Introduction to Cyber-Warfare - Proiect SEMPER FIDELIS

MONITORING DISSIDENTS: GH0STNET135an attempt to manipulate individuals to perform a certain action (i.e., activate a Trojan) ordivulge information (i.e., disclose a password), it is considered a form of social engineering.In the case of the cyber espionage operations performed against the organizations affiliatedwith the Dalai Lama, the cyber operators used what is often referred to as spear phishing—extensive use of social engineering to craft an e-mail that has specific, personal informationto entice a user to somehow activate a Trojan. As the attackers gained access to certain systems,they can start to understand relationships among employees based on things such asintra-office memorandums, e-mails, and other forms of communications. With this understanding,and access to certain computer systems, highly advanced spear phishing e-mailscan be created. For instance, let us suppose the hacker obtains access to the computer ofUser A. In reviewing the user’s e-mails, he finds that User A often works with User B. Thehacker can then leverage his access to User A’s computer to send an e-mail with an infecteddocument to User B—perhaps asking User B to review the document. User B receives thisseemingly normal message from his colleague and proceeds to activate the Trojan.In the case of the intrusion into the Tibetan exiles’ systems, the cyber spies initially used e-mails designed to interest a large number of the Tibetans in opening a malicious document.One such e-mail was sent from campaigns@freetibet.org and attached a Microsoft Word documententitled “Translation of Freedom Movement ID Book for Tibetans in Exile.doc.” 37Hence, by designing a legitimate-looking message, users were enticed to open the MicrosoftWord file—which contained the Trojan. Later, e-mails were more highly targeted, using informationharvested from those activating the initial Trojans.One can also consider the spear phishing targeting the Buddhist organizations’ computers inthe context of the “security countermeasures” dimension of cyber security as discussed in theintroduction of this book. Of the three components of security countermeasures—technology,policy/practices, and people, social engineering primarily relies on people being the weak link.Users in an organization not properly educated in the threat posed by malware-containing sociallyengineered e-mails are more likely to open such messages and their associated attachments.Hence, in any organization, education and training of the user population is a keyfactor in mitigating the effects of an adversary’s cyber espionage campaign.However, there is another aspect of security counter measures to be considered: technology.What tools do the system administrators have in place to detect and quarantine maliciousdocuments? In addition to identifying such measures in the reconnaissance phase ofthe operation cycle, hackers also typically make an effort to use lesser known system vulnerabilities.The analysts at Information Warfare Monitor examined malicious files found on theTibetan organizations’ computers and found that of the 34 leading antivirus software packagesin use at the time, only 11 were able to properly identify the files as containing Trojans. 38Using lesser known vulnerabilities, or even discovering new vulnerabilities, are reliablemethods for hackers to obtain access to systems and circumvent technological security countermeasuresuch as antivirus software.Harvesting Data from the Compromised SystemsAt least eight different families of Trojans were identified on the Tibetans expatriates’ systems.Upon establishing connection with a command server, the malware allowed practically