United States, 50 3 computers<br />
at the Embassy of India in the Unites States, and the High Commission of India in the United<br />
Kingdom and in Cyprus. It also included the Embassy of Cyprus in Germany, the Embassy of<br />
Malaysia in Cuba, the Embassy of Thailand in the Philippines and the Ministry of Industry in<br />
Vietnam. Several companies were also compromised, including Net Trade in Taiwan, the New York<br />
Office of Deloitte & Touche, and PetroVietnam, the government-owned oil and gas Company.<br />
49 The average number of days from the initial infection to the last time an infected computer “checked in” with a control server.<br />
50 It is unclear whether the affected embassy is the Republic of China (Taiwan) or People’s Republic of China.