Beijing Olympics 2008: Winning Press Freedom - World Press ...

Beijing Olympics 2008: Winning Press Freedom
56
technology behind these attacks on our organizations. In the second I part I try to address
the question that journalists most often ask, that is, “Who is responsible?”
I have subdivided the technology section to include comments on: the message that
carries the exploit, the exploit itself, the back door, the control connection, and the control
server. Similarly, I have subdivided the second section to consider whether the attackers
have government affiliation, the state’s cost-benefit analysis in allowing hackers to operate
within its borders, the political context, and evidence of recruitment from China’s
computer underground.
First, the message designed to carry the payload. The content is to persuade the user to
click on it, so the malicious code can execute. The writing style of the message content
imitates the spoofed sender. The content of the document is appropriate to the topic of
the e-mail message. In some cases, users are convinced to return a message back to the
attacker or forward to other users. We have seen memes 1 redistributed to the targeted
communities. For example, a Word document was collected from a compromised mailing
list, edited to include an exploit, and forwarded to other members of the targeted
community.
Here is a sample of a message that transports a targeted attack:
Date: Tue, 1 Apr 2008 02:22:57 -0700 (PDT)
From: Beijing Conference
Subject: Invitation to conference "Beijing Olympics 2008: Winning Press Freedom"
To: ……….
Dear Sir/Madam
We are cordially inviting you to the conference "Beijing Olympics 2008: Winning Press Freedom" which
will be held from the 18th - 19th of April, 2008 in Maison de la Chimie Paris.
[…]
The schedule of the conference is in the attachment.
Email ……..@wan.asso.fr OR
………@wan.asso.fr
By TEL: +33 (0)1 47 42 85 37
By FAX +33 (0)1 47 42 49 48
This message was sent to potential participants of this conference. The English is good,
the message is factually correct, the organization’s footers are correct. The recipient is
encouraged to download a pdf attachment. The attachment exploits a client-side
vulnerability. The most common attack vectors so far have been, CHM help files, Adobe
Acrobat Reader, PDF, Microsoft Word, Powerpoint, Excel, and Access. The file then
exploits the vulnerability, and executes shell code which usually unpacks two components:
the actual Trojan, and a non-malicious file which, rather than crashing the system, opens
a non-malicious file.