China accused over global computer spy ring

Dan Glaister in Los Angeles

The Guardian

March 30

An enormous electronic espionage programme run from servers in China has been used to spy on computers in more than 100 countries, according to two reports published at the weekend.

The reports, published by the universities of Cambridge and Toronto, detail a "murky realm" where cyber spooks infiltrate email, take over humble desktop computers and use them to spy on organisations, individuals and governments.

The reports name the system GhostNet, and claim that it has been used to attack governments in south and south-east Asia as well as the offices of the Dalai Lama. In two years, the reports suggest, the operation infiltrated 1,295 computers in 103 countries.

While one of the reports remains mute on the identity of the perpetrators, the other has no such qualms, warning that the Chinese government ran a series of cyber attacks on Tibetan exile groups. The Chinese foreign ministry could not be reached for comment.

"What Chinese spooks did in 2008, Russian crooks will do in 2010 and even low-budget criminals from less developed countries will follow in due course," conclude the Cambridge authors of The Snooping Dragon: Social Malware Surveillance of the Tibetan Movement.

But the authors of Tracking GhostNet argue that things may not be as they seem in the world of electronic espionage. "We're a bit more careful about it, knowing the nuance of what happens in the subterranean realms," said Ronald Deibert from the University of Toronto. "This could well be the CIA or the Russians. It's a murky realm that we're lifting the lid on."

The attacks were simple and direct. Infected emails bearing attachments or links to websites were sent to organisations including the private office of the Dalai Lama. Once opened, the virus allowed hackers to operate the host computer, including moving files and sending and receiving data. Their potential control was such that they could turn on an infected computer's camera and microphone, creating a surveillance bug.

The investigations began after Toronto researchers were asked by the Dalai Lama's offices to examine their computers. Officials had become concerned that communications were being intercepted. The researchers found that computers had been infected by a virus created by malicious software - or malware. That discovery led them to a group of servers on Hainan Island, off China. Other servers they tracked were based in China's Xinjiang Uyghur autonomous region, where intelligence units dealing with Tibetan independence groups are based.

"We uncovered real-time evidence of malware that had penetrated Tibetan computer systems, extracting sensitive documents from the private office of the Dalai Lama," researcher Greg Walton said.

The 10-month investigation also detected bugged computers in the foreign ministries of several countries, including Iran and Indonesia, and in the embassies of India, South Korea, Taiwan, Portugal, Germany and Pakistan.

The reports come in the wake of the annual report of the US-China Economic and Security Review Commission, published in November, which found the computer systems of US government agencies and defence companies had been compromised by Chinese hackers.

The Snooping Dragon, produced by two researchers at Cambridge University's computer laboratory, warns that what they term "social malware surveillance" are likely to spread. Defence, they suggest, is almost impossible.

"Although the attack we describe came from a major government, the techniques their agents used are available even to private individuals and are quite shockingly effective," they write.