Tracking GhostNet: Investigating a Cyber ... - Nart Villeneuve

JR02-2009 Tracking GhostNet - PART THREE
47
The evidence presented in this report—through a combination of field investigations,
interviews, technical scouting, data analysis, mining and visualization—paints a
disturbing picture.
GhostNet represents a network of compromised computers resident in high-value political,
economic, and media locations spread across numerous countries worldwide. At the time of writing,
these organizations are almost certainly oblivious to the compromised situation in which they find
themselves. The computers of diplomats, military attachés, private assistants, secretaries to Prime
Ministers, journalists and others are under the concealed control of unknown assailant(s).
In Dharamsala and elsewhere, we have witnessed machines being profiled and sensitive documents
being removed. At our Laboratory, we have analysed our own infected “honey pot” computer
and discovered that the capabilities of GhostNet are potent and wide ranging. Almost certainly,
documents are being removed without the targets’ knowledge, keystrokes logged, web cameras are
being silently triggered, and audio inputs surreptitiously activated.
This raises the question, how many sensitive activities have been preemptively anticipated by
intelligence gathered through this network How many illegal transactions have been facilitated by
information harvested through GhostNet Worst of all, how many people may have been put at risk
While these questions are compelling, it would be imprudent to read these findings as an indictment,
or to attribute to the owners of GhostNet motivations and intentions for which there is no evidence.
Alternative explanations
The list of computers controlled by the GhostNet is significant, and certainly atypical for a cybercrime
network. The size of the network is small, and the concentration of high-value systems is significant.
At the same time, penetrations of this type are not uncommon. Recently, several large-scale spy
nets have been discovered, including ones containing lists of affected computers of a magnitude
higher than that harvested by GhostNet.
This trend is predictable, converging with accumulating incidents of cyber-attacks facilitated by
lower entry-thresholds for computer exploitation methods and technologies. The tools we profile in
our investigation, though apparently amassed in a complex way to achieve a definite purpose, are
not restricted to an exclusive guild of experts with specialized and confidential knowledge.
Today, pirated cyber-crime kits circulate extensively on the Internet and can be downloaded by
anyone about as easily as the latest pirated DVD. 51 Cyberspace has empowered individuals and small
groups of non-state actors to do many things, including executing sophisticated computer network
operations that were previously only the domain of state intelligence agencies. We have entered
the era of do-it-yourself (DIY) signals intelligence.
51 http://ddanchev.blogspot.com/2008/11/zeus-crimeware-kit-gets-carding-layout.html