Tracking GhostNet: Investigating a Cyber ... - Nart Villeneuve

JR02-2009 Tracking GhostNet - PART THREE
49
the United States) for strategic purposes. Compromised proxy computers on Hainan Island, for
example, could have been deployed as staging posts, perhaps in an effort to deliberately mislead
observers as to the true operator(s) and purpose of the GhostNet system.
The Significance of GhostNet
GhostNet is significant, as it does not appear to be a typical cybercrime network. The potential
political fallout is enormous. But ultimately, the question of who is behind the GhostNet may
matter less than the strategic significance of the collection of affected targets. What this study
discovered is serious evidence that information security is an item requiring urgent attention at
the highest levels. It demonstrates that the subterranean layers of cyberspace, about which most
users are unaware, are domains of active reconnaissance, surveillance, and exploitation.
Regardless of who or what is ultimately in control of GhostNet, its capabilities of exploitation and
the strategic intelligence that can be harvested from it matter most. Indeed, although the Achilles’
heel of the GhostNet system allowed us to monitor and document its far-reaching network of
infiltration, we can safely hypothesize that it is neither the first nor the only one of its kind.