Introduction to Cyber-Warfare - Proiect SEMPER FIDELIS

136 7. WHY CYBER ESPIONAGE IS A KEY COMPONENT OF CHINESE STRATEGYtotal access to the target systems. One of the first tasks performed by the malware installed bythe Trojan is to communicate with a C&C server—much the same way as the botnets describedearlier in this book do. About 70% of C&C servers identified by Information WarfareMonitor were in the PRC. Other locations of C&C servers included the U.S., Sweden, SouthKorea, and Taiwan. Further, the connections made to these C&C servers were employingHTTP—the standard protocol used for Web servers. By using this standard protocol, the networktraffic to and from these servers appears less obvious—hence avoiding detection by intrusiondetection systems (IDSs—see the previous section of this chapter for a brief discussionon these systems).It turned out that several of the C&C servers identified by the Information Warfare Monitorresearchers were still active during the time of the investigation. Based on the apparent configurationof these servers, members of this research team were able to deduce their file structureof the C&C server. Based on this logic, they were able to locate the software that allowedfor remote administration of the machine and then obtained access to the administration interfacefor these servers. The administration interface is a software tool that allows the hackersto direct the actions of the compromised systems using easy-to-use Web-based screens. Itturned out that the hypothesis of the researchers was correct. More bizarrely, they found administrationinterfaces on four of the C&C servers that were not secured. This allowed them toactually direct the actions of many of the compromised computers. 39The administrative interface of the C&C servers had three screens. These included a listingof infected machines in communication with the server, a tool to send commands to theinfected computers, and a screen displaying the results of recently sent commands. The toolto send commands to the targets included several options. These commands included the acquisitionof system information (such as listing of documents on the target machine), sendingadditional malware to the target (to add functionality), and a feature to make the malware onthe target dormant. The ability to send additional malware to the target allows the hacker toperform such tasks as file management on the target, screen capture, key logging (which recordsall keystrokes taken on the target machine), audio capture (through the target’s microphone),and webcam view. To disguise the traffic of the additional malware, the executablecode is sent disguised as a digital image file.One of the additional pieces of malware that can be uploaded to a target machine from theC&C server is a Chinese piece of software known as gh0st RAT (Remote Access Tool). f Thisprovides many of the functionality (key logging, file management, etc.) described above bygiving the hacker access to the target system in real time. We note that gh0st RAT can be configuredto connect to a third-party command-and-control server (possibly different from theones already described). Such use of an additional master server could be to obfuscate thelines of communication to the target or could resemble a division of labor (i.e., the breachand exploitation teams described in the Operation X case study earlier in the chapter).The investigators at Information Warfare Monitor wanted more to fully understand thenature of the interaction between the version of gh0st RAT installed on the Buddhists’ systemsand their C&C servers. To do so, they set up what is known as a honey pot. A honeypot is a computer designed to appear vulnerable in order to lure hackers. Once the hackersf Sometimes also referred to as “Remote Administration Tool.”