IT wasn’t until Sunday of last week that Scott Henderson knew he’d been duped. The former US army intelligence officer, along with his colleague “Jumper” had been tracking an alleged Chinese hacker, nicknamed Lost33, who had promised him an interview. “Lost33 did not make contact with Jumper last night. In fact, it seems he spent the night changing his QQ number” — QQ is a popular Chinese instant messaging service — “and deleting all info from his blog. The Web site is now completely empty, except for a change to his personal data,” said Henderson on his blog (bit.ly/darkvisitor).
Henderson had been tracking Lost33 after his e-mail address — firstname.lastname@example.org — turned up in an investigation called GhostNet (bit.ly/ghostnet2). GhostNet started when Information Warfare Monitor (IWF, bit.ly/infowar), a team of cyberwarfare researchers created by the University of Toronto and the Canadian security think tank SecDev, had been asked to conduct a security audit for the Tibetan government in exile. It had found malicious software on the Dalai Lama’s most sensitive computers.
The investigation found links back to command and control servers located mainly in China. From there, the IWF found infected computers under the control of those servers in 103 countries. They identified roughly a third of them, and found them all to be sensitive computers in organizations important to Chinese interests, including numerous embassies, telecommunications companies, and even Vietnamese petroleum firms. Just as Lost33’s identity and motives are shrouded in mystery, the final link between GhostNet and the Chinese government is also lacking.
Ostensibly, this looks like a state-sponsored cyber-spying ring. Especially when you read the part of the report in which a member of an online Tibetan outreach project was detained for two months and interrogated by Chinese officials. They presented her with copies of her Internet chat logs. The project’s machines were compromised by the same malware that filched the Dalai Lama’s files, and communicated with the GhostNet control servers.
But there could be other motives and actors, says the IWF. GhostNet could be a
for-profit initiative, operated by cyber-criminals. It could be operated from outside China, using compromised Chinese computers as proxies (one of the control servers — also the first to be shut down when GhostNet was discovered — was based in the US).
“Even ‘patriotic hackers’ could be acting on their own volition, or with the tacit approval of their government, as operators of the GhostNet,” says the IWF report. The problem is that all of these things are happening in China anyway. Henderson says that patriotic hacking has been a mainstay of the Chinese hacking underground since the mid-1990s.
After the Internet arrived in China in 1994, people began experimenting with the technology, and in 1997, the Green Army hacker group was formed. This gave way to the Red Hacker Alliance, a loosely connected set of groups that emerged after the Jakarta riots of 1998, when Chinese nationals were accused of destabilizing the country. Indonesian Web sites were defaced by outraged Chinese hackers, and a nationalistic movement took on force.
Since then, for-profit motives have emerged. “The history has changed from being a group wanting to protect the motherland, to being specialized hacker groups that are there for the purpose of making money,” Henderson says. Now, for example, hackers have broken the rule of thumb that prevented them from attacking Chinese IP addresses. That wouldn’t have been appropriate when cyber-attacks were motivated by nationalism. Now, in the age of commercialized cybercrime, anyone is fair game.
Zhao Wei (趙薇), co-founder of the Chinese Anti-Malware Alliance (中國反惡意軟件聯盟), has been battling against the hacker underground since 2006. He says that hackers in China are growing in number, due in part to the economic downturn — and that Chinese nationals are just as vulnerable to poor security in Chinese cyberspace.
“At least 20 million people in China lost their jobs, and after they spend all of their money … then they may turn to cybercrime,” says Wei. He adds that the online crime wave is spreading to smaller cities, which shot up in great numbers during the economic boom. Phishing and other cybercrime has supplanted physical crime in some of these places.
After all, why risk harsh punishment for ripping off a warehouse when you can rip off people electronically with scant fear of retribution? “The policemen think it’s cool. There’s no one on the street. They’re all going to the bar, and they’re working on phishing. The policemen love the Internet,” Wei says.
In addition to phishing and hacking Web sites, Chinese hackers have also exploited flaws in local third-party applications, which are often badly written, Wei says. China, known for its lax view of intellectual property, is rife with pirated copies of Windows software — local companies now provide their own security update services for the company’s software, he says.
So what are Chinese hackers looking for on their victims’ machines? Much the same as hackers outside the country, but online games accounts are also targeted, and World of Warcraft, the most popular multiplayer game worldwide, is a particular prize. Accumulated gold and character points from this game can be sold on the open market.
Attacks from Chinese hackers can also be more sophisticated. Dennis Dwyer, a threat intelligence analyst at the Atlanta-based managed security services firm SecureWorks, says that targeted attacks are a signature technique perfected by Chinese cyber-criminals. They will conduct extensive research on an organization to understand which individuals work there and how they’re related.
“What we have seen is very specific malware. They’ll be looking for people using a certain version of Word,” says Dwyer. The GhostNet report demonstrates how hackers persuaded victims to open infectious files by attaching them to e-mails supposedly from people they knew.
“We also see the use of zero-day or file format type exploits [malware applications],” confirms Dwyer. “In particular, we watch a group called Phantom. They’re very public about what they do. What they typically don’t do is use [the exploits] themselves. They sell them for others to use.”
non-technical attackers to do this with a just a few mouse clicks have been found on sale for up to US$500. Online crime is now big business.
In all of this, one unanswered question remains. Who was responsible for GhostNet? “It’s convenient to have privateers. People who are given the king’s warrant to act on his behalf, but who are kept at arm’s length,” says Rafal Rohozinski, principal analyst at the IWF and co-author of the report. He likens cyberspace to the high seas of old, which were populated by what amounted to freelance warships sanctioned by the state. “I think these are third-party actors. Whether they’re deliberately commissioned, protected or allowed to raise money from other activities that are overlooked, I don’t know.”
In China, more than perhaps anywhere else in the world, there is a bountiful supply of such cyber-swashbucklers. Who knows how many other treasure chests people may have buried in the world’s networks — or whether we will ever be able to prove the true identity of those that put them there?
The chills were what first tipped me off that something was wrong. It was an early Thursday evening in late February and I was sitting in my office. I normally hit an energy low this time of the day but this was different, as I suddenly felt chilled, absolutely drained of energy, the lightest of achiness in my muscles and joints and a slight pain behind my eyeballs. I went home, took a long hot shower and went to bed early. After a full day of rest, I felt normal enough on Saturday to jump on my bike and enjoy
1. If you go to the hospital for a check-up, plan for the worst-case scenario — having to stay there without returning home. Have a hospital “grab bag” to either take with you or have someone deliver. Recommended items include: T-shirts, shorts and sleeping clothes, socks and underwear, sweater/fleece, personal toiletries and medications, computer (and headphones) and phone plus charging cables, towel, slippers, nail clippers and reading material. Also, have a water bottle/container that nurses can fill up with drinking water. Remember that Taiwanese hospitals generally only provide the most basic of daily necessities. 2. If you test positive, anticipate
When a man surnamed Chen discovered that his wife, surnamed Chang, was having an affair with a foreign national surnamed James, he hired private investigators to catch them having sex. Chen and three private investigators staked out James’ apartment and, when they heard moaning sounds coming from Chang, burst in and filmed the couple in flagrante delicto. A judge later found the pair guilty of adultery and sentenced them to four months in prison, and ordered the foreign national to be deported. Like anywhere, adultery is a daily occurrence in Taiwan, and rarely a day passes when an adulterous couple
With around 10,000 descendants packing the ancestral shrine every Tomb Sweeping Day, the Yeh family’s grand affair made a bid for the Guiness Book of World Records in 2016. They won’t be coming even close on Saturday. Due to the COVID-19 pandemic, less than 30 people will be attending and conducting the rituals. “We hope that our ancestors don’t take offense,” branch association head Yeh Lun-tsai (葉倫在) tells the Liberty Times (sister paper of the Taipei Times). Tomb Sweeping Day activities can potentially aggravate the spread of the virus as large groups congregate in cemeteries and columbariums at the same