Network Security News

Chinese possibly behind GhostNet attacks

Tuesday, March 31, 2009

The network security industry is reacting strongly to cyberthreats from China after a report over the weekend revealed that a cyberespionage network called GhostNet may be based from servers in mainland China.

Security researchers in Canada identified "high-value targets" victimized by cyberattacks from GhostNet, including the Dalai Lama, foreign embassies and ministries and NATO. Ron Deibert and Rafal Rohozinski released their 53-page report Sunday.

"The attacker(s) are able to exploit several infection vectors," the researchers wrote. "First, they create web pages that contain drive-by exploit code that infects the computers of those who visit the page. Second, the attacker(s) have also shown that they engage in spear phishing in which contextually relevant emails are sent to targets with PDF and DOC attachments."

Security experts said the attacks could be from other sources, although circumstantial evidence points to the involvement of Chinese hackers, even if they are not controlled by the communist regime.

The attacks were highly sophisticated, suggesting a level of skill and motivation that ordinary cybercriminals lack, experts said. The hackers were able to use spear-phishing emails that linked the exploited machines to command servers that order infected PCs to send stolen data, experts said.