Tracking GhostNet: Investigating a Cyber ... - Nart Villeneuve
Tracking GhostNet: Investigating a Cyber ... - Nart Villeneuve
Tracking GhostNet: Investigating a Cyber ... - Nart Villeneuve
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
JR02-2009 <strong>Tracking</strong> <strong>GhostNet</strong> - SUMMARY<br />
6<br />
horse programmes designed to take advantage of vulnerabilities in software installed on the target’s<br />
computer.<br />
Once compromised, files located on infected computers may be mined for contact information,<br />
and used to spread malware through e-mail and document attachments that appear to come from<br />
legitimate sources, and contain legitimate documents and messages. It is therefore possible that the<br />
large percentage of high value targets identified in our analysis of the <strong>GhostNet</strong> are coincidental,<br />
spread by contact between individuals who previously communicated through e-mail.<br />
Nonetheless the existence of the <strong>GhostNet</strong> network is a significant fact in and of itself. At the very<br />
least, it demonstrates the ease by which computer-based malware can be used to build a robust, lowcost<br />
intelligence capability and infect a network of potentially high-value targets.<br />
Key findings:<br />
• Documented evidence of a cyber espionage network— <strong>GhostNet</strong>—infecting at least 1,295<br />
computers in 103 countries, of which close to 30% can be considered as high-value<br />
diplomatic, political, economic, and military targets.<br />
• Documented evidence of <strong>GhostNet</strong> penetration of computer systems containing sensitive<br />
and secret information at the private offices of the Dalai Lama and other Tibetan<br />
targets.<br />
Documentation and reverse engineering of the<br />
• modus operandi of the <strong>GhostNet</strong><br />
system—including vectors, targeting, delivery mechanisms, data retrieval and control<br />
systems—reveals a covert, difficult-to-detect and elaborate cyber-espionage system<br />
capable of taking full control of affected systems.