IT wasn’t until Sunday of last week that Scott Henderson knew he’d been duped. The former US army intelligence officer, along with his colleague “Jumper” had been tracking an alleged Chinese hacker, nicknamed Lost33, who had promised him an interview. “Lost33 did not make contact with Jumper last night. In fact, it seems he spent the night changing his QQ number” — QQ is a popular Chinese instant messaging service — “and deleting all info from his blog. The Web site is now completely empty, except for a change to his personal data,” said Henderson on his blog (bit.ly/darkvisitor).
Henderson had been tracking Lost33 after his e-mail address — losttemp33@hotmail.com — turned up in an investigation called GhostNet (bit.ly/ghostnet2). GhostNet started when Information Warfare Monitor (IWF, bit.ly/infowar), a team of cyberwarfare researchers created by the University of Toronto and the Canadian security think tank SecDev, had been asked to conduct a security audit for the Tibetan government in exile. It had found malicious software on the Dalai Lama’s most sensitive computers.
The investigation found links back to command and control servers located mainly in China. From there, the IWF found infected computers under the control of those servers in 103 countries. They identified roughly a third of them, and found them all to be sensitive computers in organizations important to Chinese interests, including numerous embassies, telecommunications companies, and even Vietnamese petroleum firms. Just as Lost33’s identity and motives are shrouded in mystery, the final link between GhostNet and the Chinese government is also lacking.
Ostensibly, this looks like a state-sponsored cyber-spying ring. Especially when you read the part of the report in which a member of an online Tibetan outreach project was detained for two months and interrogated by Chinese officials. They presented her with copies of her Internet chat logs. The project’s machines were compromised by the same malware that filched the Dalai Lama’s files, and communicated with the GhostNet control servers.
But there could be other motives and actors, says the IWF. GhostNet could be a
for-profit initiative, operated by cyber-criminals. It could be operated from outside China, using compromised Chinese computers as proxies (one of the control servers — also the first to be shut down when GhostNet was discovered — was based in the US).
“Even ‘patriotic hackers’ could be acting on their own volition, or with the tacit approval of their government, as operators of the GhostNet,” says the IWF report. The problem is that all of these things are happening in China anyway. Henderson says that patriotic hacking has been a mainstay of the Chinese hacking underground since the mid-1990s.
After the Internet arrived in China in 1994, people began experimenting with the technology, and in 1997, the Green Army hacker group was formed. This gave way to the Red Hacker Alliance, a loosely connected set of groups that emerged after the Jakarta riots of 1998, when Chinese nationals were accused of destabilizing the country. Indonesian Web sites were defaced by outraged Chinese hackers, and a nationalistic movement took on force.
Since then, for-profit motives have emerged. “The history has changed from being a group wanting to protect the motherland, to being specialized hacker groups that are there for the purpose of making money,” Henderson says. Now, for example, hackers have broken the rule of thumb that prevented them from attacking Chinese IP addresses. That wouldn’t have been appropriate when cyber-attacks were motivated by nationalism. Now, in the age of commercialized cybercrime, anyone is fair game.
Zhao Wei (趙薇), co-founder of the Chinese Anti-Malware Alliance (中國反惡意軟件聯盟), has been battling against the hacker underground since 2006. He says that hackers in China are growing in number, due in part to the economic downturn — and that Chinese nationals are just as vulnerable to poor security in Chinese cyberspace.
“At least 20 million people in China lost their jobs, and after they spend all of their money … then they may turn to cybercrime,” says Wei. He adds that the online crime wave is spreading to smaller cities, which shot up in great numbers during the economic boom. Phishing and other cybercrime has supplanted physical crime in some of these places.
After all, why risk harsh punishment for ripping off a warehouse when you can rip off people electronically with scant fear of retribution? “The policemen think it’s cool. There’s no one on the street. They’re all going to the bar, and they’re working on phishing. The policemen love the Internet,” Wei says.
In addition to phishing and hacking Web sites, Chinese hackers have also exploited flaws in local third-party applications, which are often badly written, Wei says. China, known for its lax view of intellectual property, is rife with pirated copies of Windows software — local companies now provide their own security update services for the company’s software, he says.
So what are Chinese hackers looking for on their victims’ machines? Much the same as hackers outside the country, but online games accounts are also targeted, and World of Warcraft, the most popular multiplayer game worldwide, is a particular prize. Accumulated gold and character points from this game can be sold on the open market.
Attacks from Chinese hackers can also be more sophisticated. Dennis Dwyer, a threat intelligence analyst at the Atlanta-based managed security services firm SecureWorks, says that targeted attacks are a signature technique perfected by Chinese cyber-criminals. They will conduct extensive research on an organization to understand which individuals work there and how they’re related.
“What we have seen is very specific malware. They’ll be looking for people using a certain version of Word,” says Dwyer. The GhostNet report demonstrates how hackers persuaded victims to open infectious files by attaching them to e-mails supposedly from people they knew.
“We also see the use of zero-day or file format type exploits [malware applications],” confirms Dwyer. “In particular, we watch a group called Phantom. They’re very public about what they do. What they typically don’t do is use [the exploits] themselves. They sell them for others to use.”
This trend of selling exploits on the open market is now gravitating toward selling toolkits. SecureWorks has identified a new kit — Leopard in a Hole — that automates the kind of SQL injection attacks for which Chinese hackers have become famous. This time last year, Chinese hackers compromised tens of thousands of Web sites with malicious JavaScript. Versions of Leopard in a Hole that essentially allow
non-technical attackers to do this with a just a few mouse clicks have been found on sale for up to US$500. Online crime is now big business.
In all of this, one unanswered question remains. Who was responsible for GhostNet? “It’s convenient to have privateers. People who are given the king’s warrant to act on his behalf, but who are kept at arm’s length,” says Rafal Rohozinski, principal analyst at the IWF and co-author of the report. He likens cyberspace to the high seas of old, which were populated by what amounted to freelance warships sanctioned by the state. “I think these are third-party actors. Whether they’re deliberately commissioned, protected or allowed to raise money from other activities that are overlooked, I don’t know.”
In China, more than perhaps anywhere else in the world, there is a bountiful supply of such cyber-swashbucklers. Who knows how many other treasure chests people may have buried in the world’s networks — or whether we will ever be able to prove the true identity of those that put them there?
May 11 to May 18 The original Taichung Railway Station was long thought to have been completely razed. Opening on May 15, 1905, the one-story wooden structure soon outgrew its purpose and was replaced in 1917 by a grandiose, Western-style station. During construction on the third-generation station in 2017, workers discovered the service pit for the original station’s locomotive depot. A year later, a small wooden building on site was determined by historians to be the first stationmaster’s office, built around 1908. With these findings, the Taichung Railway Station Cultural Park now boasts that it has
The latest Formosa poll released at the end of last month shows confidence in President William Lai (賴清德) plunged 8.1 percent, while satisfaction with the Lai administration fared worse with a drop of 8.5 percent. Those lacking confidence in Lai jumped by 6 percent and dissatisfaction in his administration spiked up 6.7 percent. Confidence in Lai is still strong at 48.6 percent, compared to 43 percent lacking confidence — but this is his worst result overall since he took office. For the first time, dissatisfaction with his administration surpassed satisfaction, 47.3 to 47.1 percent. Though statistically a tie, for most
As Donald Trump’s executive order in March led to the shuttering of Voice of America (VOA) — the global broadcaster whose roots date back to the fight against Nazi propaganda — he quickly attracted support from figures not used to aligning themselves with any US administration. Trump had ordered the US Agency for Global Media, the federal agency that funds VOA and other groups promoting independent journalism overseas, to be “eliminated to the maximum extent consistent with applicable law.” The decision suddenly halted programming in 49 languages to more than 425 million people. In Moscow, Margarita Simonyan, the hardline editor-in-chief of the
Six weeks before I embarked on a research mission in Kyoto, I was sitting alone at a bar counter in Melbourne. Next to me, a woman was bragging loudly to a friend: She, too, was heading to Kyoto, I quickly discerned. Except her trip was in four months. And she’d just pulled an all-nighter booking restaurant reservations. As I snooped on the conversation, I broke out in a sweat, panicking because I’d yet to secure a single table. Then I remembered: Eating well in Japan is absolutely not something to lose sleep over. It’s true that the best-known institutions book up faster
RSS