Introduction to Cyber-Warfare - Proiect SEMPER FIDELIS

142 7. WHY CYBER ESPIONAGE IS A KEY COMPONENT OF CHINESE STRATEGYLeveraging Legitimate Web Sites for Data ExfiltrationThe investigators assess that, as with Gh0stNet, the hackers behind the Shadow Networkrelied on spear phishing in order to gain access to targeted systems. They observed that thehackers used files such as Adobe Acrobat (PDF), Microsoft PowerPoint (PPT), and MicrosoftWord (DOC) that contained Trojans that exploited one of several vulnerabilities. Althoughthe vulnerabilities used by PPT and DOC files were older and hence better known, thePDF files used weaknesses that had been addressed by Adobe only several weeks prior tothe infection. Hence, though a counter measure was available, it clearly was not in placein the Tibetan information systems due to its (then) very recent development.When the researchers examined the actual malware installed by the Trojans, they noticed asignificant departure from what they found in Gh0stNet. In several of the infected systems,the investigators found that the Shadow Network hackers were not relying on a simplecommand-and-control server or even a proxy thereto, but were rather using popular Web sitessuch as Yahoo! Mail and Twitter to add a layer of communication to the target system. For instance,several computers were found to connect to Yahoo! Mail. The hackers interfaced directlywith a Yahoo!’s e-mail inbox using the associated application program interface (API)—the set ofsoftware libraries intended for the development of legitimate applications to access Yahoo!Mail. Using this communication with Yahoo! Mail, the infected computer periodically used aparticular e-mail account to send and receive messages. In a scheme of direct communication,the hackers would send e-mails to the target machine, which contained executable code (computercode that is capable of actually running a piece of software) directing the computer to dofurther actions. These actions functioned similarly to the capabilities provided to the Gh0stNethackers in the administrative interface of their command-and-control (C&C) servers. The investigatorsanalyzed this executable code and found that it directs the target to download anotherpiece of malware from a Web site publically hosted on a Google server. This malware, in turn,connected to another C&C server in order to download several files disguised as digital images,which allowed it to connect to the Tor anonymity network. 68 This network is used by individualsdesiring anonymity such as journalists, law enforcement, and human rights activists. Tor is ananonymity system that uses a special protocol known as Onion Routing to hide the origin ofthe sender. A message sent on the Tor network relies on a series of servers to route the messageto its destination. A given message travels from an “entrance node” to an “exit node.” Thesender’slocationisonlyknownto the“entrancenode” and thedataareencrypteduntiltheyreachthe “exit node” (full details of this protocol can be found in Goldschlag et al. 69 ). Although the exitnode has no memory of the original sender, it passes on the original, unencrypted message. Theresearchers from Information Warfare Monitor referred to a study by Dan Egerstad 70 where heexamined network traffic leaving an exit node in the Tor network. He identified information,apparently from embassies belonging to countries such as Australia, Japan, Iran, and India.Based on his conversations with some embassy personnel, Egerstad suspected that someonehacked the accounts of the embassy personnel, sent data through Tor, and then eavesdroppedon the exit nodes. In this way, he could capture the data in a stealthy manner, as the locationof the eavesdropper would not be in the Tor network path. It is possible that members of theShadow Network were using Tor in a similar manner to exfiltrate data from their targets.Yahoo! Mail was not the only legitimate Web site being misused by members of theShadow Network for data exfiltration. The Information Warfare Monitor investigators found