Researchers Say China-Based Network Infiltrated Computers
By VOA News
29 March 2009
Chinese workers take a break near a robot outside a computer mall in Beijing, China, 19 Mar 2009
Canadian researchers say they have discovered a large China-based electronic spying operation that infiltrated computers and stole information from government and private offices around the world, including the Dalai Lama.
The New York Times and the Associated Press quote researchers at the University of Toronto as saying close to 1,300 computers in 103 countries were affected.
The article says embassies, foreign ministries, government offices and Tibetan exile centers in several countries were affected, but that there is no evidence that U.S. government offices were breached.
The researchers say they were able to track the hacking effort to computers in China, but were unable to identiffy exactly who was behind the operation. The spy system appeared to be focused on governments of South Africa, Southeast Asia and the exiled Tibetan spiritual leader.
The Chinese Consulate in New York called the accusation nonsense.
The New York Times says the researchers began their investigation after a request from the Dalai Lama office in India. It says that two specialists found that intruders had stolen files from personal computers serving several Tibetan exile groups.
The researchers say the spy network possessed remarkable capabilities, including camera and audio-recording functions of infected computers for potential in-room monitoring.
Some information for this report was provided by AP and Reuters.
China accused of spying ops
-
izzix
- udonmap.com
- Posts: 2562
- Joined: November 30, 2005, 7:59 pm
- Location: where can i find a GOOD brass
China accused of spying ops
-
Laan Yaa Mo
- udonmap.com
- Posts: 9822
- Joined: February 7, 2007, 9:12 am
- Location: ขอนแก่น
Re: China accused of spying ops
It is interesting that the Thai embassy was targeted too.
If you go to GlobeandMail.com, you can watch a video about this (Ghost Net Report), read comments and so on.
Canadian researchers uncover spy plot against Dalai Lama
Canadians say they have uncovered broad espionage network affecting 103 countries plus Tibetan exiles
Article Comments (339) The Canadian Press
March 29, 2009 at 8:29 AM EDT
TORONTO — A cyber spy network based mainly in China has tapped into classified documents from government and private organizations in 103 countries, including the computers of Tibetan exiles, Canadian researchers said Saturday.
The work of the Information Warfare Monitor initially focused on allegations of Chinese cyber espionage against the Tibetan community in exile, especially the Dalai Lama, who is frequently denounced by Chinese officials.
The research eventually led to a much wider network of compromised machines, the Internet-based research group said.
Information Warfare Monitor is a joint effort of the SecDev Group in Ottawa and the Citizen Lab at the University of Toronto.
Related Articles
Recent
South Africa's ban of Dalai Lama leads to cancellation of peace conference
Loss of courage
Internet Links
Read: The GhostNet report
Information Warfare Monitor
The group said in a news release Sunday that investigators conducted field research in India, Europe and North America, including in the private office of the Dalai Lama, the Tibetan government-in-exile and several Tibetan NGOs.
Investigator Greg Walton said: "We uncovered real-time evidence of malware that had penetrated Tibetan computer systems, extracting sensitive documents from the private office of the Dalai Lama."
During the second phase of the investigation, the data led to the discovery of insecure, web-based interfaces to four control servers. The interfaces allow attackers to send instructions to and receive data from compromised computers.
"What we found is not so much unprecedented in scope and sophistication," said Nart Villeneuve, a senior IWM analyst.
"But the relatively small size of the network and concentration of high-value targets is significant. It does not fit the profile for a typical cyber crime network."
Principal investigators Ron Deibert and Rafal Rohozinski said: "This report serves as a wake-up call."
"At the very least, the large percentage of high-value targets compromised by this network demonstrates the relative ease with which a technically unsophisticated approach can quickly be harnessed to create a very effective spynet."
The compromised computers included, among many others, the ministry of foreign affairs of Iran; the embassies of India, South Korea, Indonesia, Thailand, Taiwan, Portugal, Germany and Pakistan; the ASEAN Secretariat; the Asian Development Bank; news organizations and an unclassified computer located at NATO headquarters.
The research group said while its analysis points to China as the main source of the network, it has not conclusively been able to detect the exact identity or motivation of the hackers.
A spokesman for the Chinese Consulate in New York dismissed the idea that China was involved.
The researchers said they have notified international law-enforcement agencies of the spying operation.
The F.B.I. declined comment on the operation.
The full report of the investigation entitled, "Tracking GhostNet: Investigating a Cyber Espionage Network," was released online Sunday.
Article Comments (339)
If you go to GlobeandMail.com, you can watch a video about this (Ghost Net Report), read comments and so on.
Canadian researchers uncover spy plot against Dalai Lama
Canadians say they have uncovered broad espionage network affecting 103 countries plus Tibetan exiles
Article Comments (339) The Canadian Press
March 29, 2009 at 8:29 AM EDT
TORONTO — A cyber spy network based mainly in China has tapped into classified documents from government and private organizations in 103 countries, including the computers of Tibetan exiles, Canadian researchers said Saturday.
The work of the Information Warfare Monitor initially focused on allegations of Chinese cyber espionage against the Tibetan community in exile, especially the Dalai Lama, who is frequently denounced by Chinese officials.
The research eventually led to a much wider network of compromised machines, the Internet-based research group said.
Information Warfare Monitor is a joint effort of the SecDev Group in Ottawa and the Citizen Lab at the University of Toronto.
Related Articles
Recent
South Africa's ban of Dalai Lama leads to cancellation of peace conference
Loss of courage
Internet Links
Read: The GhostNet report
Information Warfare Monitor
The group said in a news release Sunday that investigators conducted field research in India, Europe and North America, including in the private office of the Dalai Lama, the Tibetan government-in-exile and several Tibetan NGOs.
Investigator Greg Walton said: "We uncovered real-time evidence of malware that had penetrated Tibetan computer systems, extracting sensitive documents from the private office of the Dalai Lama."
During the second phase of the investigation, the data led to the discovery of insecure, web-based interfaces to four control servers. The interfaces allow attackers to send instructions to and receive data from compromised computers.
"What we found is not so much unprecedented in scope and sophistication," said Nart Villeneuve, a senior IWM analyst.
"But the relatively small size of the network and concentration of high-value targets is significant. It does not fit the profile for a typical cyber crime network."
Principal investigators Ron Deibert and Rafal Rohozinski said: "This report serves as a wake-up call."
"At the very least, the large percentage of high-value targets compromised by this network demonstrates the relative ease with which a technically unsophisticated approach can quickly be harnessed to create a very effective spynet."
The compromised computers included, among many others, the ministry of foreign affairs of Iran; the embassies of India, South Korea, Indonesia, Thailand, Taiwan, Portugal, Germany and Pakistan; the ASEAN Secretariat; the Asian Development Bank; news organizations and an unclassified computer located at NATO headquarters.
The research group said while its analysis points to China as the main source of the network, it has not conclusively been able to detect the exact identity or motivation of the hackers.
A spokesman for the Chinese Consulate in New York dismissed the idea that China was involved.
The researchers said they have notified international law-enforcement agencies of the spying operation.
The F.B.I. declined comment on the operation.
The full report of the investigation entitled, "Tracking GhostNet: Investigating a Cyber Espionage Network," was released online Sunday.
Article Comments (339)