pkd
FULL MEMBER
- Joined
- Aug 29, 2009
- Messages
- 1,432
- Reaction score
- 0
TORONTO Turning the tables on a China-based computer espionage gang, Canadian and United States computer security researchers have monitored a spying operation for the past eight months, observing while the intruders pilfered classified and restricted documents from the highest levels of the Indian Defense Ministry.
In a report issued Monday night, the researchers, based at the Munk School of Global Affairs at the University of Toronto, provide a detailed account of how a spy operation it called the Shadow Network systematically hacked into personal computers in government offices on several continents.
The Toronto spy hunters not only learned what kinds of material had been stolen, but were able to see some of the documents, including classified assessments about security in several Indian states, and confidential embassy documents about Indias relationships in West Africa, Russia and the Middle East. The intruders breached the systems of independent analysts, taking reports on several Indian missile systems. They also obtained a years worth of the Dalai Lamas personal e-mail messages.
The intruders even stole documents related to the travel of NATO forces in Afghanistan, illustrating that even though the Indian government was the primary target of the attacks, one chink in computer security can leave many nations exposed.
Its not only that youre only secure as the weakest link in your network, said Rafal Rohozinski, a member of the Toronto team. But in an interconnected world, youre only as secure as the weakest link in the global chain of information.
As recently as early March, the Indian communications minister, Sachin Pilot, told reporters that government networks had been attacked by China, but that not one attempt has been successful. But on March 24, the Toronto researchers said, they contacted intelligence officials in India and told them of the spy ring they had been tracking. They requested and were given instructions on how to dispose of the classified and restricted documents.
On Monday, Sitanshu Kar, a spokesman for the Indian Defense Ministry, said officials were looking into the report, but had no official statement.
The attacks look like the work of a criminal gang based in Sichuan Province, but as with all cyberattacks, it is easy to mask the true origin, the researchers said. Given the sophistication of the intruders and the targets of the operation, the researchers said, it is possible that the Chinese government approved of the spying.
When asked about the new report on Monday, a propaganda official in Sichuans capital, Chengdu, said its ridiculous to suggest that the Chinese government might have played a role. The Chinese government considers hacking a cancer to the whole society, said the official, Ye Lao. Tensions have risen between China and the United States this year after a statement by Google in January that it and dozens of other companies had been the victims of computer intrusions coming from China.
The spy operation appears to be different from the Internet intruders identified by Google and from a surveillance ring known as Ghostnet, also believed to be operating from China, which the Canadian researchers identified in March of last year. Ghostnet used computer servers based largely on the island of Hainan to steal documents from the Dalai Lama, the exiled Tibetan spiritual leader, and governments and corporations in more than 103 countries.
The Ghostnet investigation led the researchers to this second Internet spy operation, which is the subject of their new report, titled Shadows in the Cloud: An investigation Into Cyberespionage 2.0. The new report shows that the India-focused spy ring made extensive use of Internet services like Twitter, Google Groups, Blogspot, blog.com, Baidu Blogs and Yahoo! Mail to automate the control of computers once they had been infected.
The Canadian researchers cooperated in their investigation with a volunteer group of security experts in the United States at the Shadowserver Foundation, which focuses on Internet criminal activity.
This would definitely rank in the sophisticated range, said Steven Adair, a security research with the group. While we dont know exactly whos behind it, we know they selected their targets with great care.
By gaining access to the control servers used by the second cyber gang, the researchers observed the theft of a wide range of material, including classified documents from the Indian government and reports taken from Indian military analysts and corporations, as well as documents from agencies of the United Nations and other governments.
We snuck around behind the backs of the attackers and picked their pockets, said Ronald J. Deibert, a political scientist who is director of the Citizen Lab, a cybersecurity research group at the Munk School. Ive not seen anything remotely close to the depth and the sensitivity of the documents that weve recovered.
The researchers said the second spy ring was more sophisticated and difficult to detect than the Ghostnet operation.
By examining a series of e-mail addresses, the investigators traced the attacks to hackers who appeared to be based in Chengdu, which is home to a large population from neighboring Tibet. Researchers believe that one hacker used the code name lost33 and that he may have been affiliated with the citys prestigious University of Electronic Science and Technology. The university publishes books on computer hacking and offers courses in network attack and defense technology and information conflict technology, according to its Web site.
The Peoples Liberation Army also operates a technical reconnaissance bureau in the city, and helps finance the universitys research on computer network defense. A university spokesman could not be reached Monday because of a national holiday.
The Peoples Liberation Army also operates a technical reconnaissance bureau in the city, and helps finance the universitys research on computer network defense. A university spokesman could not be reached Monday because of a national holiday.
Researchers Trace Data Theft to China - NYTimes.com
In a report issued Monday night, the researchers, based at the Munk School of Global Affairs at the University of Toronto, provide a detailed account of how a spy operation it called the Shadow Network systematically hacked into personal computers in government offices on several continents.
The Toronto spy hunters not only learned what kinds of material had been stolen, but were able to see some of the documents, including classified assessments about security in several Indian states, and confidential embassy documents about Indias relationships in West Africa, Russia and the Middle East. The intruders breached the systems of independent analysts, taking reports on several Indian missile systems. They also obtained a years worth of the Dalai Lamas personal e-mail messages.
The intruders even stole documents related to the travel of NATO forces in Afghanistan, illustrating that even though the Indian government was the primary target of the attacks, one chink in computer security can leave many nations exposed.
Its not only that youre only secure as the weakest link in your network, said Rafal Rohozinski, a member of the Toronto team. But in an interconnected world, youre only as secure as the weakest link in the global chain of information.
As recently as early March, the Indian communications minister, Sachin Pilot, told reporters that government networks had been attacked by China, but that not one attempt has been successful. But on March 24, the Toronto researchers said, they contacted intelligence officials in India and told them of the spy ring they had been tracking. They requested and were given instructions on how to dispose of the classified and restricted documents.
On Monday, Sitanshu Kar, a spokesman for the Indian Defense Ministry, said officials were looking into the report, but had no official statement.
The attacks look like the work of a criminal gang based in Sichuan Province, but as with all cyberattacks, it is easy to mask the true origin, the researchers said. Given the sophistication of the intruders and the targets of the operation, the researchers said, it is possible that the Chinese government approved of the spying.
When asked about the new report on Monday, a propaganda official in Sichuans capital, Chengdu, said its ridiculous to suggest that the Chinese government might have played a role. The Chinese government considers hacking a cancer to the whole society, said the official, Ye Lao. Tensions have risen between China and the United States this year after a statement by Google in January that it and dozens of other companies had been the victims of computer intrusions coming from China.
The spy operation appears to be different from the Internet intruders identified by Google and from a surveillance ring known as Ghostnet, also believed to be operating from China, which the Canadian researchers identified in March of last year. Ghostnet used computer servers based largely on the island of Hainan to steal documents from the Dalai Lama, the exiled Tibetan spiritual leader, and governments and corporations in more than 103 countries.
The Ghostnet investigation led the researchers to this second Internet spy operation, which is the subject of their new report, titled Shadows in the Cloud: An investigation Into Cyberespionage 2.0. The new report shows that the India-focused spy ring made extensive use of Internet services like Twitter, Google Groups, Blogspot, blog.com, Baidu Blogs and Yahoo! Mail to automate the control of computers once they had been infected.
The Canadian researchers cooperated in their investigation with a volunteer group of security experts in the United States at the Shadowserver Foundation, which focuses on Internet criminal activity.
This would definitely rank in the sophisticated range, said Steven Adair, a security research with the group. While we dont know exactly whos behind it, we know they selected their targets with great care.
By gaining access to the control servers used by the second cyber gang, the researchers observed the theft of a wide range of material, including classified documents from the Indian government and reports taken from Indian military analysts and corporations, as well as documents from agencies of the United Nations and other governments.
We snuck around behind the backs of the attackers and picked their pockets, said Ronald J. Deibert, a political scientist who is director of the Citizen Lab, a cybersecurity research group at the Munk School. Ive not seen anything remotely close to the depth and the sensitivity of the documents that weve recovered.
The researchers said the second spy ring was more sophisticated and difficult to detect than the Ghostnet operation.
By examining a series of e-mail addresses, the investigators traced the attacks to hackers who appeared to be based in Chengdu, which is home to a large population from neighboring Tibet. Researchers believe that one hacker used the code name lost33 and that he may have been affiliated with the citys prestigious University of Electronic Science and Technology. The university publishes books on computer hacking and offers courses in network attack and defense technology and information conflict technology, according to its Web site.
The Peoples Liberation Army also operates a technical reconnaissance bureau in the city, and helps finance the universitys research on computer network defense. A university spokesman could not be reached Monday because of a national holiday.
The Peoples Liberation Army also operates a technical reconnaissance bureau in the city, and helps finance the universitys research on computer network defense. A university spokesman could not be reached Monday because of a national holiday.
Researchers Trace Data Theft to China - NYTimes.com
Beats me! what were these guys doing? Snooping to see if Computers all over the world are safe?!? 
