excerpt from the book I'm writing on technology, terrorism, and
time at DHS, tentatively titled "Skating on Stilts." (If you want to
read the excerpts in a more coherent fashion, try the categories on the
right labeled "Excerpts from the book." I'm afraid I can't fix the bug
in TypePad that prevents me from putting them in the category in
reverse-chronological order, but I have started putting chapters up in
pdf form from time to time.) Comments and factual quibbles
are welcome, either in the comments section or by email:
firstname.lastname@example.org. If you're dying to order the book, send
mail to the same address. I'm still looking for an agent and a
publisher, so feel free to make recommendations on that score too.
The Office of His Holiness the Dalai Lama is partly a religious, partly a diplomatic mission. The Dalai Lama travels widely and seeks audiences with foreign diplomats and officials to demonstrate support for his faith and for Tibetan independence. The Chinese government in turn vehemently opposes an independent Tibet and does all it can to discourage official meetings with the Dalai Lama.
The Dalai Lama’s travel schedule is thus a matter of high state interest, and the planning of his meetings has an element of cat and mouse about it. The Dalai Lama’s office finds that the best way to set up those meetings is first to send an email to the officials the Dalai Lama hopes to meet and then follow up quickly with a telephone call.
But around the early part of 2008, something odd began to happen. The Dalai Lama’s office would send an email to a diplomat as usual proposing a meeting. Then it would call to discuss the details, again as usual. But the diplomat’s office would be strangely cool. “We’ve already heard from the Chinese government,” the diplomat’s staff would say, “and they’ve strongly discouraged us from having this meeting.”
The Dalai Lama and his office had been using the Internet since the 1990s. His network administrators know the risks, and they'd been careful about computer security for years. They’d implemented the standard defenses against network attacks. They didn’t know what had happened. But the evidence of a serious breach was simply too strong.
They called in a team of Western computer security experts. What the experts found was deeply troubling, and not just for the Dalai Lama.
Some of the Dalai Lama’s staff participates in Internet forums. They chat with other, like-minded individuals about the Dalai Lama’s goals and activities. Sometimes one of their online acquaintances sends them Word or .pdf documents relevant to those activities.
The experts concluded that hackers had monitored these forums and then forged an email from a forum participant to a member of the Dalai Lama’s staff attaching a document of mutual interest. When the staff member opened the document, he also activated a piece of malware packed with it. While the staff member was reading the document, the malware installed itself in the background.
The malware was cleverly designed; two-thirds of commercial antivirus software programs would have missed it. (Hackers often subscribe to antivirus software so they can test their malware against it at leisure.) Even if one attachment was stopped, it would be a simple matter to retransmit the message using a different bit of malware; the attackers could keep trying until something got through.
Once installed, the malware would “phone home,” uploading information about the victim’s computer and files to a control server operated by the hackers. Next, the captured computer would download more malware to install on the staff member’s machine. This was often a complete administrative program that would allow the attackers to control the staffer’s computer, and in some cases the entire network.
The administrative malware took full advantage of the empowerment made possible by today’s technology. It featured a graphic interface with dropdown menus offering even an unsophisticated attacker a wide variety of options.
Want to record every keystroke as the user types so you can steal all his passwords? Check one of the options on the menu.
Want to turn on the user’s microphone, turning it into a bug so you can listen to the office conversations? Check another box.
Want video straight from the user's desktop camera? That's just another option on the menu.
In the end, the Dalai Lama's office was living a version of Orwell's 1984. Telescreens in each room spied on the occupants. But in this version of 1984, Big Brother didn’t even have to pay for this spy equipment. It had been purchased and installed by the victims.
Once the hackers had compromised a single computer on the network, it wasn’t hard to compromise more. Every time an infected computer sent a document by email, malware could be attached to the file. The recipient couldn’t possibly be suspicious; the email and attachment were exactly what he expected to receive from his colleague. He opened the document. The malware installed itself in the background. The cycle began again. It was an entire network of surveillance, dubbed Ghostnet by the security team.
Ghostnet has lessons for all of us. You may be sure you wouldn’t fall for the Spanish lottery, and perhaps not even for a Facebook call for help, but it’s hard to find any comfort in this story.
Do you rely on standard commercial antivirus software to scan attachments? Do you open documents sent by people you’ve met on line? How about documents from prospective customers or clients? Or old friends you recently connected with on line? Do you open mail and documents sent to you by coworkers?
Of course you do. So do I. And that means that most of us are no more able to defend ourselves from this attack than the Dalai Lama was.
If there were any doubt about the scope of such attacks, they were eliminated by what the security team did next.
They took another look at the IP address of the hacker’s control server, and asked a simple question.
“Do you think hackers who need a graphic interface to steal secrets are really good at locking down their own computers?” I imagine the Canadian team sharing a mischievous smile as they asked.
Perhaps a veil should be drawn over exactly what they did next. Hacking is illegal in most jurisdictions, even if you're hacking someone who has just hacked you. Using methods they decline to specify, the security team was able to verify that whoever attacked the Dalai Lama’s network was indeed much better at breaking into other people’s computers than at keeping intruders out of their own.
Finding themselves inside the hackers’ control servers, the security team naturally had a look around. They watched as reports came in from the Dalai Lama’s computers. But that’s not all. Reports were coming in from other computers as well. Hundreds of them.
The hackers who compromised the Dalai Lama’s network were collecting data from nearly 1300 other computers. Who else had been targeted by the attackers? That wasn’t hard to find out. All the security team had to do was to ask who owned the IP addresses of the compromised computers.
What they found was a Who’s Who of Asian organizations that ought to be highly concerned about -- and pretty good at -- computer security. Indian embassies in the United States, Germany, and the United Kingdom. The foreign ministries of Iran, Indonesia, and the Philippines. The Prime Minister’s office in Laos. All were in thrall to the attackers’ servers. Computers in sensitive businesses, from the Asia Development Bank to Vietnam’s petroleum company, were also sending the attackers their data.
And, even though this set of attacks does not seem to have been aimed at the United States, Ghostnet was collecting reports from computers that belonged to Associated Press and the auditing firm of Deloitte & Touche. Oh, and NATO too.
No one was safe.
The security team split on the question whether to assign responsibility for Ghostnet to China. Some said it must be the Chinese government. Others were willing to let the facts speak for themselves. The Chinese government denies everything.
But there’s not much comfort for us in the denials. The attacks happened, and they worked. If a government wasn’t responsible, then this kind of capability is already in the hands of organized crime. Indeed, with its script-spy graphic interface and unsecured control servers, the whole episode underlines a troubling fact. Thanks to exponential empowerment, today’s hackers don’t even have to be very good. Empowered by democratizing technology, they can still beat our best defenses.
In fact, something similar to Ghostnet is already being used by organized crime. Most businesses depend on bank clearinghouse accounts or electronic fund transfers to pay their bills. They log on to bank sites using passwords; for larger amounts they may also be asked a set of “challenge questions” seeking information only the businesses know. But corporate officials also open email attachments from business contacts, and once attackers have access to the officials' keystrokes, neither the password nor the challenge questions offer any security. Hackers have stolen more than $100 million from US businesses using this technique, the FBI reported in October 2009.
I wasn’t in government in 1998 or 2003, when the Clinton and Bush administrations called for new computer security measures. I didn’t get the classified briefings that galvanized both presidents. Now I figure I don’t have to.
This is scary enough.