Classified documents compromised in 103 countries, researchers say
TORONTO - A cyber spy network based mainly in China has tapped into classified documents from government and private organizations in 103 countries, including the computers of Tibetan exiles, Canadian researchers said Saturday.
The work of the Information Warfare Monitor initially focused on allegations of Chinese cyber espionage against the Tibetan community in exile, and eventually led to a much wider network of compromised machines, the Internet-based research group said.
"We uncovered real-time evidence of malware that had penetrated Tibetan computer systems, extracting sensitive documents from the private office of the Dalai Lama," investigator Greg Walton said.
The research group said that while its analysis points to China as the main source of the network, it has not conclusively been able to detect the exact identity or motivation of the hackers.
The Chinese Embassy in Toronto did not immediately return calls for comment.
Students For a Free Tibet activist Bhutila Karpoche said she was not surprised about the possibility that China could be behind the network.
"Our computers have been hacked into numerous times over the past 4 to 5 years and especially in the past year," Karpoche said. She said she often gets e-mails that end up containing viruses that crash the group's computers.
The IWM is composed of researchers from Ottawa-based think tank SecDev Group and the University of Toronto's Munk Centre for International Studies. The group's initial findings lead to a 10-month investigation that has been summarized in the report, "Tracking GhostNet: Investigating a Cyber Espionage Network." It will be released online Sunday.
The researchers detected a cyber espionage network involving over 1,295 compromised computers from the ministries of foreign affairs of Iran, Bangladesh, Latvia, Indonesia, Philippines, Brunei, Barbados and Bhutan. They also discovered hacked systems in the embassies of India, South Korea, Indonesia, Romania, Cyprus, Malta, Thailand, Taiwan, Portugal, Germany and Pakistan.
Once the hackers infiltrated the systems, they gained control using malware — software they install on the compromised computers — and sent and received data from them, the researchers said.
Link: http://www.msnbc.msn.com/id/29935591/