Introduction to Cyber-Warfare - Proiect SEMPER FIDELIS

116 7. WHY CYBER ESPIONAGE IS A KEY COMPONENT OF CHINESE STRATEGYrelied on the use of botnets. However, locating the command and control (C&C) servers ofthese botnets—typically located in mainland China—was relatively easy for investigators.The successor to “Gh0stNet” became known as the “Shadow Network” and leveraged an innovativeC&C structure that included the use of social media sites and obfuscated serversmaking it more difficult to pinpoint. Finally, in late 2009, “Operation Aurora,” which involvedthe mass exfiltration of sensitive intellectual properties from major corporations, mostnotably Google, illustrates a high degree of sophistication, because it entailed multiple techniquesincluding previously unheard of vulnerabilities b in Web browsers.The chapter is organized as follows: first, we present a brief description of the writings ofChinese military thinkers on cyber espionage. After laying out the conceptual base of Chinesethinking on cyber war, we will attempt to identify some of the prominent Chinese cyber warriors.This is followed by a discussion of “Titan Rain” and a case study of an early cyberexfiltration incident described by Northrop Grumman in a presentation to the U.S.-ChinaEconomic Security Review Commission. Though Northrop Grumman does not disclose certaindetails of the attack (i.e., the company which was attacked or the exact date in which itoccurred), it does provide good insight into some of the earlier Chinese cyber espionage operations.We then go on to discuss “Gh0stNet” and the “Shadow Network.” This is followedby an example for intellectual property theft during “Operation Aurora.” The chapter closeswith a description of the more recent Chinese-attributed espionage operation using the“Sykipot” malware where cutting-edge techniques are used to steal information on the nextgeneration of U.S. unmanned aerial vehicles (UAVs).WHY CYBER ESPIONAGE IS IMPORTANT TO CHINA:A LOOK AT CHINESE CYBER DOCTRINETwo Examples on Chinese Strategic ThoughtPerhaps, the most striking aspect of Chinese cyber doctrine is how it seems radically differentfrom Western thought. This section outlines two examples on how Chinese and Westernthought on strategy contrast. These examples were originally presented by COL EdwardSobiesk, head of the Information Technology Program at West Point, in a 2003 SANS Institutepaper. 2In the first example, we compare two classic board games—the Western game of chess andthe game of Go, which originated in China more than 2500 years ago. 3 Over the course of achess game, the players conduct a war of attrition by capturing the opponent’s pieces with theultimate goal of capturing or cornering the opponent’s king. In Go, on the other hand, eachplayer starts at an empty board and, at each turn, attempts to conquer parts of the game spacewith colored stones. Note that in chess the destruction of a player’s opponent is required towin. Conversely, in Go, a player’s opponent is more of an obstacle to victory. In many ways,the writings of Chinese military thinkers highlight these two ideas. With regard to the firstidea, it may be preferable to focus on conquering parts of the cyber-playing field, rather thandirectly confronting the enemy. With respect to the second, it may be preferable to find waysb Such vulnerabilities are known as “zero-day” exploits.