Massive Chinese computer espionage network uncovered
Paul Harris in New York
Sunday 29 March 2009
A mystery electronic spy network apparently based in China has infiltrated hundreds of computers around the world and stolen files and documents, Canadian researchers have revealed.
The network, dubbed GhostNet, appears to target embassies, media groups, NGOs, international organisations, government foreign ministries and the offices of the Dalai Lama, leader of the Tibetan exile movement. The researchers, based at Toronto University’s Munk Centre for International Studies, said their discovery had profound implications.
“This report serves as a wake-up call… these are major disruptive capabilities that the professional information security community, as well as policymakers, need to come to terms with rapidly,” said researchers Ron Deibert and Rafal Rohozinski.
After 10 months of study, the researchers concluded that GhostNet had invaded 1,295 computers in 103 countries, but it appeared to be most focused on countries in south Asia and south-east Asia, as well as the Dalai Lama’s offices in India, Brussels, London and New York. The network continues to infiltrate dozens of new computers each week.
Such a pattern, and the fact that the network seemed to be controlled from computers inside China, could suggest that GhostNet was set up or linked to Chinese government espionage agencies. However, the researchers were clear that they had not been able to identify who was behind the network, and said it could be run by private citizens in China or a different country altogether. A Chinese government spokesmen has denied any official involvement.
GhostNet can invade a computer over the internet and penetrate and steal secret files. It can also turn on the cameras and microphones of an infected computer, effectively creating a bug that can monitor what is going inside the room where the computer is. Anyone could be watched and listened to.
The researchers said they had been tipped off to the network after having been asked by officials with the Dalai Lama to examine their computers. The officials had been worried that their computers were being infected and monitored by outsiders. The Chinese government regularly attacks the Tibetan exile movement as encouraging separatism and terrorism within China. The researchers found that the computers had succumbed to cyber-attack and that numerous files, including letters and emails, had been stolen. The intruders had also gained control of the electronic mail server of the Dalai Lama’s computers.
“The investigation was able to conclude that Tibetan computer systems were compromised by multiple infections that gave attackers unprecedented access to potentially sensitive information, including documents from the private office of the Dalai Lama,” the researchers concluded in their report. They have now notified various law enforcement agencies, including international groups and the FBI.
The news also comes as researchers at Cambridge University prepare to release a report today called Snooping Dragon, which looks at suspected Chinese cyber-monitoring of Tibetan exile groups. The report is expected to detail the unexpected scale and sophistication of such efforts by a government against a private body.
