GhostNet cyber espionage probe still has loose ends

Nearly three months after a report detailed an extensive, worldwide cyber espionage operation, many countries that were hacked may not have been formally notified yet.

Legal barriers have hampered efforts to contact many countries whose computers in embassies and ministries of foreign affairs were infected with malicious software capable of stealing data, said Nart Villeneuve, one of the authors of a detailed 53-page report that shed new light on the extent of cyber spying.

The report was written by analysts with the Information Warfare Monitor, a research project of the SecDev Group, a think tank, and the Munk Center for International Studies at the University of Toronto.

The analysts uncovered an operation nicknamed "GhostNet" that infected computers belonging Tibetan nongovernmental organizations and the private office of the Dalai Lama.

Further investigation showed the computers of 103 countries were infected as well as organizations such as the ASEAN (Association of Southeast Asian Nations) secretariat and the Asian Development Bank. Data was shipped to remote servers, many of which were located in China.

The report was one of the first publicly revealed investigations that showed how easy it was for hackers to target organizations through social engineering and malware attacks.

The hackers used commonly available malware, a remote access tool called gh0st RAT (Remote Access Tool), to steal sensitive documents, operate Web cams and completely control infected computers. In the case of the Tibetan NGOs, staffers received e-mail containing a Microsoft Word document that if opened exploited a known vulnerability that wasn't patched in the application.

A number of mistakes by the hackers allowed investigators to pinpoint servers used to collect data and the extent of the probes, Villeneuve said.

Villeneuve said detailed information on compromised computers has only been given to the Canadian Cyber Incident Response Center (CCIRC), the country's national cyber reporting center. The CCIRC is in the process of contacting some of the groups affected, he said.

The analysts who wrote the report felt that was the safest option, since they did not want to reveal exactly what computers had been compromised to countries that could potentially abuse the sensitive information.

Sign up for ITworld's Daily newsletter
Follow ITworld on Twitter @IT_world

• Email
• Print
• Share
  • Slashdot
  • Digg
  • Stumble
  • Reddit
  • Newsvine