IT wasn’t until Sunday of last week that Scott Henderson knew he’d been duped. The former US army intelligence officer, along with his colleague “Jumper” had been tracking an alleged Chinese hacker, nicknamed Lost33, who had promised him an interview. “Lost33 did not make contact with Jumper last night. In fact, it seems he spent the night changing his QQ number” — QQ is a popular Chinese instant messaging service — “and deleting all info from his blog. The Web site is now completely empty, except for a change to his personal data,” said Henderson on his blog (bit.ly/darkvisitor).
Henderson had been tracking Lost33 after his e-mail address — losttemp33@hotmail.com — turned up in an investigation called GhostNet (bit.ly/ghostnet2). GhostNet started when Information Warfare Monitor (IWF, bit.ly/infowar), a team of cyberwarfare researchers created by the University of Toronto and the Canadian security think tank SecDev, had been asked to conduct a security audit for the Tibetan government in exile. It had found malicious software on the Dalai Lama’s most sensitive computers.
The investigation found links back to command and control servers located mainly in China. From there, the IWF found infected computers under the control of those servers in 103 countries. They identified roughly a third of them, and found them all to be sensitive computers in organizations important to Chinese interests, including numerous embassies, telecommunications companies, and even Vietnamese petroleum firms. Just as Lost33’s identity and motives are shrouded in mystery, the final link between GhostNet and the Chinese government is also lacking.
Ostensibly, this looks like a state-sponsored cyber-spying ring. Especially when you read the part of the report in which a member of an online Tibetan outreach project was detained for two months and interrogated by Chinese officials. They presented her with copies of her Internet chat logs. The project’s machines were compromised by the same malware that filched the Dalai Lama’s files, and communicated with the GhostNet control servers.
But there could be other motives and actors, says the IWF. GhostNet could be a
for-profit initiative, operated by cyber-criminals. It could be operated from outside China, using compromised Chinese computers as proxies (one of the control servers — also the first to be shut down when GhostNet was discovered — was based in the US).
“Even ‘patriotic hackers’ could be acting on their own volition, or with the tacit approval of their government, as operators of the GhostNet,” says the IWF report. The problem is that all of these things are happening in China anyway. Henderson says that patriotic hacking has been a mainstay of the Chinese hacking underground since the mid-1990s.
After the Internet arrived in China in 1994, people began experimenting with the technology, and in 1997, the Green Army hacker group was formed. This gave way to the Red Hacker Alliance, a loosely connected set of groups that emerged after the Jakarta riots of 1998, when Chinese nationals were accused of destabilizing the country. Indonesian Web sites were defaced by outraged Chinese hackers, and a nationalistic movement took on force.
Since then, for-profit motives have emerged. “The history has changed from being a group wanting to protect the motherland, to being specialized hacker groups that are there for the purpose of making money,” Henderson says. Now, for example, hackers have broken the rule of thumb that prevented them from attacking Chinese IP addresses. That wouldn’t have been appropriate when cyber-attacks were motivated by nationalism. Now, in the age of commercialized cybercrime, anyone is fair game.
Zhao Wei (趙薇), co-founder of the Chinese Anti-Malware Alliance (中國反惡意軟件聯盟), has been battling against the hacker underground since 2006. He says that hackers in China are growing in number, due in part to the economic downturn — and that Chinese nationals are just as vulnerable to poor security in Chinese cyberspace.
“At least 20 million people in China lost their jobs, and after they spend all of their money … then they may turn to cybercrime,” says Wei. He adds that the online crime wave is spreading to smaller cities, which shot up in great numbers during the economic boom. Phishing and other cybercrime has supplanted physical crime in some of these places.
After all, why risk harsh punishment for ripping off a warehouse when you can rip off people electronically with scant fear of retribution? “The policemen think it’s cool. There’s no one on the street. They’re all going to the bar, and they’re working on phishing. The policemen love the Internet,” Wei says.
In addition to phishing and hacking Web sites, Chinese hackers have also exploited flaws in local third-party applications, which are often badly written, Wei says. China, known for its lax view of intellectual property, is rife with pirated copies of Windows software — local companies now provide their own security update services for the company’s software, he says.
So what are Chinese hackers looking for on their victims’ machines? Much the same as hackers outside the country, but online games accounts are also targeted, and World of Warcraft, the most popular multiplayer game worldwide, is a particular prize. Accumulated gold and character points from this game can be sold on the open market.
Attacks from Chinese hackers can also be more sophisticated. Dennis Dwyer, a threat intelligence analyst at the Atlanta-based managed security services firm SecureWorks, says that targeted attacks are a signature technique perfected by Chinese cyber-criminals. They will conduct extensive research on an organization to understand which individuals work there and how they’re related.
“What we have seen is very specific malware. They’ll be looking for people using a certain version of Word,” says Dwyer. The GhostNet report demonstrates how hackers persuaded victims to open infectious files by attaching them to e-mails supposedly from people they knew.
“We also see the use of zero-day or file format type exploits [malware applications],” confirms Dwyer. “In particular, we watch a group called Phantom. They’re very public about what they do. What they typically don’t do is use [the exploits] themselves. They sell them for others to use.”
This trend of selling exploits on the open market is now gravitating toward selling toolkits. SecureWorks has identified a new kit — Leopard in a Hole — that automates the kind of SQL injection attacks for which Chinese hackers have become famous. This time last year, Chinese hackers compromised tens of thousands of Web sites with malicious JavaScript. Versions of Leopard in a Hole that essentially allow
non-technical attackers to do this with a just a few mouse clicks have been found on sale for up to US$500. Online crime is now big business.
In all of this, one unanswered question remains. Who was responsible for GhostNet? “It’s convenient to have privateers. People who are given the king’s warrant to act on his behalf, but who are kept at arm’s length,” says Rafal Rohozinski, principal analyst at the IWF and co-author of the report. He likens cyberspace to the high seas of old, which were populated by what amounted to freelance warships sanctioned by the state. “I think these are third-party actors. Whether they’re deliberately commissioned, protected or allowed to raise money from other activities that are overlooked, I don’t know.”
In China, more than perhaps anywhere else in the world, there is a bountiful supply of such cyber-swashbucklers. Who knows how many other treasure chests people may have buried in the world’s networks — or whether we will ever be able to prove the true identity of those that put them there?
On the final approach to Lanshan Workstation (嵐山工作站), logging trains crossed one last gully over a dramatic double bridge, taking the left line to enter the locomotive shed or the right line to continue straight through, heading deeper into the Central Mountains. Today, hikers have to scramble down a steep slope into this gully and pass underneath the rails, still hanging eerily in the air even after the bridge’s supports collapsed long ago. It is the final — but not the most dangerous — challenge of a tough two-day hike in. Back when logging was still underway, it was a quick,
From censoring “poisonous books” to banning “poisonous languages,” the Chinese Nationalist Party (KMT) tried hard to stamp out anything that might conflict with its agenda during its almost 40 years of martial law. To mark 228 Peace Memorial Day, which commemorates the anti-government uprising in 1947, which was violently suppressed, I visited two exhibitions detailing censorship in Taiwan: “Silenced Pages” (禁書時代) at the National 228 Memorial Museum and “Mandarin Monopoly?!” (請說國語) at the National Human Rights Museum. In both cases, the authorities framed their targets as “evils that would threaten social mores, national stability and their anti-communist cause, justifying their actions
In the run-up to World War II, Admiral Wilhelm Canaris, head of Abwehr, Nazi Germany’s military intelligence service, began to fear that Hitler would launch a war Germany could not win. Deeply disappointed by the sell-out of the Munich Agreement in 1938, Canaris conducted several clandestine operations that were aimed at getting the UK to wake up, invest in defense and actively support the nations Hitler planned to invade. For example, the “Dutch war scare” of January 1939 saw fake intelligence leaked to the British that suggested that Germany was planning to invade the Netherlands in February and acquire airfields
Taiwanese chip-making giant Taiwan Semiconductor Manufacturing Co (TSMC) plans to invest a whopping US$100 billion in the US, after US President Donald Trump threatened to slap tariffs on overseas-made chips. TSMC is the world’s biggest maker of the critical technology that has become the lifeblood of the global economy. This week’s announcement takes the total amount TSMC has pledged to invest in the US to US$165 billion, which the company says is the “largest single foreign direct investment in US history.” It follows Trump’s accusations that Taiwan stole the US chip industry and his threats to impose tariffs of up to 100 percent
RSS