Introduction to Cyber-Warfare - Proiect SEMPER FIDELIS

144 7. WHY CYBER ESPIONAGE IS A KEY COMPONENT OF CHINESE STRATEGYThe compromised machines then connect to the server belonging to the security professional.The IP addresses of the compromised machines can then be identified in order to determinethe extent of the spread of a given piece of malware. g The idea is similar to that of a “HoneyPot.” A “Honey Pot” is a system set up by security professionals with the goal of enticing individualsto compromise it—hence, allowing the security pros to study the behavior of thehackers. A DNS Sinkhole is similar in that it is set up by security professionals to studythe behavior of malicious software. However, it differs in that it is designed to capture trafficof compromised systems rather than lure attackers.The investigators used this technique based on abandoned C&C servers to which the computersin the Office of His Holiness the Dalai Lama were attempting to connect. They foundthat a great many of systems were compromised—many completely unrelated to the Tibetanorganizations whose infected computers initiated the analysis. Affected computers were locatedin academic institutions such as New York University, the University of Western Ontario,and Kaunas University of Technology (Lithuania); or pertained to media outlets such asthe Times of India. Science and technology organizations such as the Commission for Scienceand Technology for Sustainable Development in Pakistan and the National Informatics Centerin India as well as various Indian institutions, including the Chambers of Commerce andIndustry and the New Delhi Railway station, had also been infected.In addition to DNS Sinkholing, the investigators were able to recover stolen data from oneof the C&C servers that was not properly secured. In addition to the documents capturedfrom the Office of the Dalai Lama, the researchers found data relating to government diplomaticmissions, national security, defense, academia, and the media. India was the predominanttarget of these exfiltrations. Several documents taken from Indian diplomatic computerswere marked with “SECRET” (two documents), “RESTRICTED” (six documents), or “CON-FIDENTIAL” (five documents) markings. 71 Many of these classified documents dealt withsecurity assessments of certain Indian provinces as well as embassy information on India’srelationship with Russia, West African nations, and the Middle East. Unlike the documentstaken from diplomatic organizations, the data exfiltrated from defense systems appeared tobe unclassified. However, it appears that the information taken was not generally known tothe public. Documents were recovered relating to the Russian Pechora Missile System, 72 theIsraeli Iron Dome air defense system, and an Indian artillery system known as ProjectShakti. 73 The hackers also stole documents on several academics and journalists—focusingon those associated with writings either on the containment of the Peoples’ Republic of China,Chinese military exports, the Chinese-Indian relationship, or armed groups within the PRC.Much of the stolen data may seem to answer Chinese IRs, but there were other clues thatpointed the researchers to suggest the involvement of the Chinese government.Clues of Chinese Involvement in the Shadow NetworkThe investigators from Information Warfare Monitor captured several evidences that linkedthe operators toChengdu, Sichuan. First,the IP addressesfrom whichthe e-mails were sent to thecompromised machines via Yahoo! Mail (as described earlier) were traced back to Chengdu.g For more on DNS Sinkholing, we suggest the SANS Institute paper “DNS Sinkhole” by Guy Bruneauavailable at http://www.sans.org/reading_room/whitepapers/dns/dns-sinkhole_33523.