A spy network targeting sensitive government networks in India and other countries has been pilfering highly classified and other sensitive documents related to missile systems, the movement of military forces and relations among countries, according to a report released Tuesday.
It also grabbed nearly a year’s worth of personal correspondence from the Dalai Lama’s office, even after reports published last year indicated that the Dalai Lama’s network had been compromised in what is believed to be a separate breach.
The researchers say the network is an example of a sophisticated shift that has occurred in malware networks from “what were once primarily simple to increasingly complex, adaptive systems spread across redundant services and platforms” and from ones that primarily focused on exploitation for criminal purposes to ones that are focused on “political, military, and intelligence-focused espionage.”
The spy network, dubbed Shadow Network, was discovered by a group of computer security researchers in Canada and the United States, who have been monitoring the espionage for at least eight months and watched as the spies siphoned classified and other restricted documents from the Indian Defense Ministry and other networks.
The researchers — based primarily at the Munk School of Global Affairs’ Citizen Lab at the University of Toronto and at SecDev Group, a consultancy in Ottawa — are the same ones who reported last March on another spynet, dubbed Ghost Net, that had breached computers of the Dalai Lama and more than 1,200 other systems at embassies, foreign ministries, news media outlets and non-governmental organizations based primarily in South and Southeast Asia. The researchers, who worked with colleagues at the Shadowserver Foundation in the U.S., discovered the Shadow Network last year while investigating the Ghost Net. While the Ghost Net focused primarily on the Dalai Lama and Asia, the Shadow Network focused primarily on India, though also targeted the Office of the Dalai Lama, the United Nations, the Pakistan Embassy in the U.S. and numerous other institutions and private companies.
According to the report by the researchers, “Shadows in the Cloud”, the documents pilfered through the Shadow Network included classified assessments about security in several Indian states, as well as sensitive and confidential embassy documents about Indias relationships with Russia and nations in West Africa and the Middle East and “secret assessments of Indias security situation in the states of Assam, Manipur, Nagaland and Tripura, as well as concerning the Naxalites and Maoists, two political opposition groups. The spies also stole documents from the United Nations Economic and Social Commission for Asia and the Pacific.
The intruders obtained reports on several Indian missile systems as well as documents related to the travel of NATO forces in Afghanistan. There is evidence that computers at Indian embassies in Kabul, Moscow and Dubai, United Arab Emirates, and at the High Commission of India in Abuja, Nigeria had been compromised, including ones the process visa applications.
Among the stolen data, the researchers found visa applications submitted to Indian diplomatic missions in Afghanistan from nationals of 13 countries.
“In a context like Afghanistan,” the reseachers write, ” this finding points to the complex nature of the information security challenge where risks to individuals (or operational security) can occur as a result of a data compromise on secure systems operated by trusted partners.”
Aside from government networks, the attackers further targeted computers at the Institute for Defence Studies and Analyses in India, the India Strategic Defence Magazine and Force Magazine as well as the networks of companies based in India.
Last month, the Indian communications minister told reporters that government networks had been targeted by China, but that the attempted attacks had been unsuccessful. The Toronto researchers then contacted Indian intelligence officials to tell them about the spy network. The Indian Defense Ministry told the New York Times that it’s looking into the matter.
The attacks appear to come from a different source than the one behind the Ghost Net attack. The researchers say the Shadow Network appears to originate from a criminal gang based in Sichuan Province, while acknowledging that true attribution is generally difficult or impossible to surmise in hacking attacks.
Ghost Net used computer servers located on the island of Hainan. After the researchers exposed the Ghost Net last year, several of the command and control servers used in that attack went offline.
We snuck around behind the backs of the attackers and picked their pockets, Ronald J. Deibert, a political scientist and director of a cybersecurity research group at the Munk School, told the Times. Ive not seen anything remotely close to the depth and the sensitivity of the documents that weve recovered.
The researchers said the second spy ring was more sophisticated and difficult to detect than the Ghostnet operation, but like that other network, also pilfered e-mail from the Dalai Lama. The intruders obtained at least 1,500 letters sent from the Dalai Lamas office between January and November 2009.
The researchers traced some e-mails used in the attacks to hackers who appeared to be based in Chengdu, in Sichuan Province. Circumstantial evidence points to at least one of the alleged hackers being affiliated with the University of Electronic Science and Technology there.
Image:Diplomatic Security Special Agents escort the Dalai Lama from a speaking engagement at Rice University in Houston, TX, May 1, 2007. (Department of State)
See Also:
- Electronic Spy Network Focused on Dalai Lama and Embassy Computers …
