GhostNet (simplified Chinese:幽灵网;traditional Chinese:幽靈網;pinyin:YōuLíngWǎng) is the name given by researchers at theInformation Warfare Monitor to a large-scalecyber spying[1][2] operation discovered in March 2009. The operation is likely associated with anadvanced persistent threat, or a network actor that spies undetected.[3] Its command and control infrastructure is based mainly in thePeople's Republic of China and GhostNet has infiltrated high-value political, economic and media locations[4] in 103 countries. Computer systems belonging toembassies, foreign ministries and other government offices, and theDalai Lama'sTibetan exile centers in India, London and New York City were compromised.
GhostNet was discovered and named following a 10-month investigation by theInfowar Monitor (IWM), carried out after IWM researchers approached theDalai Lama's representative in Geneva[5] suspecting that their computer network had been infiltrated.[6] The IWM is composed of researchers from The SecDev Group and Canadian consultancy and theCitizen Lab,Munk School of Global Affairs at theUniversity of Toronto; the research findings were published in theInfowar Monitor, an affiliated publication.[7] Researchers from theUniversity of Cambridge'sComputer Laboratory, supported by theInstitute for Information Infrastructure Protection,[8] also contributed to the investigation at one of the three locations inDharamshala, where the Tibetan government-in-exile is located. The discovery of the 'GhostNet', and details of its operations, were reported byThe New York Times on March 29, 2009.[7][9] Investigators focused initially on allegations of Chinese cyber-espionage against theTibetan exile community, such as instances where email correspondence and other data were extracted.[10]
Compromised systems were discovered in theembassies ofIndia,South Korea,Indonesia,Romania,Cyprus,Malta,Thailand,Taiwan,Portugal,Germany andPakistan and the office of the Prime Minister ofLaos. Theforeign ministries ofIran,Bangladesh,Latvia,Indonesia,Philippines,Brunei,Barbados andBhutan were also targeted.[1][11] No evidence was found thatU.S. orU.K. government offices were infiltrated, although aNATO computer was monitored for half a day and the computers of theIndian embassy inWashington, D.C., were infiltrated.[4][11][12]
Since its discovery, GhostNet has attacked other government networks, for example Canadian official financial departments in early 2011, forcing them off-line. Governments commonly do not admit such attacks, which must be verified by official but anonymous sources.[13]
Emails are sent to target organizations that contain contextually relevant information. These emails contain malicious attachments, that when opened, enable aTrojan horse to access the system.[citation needed] This Trojan connects back to a control server, usually located in China, to receive commands. The infected computer will then execute the command specified by the control server. Occasionally, the command specified by the control server will cause the infected computer to download and install a Trojan known asGh0st Rat that allows attackers to gain complete, real-time control of computers runningMicrosoft Windows.[4] Such a computer can be controlled or inspected by attackers, and the software even has the ability to turn on camera and audio-recording functions of infected computers, enabling attackers to perform surveillance.[7]
The researchers from the IWM stated they could not conclude that the Chinese government was responsible for the spy network.[14] However, a report from researchers at theUniversity of Cambridge says they believe that the Chinese government is behind the intrusions they analyzed at the Office of the Dalai Lama.[15]
Researchers have also noted the possibility that GhostNet was an operation run by private citizens in China for profit or for patriotic reasons, or created by intelligence agencies from other countries such as Russia or the United States.[7] The Chinese government has stated that China "strictly forbids any cyber crime."[1][10]
The "Ghostnet Report" documents several unrelated infections at Tibetan-related organizations in addition to the Ghostnet infections. By using the email addresses provided by the IWM report, Scott J. Henderson had managed to trace one of the operators of one of the infections (non-Ghostnet) toChengdu. He identifies the hacker as a 27-year-old man who had attended theUniversity of Electronic Science and Technology of China, and currently connected with the Chinese hackerunderground.[16]
Despite the lack of evidence to pinpoint the Chinese government as responsible for intrusions against Tibetan-related targets, researchers at Cambridge have found actions taken by Chinese government officials that corresponded with the information obtained via computer intrusions. One such incident involved a diplomat who was pressured by Beijing after receiving an email invitation to a visit with theDalai Lama from his representatives.[15]
Another incident involved a Tibetan woman who was interrogated by Chinese intelligence officers and was shown transcripts of her online conversations.[14][17] However, there are other possible explanations for this event. Drelwa usesQQ and other instant messengers to communicate with Chinese Internet users. In 2008, IWM found that TOM-Skype, the Chinese version of Skype, was logging and storing text messages exchanged between users. It is possible that the Chinese authorities acquired the chat transcripts through these means.[18]
IWM researchers have also found that when detected, GhostNet is consistently controlled from IP addresses located on the island ofHainan, China, and have pointed out that Hainan is home to the Lingshui signals intelligence facility and the Third Technical Department of the People's Liberation Army.[4] Furthermore, one of GhostNet's four control servers has been revealed to be agovernment server.[clarify][19]