Tracking GhostNet: Investigating a Cyber ... - Nart Villeneuve
Tracking GhostNet: Investigating a Cyber ... - Nart Villeneuve
Tracking GhostNet: Investigating a Cyber ... - Nart Villeneuve
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
JR02-2009 <strong>Tracking</strong> <strong>GhostNet</strong> - INTRODUCTION<br />
8<br />
But the most significant actors in cyberspace are not states. The online engagements that<br />
accompanied the recent Russia-Georgia conflict in August 2008 4 and Israel’s January 2009 offensive<br />
in Gaza 5 were carried out by independent attackers. The May 2007 denial of service attacks against<br />
Estonia 6 resulted in a single conviction of a Russian living in Estonia. Likewise, previous high-profile<br />
investigations of hacking against strategic U.S. targets were never positively attributed to foreign<br />
intelligence services 7 , and in many cases were the work of individuals. 8<br />
The contest in the shadows currently underway in cyberspace appears to rely largely on third parties.<br />
In numerous instances, including case studies conducted by the Information Warfare Monitor’s sister<br />
project, the OpenNet Initiative, third party attackers were responsible for triggering national-level<br />
cyber events. In Kyrgyzstan (2005) 9 , Belarus (2006) 10 , during the Russia Georgia war (2008), and<br />
Kyrgyzstan (2009), individuals and/or loose coalitions were responsible for publishing target lists<br />
and attack tools on semi-private websites. The ensuing “cyclones in cyberspace” were sufficient to<br />
precipitate events outside of cyberspace. 11<br />
International cooperation has for the most part focused on establishing capabilities for counteracting<br />
the criminal use of cyberspace, and with good reason. In 2009, the FBI estimated that cybercrime is<br />
responsible for over $10 billion worth of losses each year. 12 <strong>Cyber</strong>crime is a relatively low cost, low<br />
threshold activity. Techniques such as phishing and targeted malware are easy to construct, and the<br />
chances of prosecution are minimal given a general lack of international coordination.<br />
This is slowly changing as national and international authorities become more aware of the threat.<br />
The attacks on Estonia, for example, led to the establishment of NATO’s Cooperative <strong>Cyber</strong> Defence<br />
Centre of Excellence in Tallinn, Estonia. 13 The International Telecommunication Union has also<br />
established its own specialized agency, IMPACT, designed to aid intelligence sharing and tracking of<br />
4 http://blog.wired.com/defense/2008/10/government-and.html ; http://www.slate.com/id/2197514<br />
5 http://www.csmonitor.com/2009/0123/p04s03-wome.html<br />
6 http://www.webpronews.com/topnews/2008/01/24/man-convicted-in-estonia-cyber-attack<br />
7 For example, a US government investigation of systematic hacking of Department of Defense networks and defence laboratories<br />
dubbed ‘Titan Rain’ never provided conclusive evidence to substantiate allegations that the hacking was conducted at the behest of<br />
the Chinese government. http://www.time.com/time/magazine/article/0,9171,1098961,00.html<br />
8 A good example is the 1998 ‘Solar Sunrise’ investigation. The evidence gathered by US authorities eventually led to the conviction<br />
of an Israeli citizen, Ehud Tenebaum, although the involvement of Israeli security services was never proven. http://www.sans.org/<br />
resources/idfaq/solar_sunrise.php<br />
9 http://opennet.net/special/kg/<br />
10 http://opennet.net/sites/opennet.net/files/ONI_Belarus_Country_Study.pdf<br />
11 http://www.infowar-monitor.net/modules.phpop=modload&name=News&file=article&sid=2146<br />
12 http://kn.theiet.org/magazine/issues/0903/hacking-goes-pro-0903.cfm<br />
13 http://www.nato.int/docu/update/2008/05-may/e0514a.html