Tracking GhostNet: Investigating a Cyber ... - Nart Villeneuve

JR02-2009 Tracking GhostNet - PART TWO
44
Table 2: Selected infections (cont’d)
Organization Confidence Location Infections
Taiwan Government Service Network, Taiwan H TW 1
Tibetan Government in Exile, India H IN, US 4
Trade and Industry Department, Government of Hong Kong H HK 1
Infection timeline
The earliest infected computer called home to the control server on May 22, 2007. The most recent
entry in our sample is March 12, 2009. On average, the amount of time that a host was actively
infected was 145 days. 49 While 90 infected computers were only infected for one day, 145 were
infected for over 400 days. The longest infection span was 660 days. In total, 422 hosts checked in
March 1-12, 2009; 373 of these computers were infected in 2008. The data indicates that despite a
reduction in new infections, the network continues to be operational. (See Fig. 13 - p. 45)
There are significant spikes in infection rates in December 2007 and August 2008.
There were 320 infections in December 2007 spread across 56 countries. However, 113 were located
within Taiwan and the majority of these infections occurred within a single organization: the
Taiwan External Trade Development Council. During this same period, computers at the Embassies
of India in Belgium and Zimbabwe were infected as were the Embassies of Indonesia and the
Republic of Korea in the People’s Republic of China. In addition, computers at the Ministry of
Foreign Affairs in Iran were infected as were several computers at the Tibetan Government-in-Exile.
The spike in August 2008 totalled 258 infections spread across 46 countries. The OHHDL computer
was infected during one of these spikes in August 2008 (It last checked in to the control server
in September 2008). This spike included the Chinese Embassy in the United States, 50 3 computers
at the Embassy of India in the Unites States, and the High Commission of India in the United
Kingdom and in Cyprus. It also included the Embassy of Cyprus in Germany, the Embassy of
Malaysia in Cuba, the Embassy of Thailand in the Philippines and the Ministry of Industry in
Vietnam. Several companies were also compromised, including Net Trade in Taiwan, the New York
Office of Deloitte & Touche, and PetroVietnam, the government-owned oil and gas Company.
49 The average number of days from the initial infection to the last time an infected computer “checked in” with a control server.
50 It is unclear whether the affected embassy is the Republic of China (Taiwan) or People’s Republic of China.