Tracking GhostNet: Investigating a Cyber ... - Nart Villeneuve

JR02-2009 Tracking GhostNet - SUMMARY
6
horse programmes designed to take advantage of vulnerabilities in software installed on the target’s
computer.
Once compromised, files located on infected computers may be mined for contact information,
and used to spread malware through e-mail and document attachments that appear to come from
legitimate sources, and contain legitimate documents and messages. It is therefore possible that the
large percentage of high value targets identified in our analysis of the GhostNet are coincidental,
spread by contact between individuals who previously communicated through e-mail.
Nonetheless the existence of the GhostNet network is a significant fact in and of itself. At the very
least, it demonstrates the ease by which computer-based malware can be used to build a robust, lowcost
intelligence capability and infect a network of potentially high-value targets.
Key findings:
• Documented evidence of a cyber espionage network— GhostNet—infecting at least 1,295
computers in 103 countries, of which close to 30% can be considered as high-value
diplomatic, political, economic, and military targets.
• Documented evidence of GhostNet penetration of computer systems containing sensitive
and secret information at the private offices of the Dalai Lama and other Tibetan
targets.
Documentation and reverse engineering of the
• modus operandi of the GhostNet
system—including vectors, targeting, delivery mechanisms, data retrieval and control
systems—reveals a covert, difficult-to-detect and elaborate cyber-espionage system
capable of taking full control of affected systems.