The worlds biggest spy network has been uncovered - all roads lead back to the Chinese, though its not certain for yet. Ghostnet may be the biggest operation of its kind uncovered so far.

 The scale is such that it is suspected that up to 103 countries may have had confidential documents stolen. Countries include Iran, Bangladesh, Latvia, Indonesia, Philippines, Brunei, Barbados and Bhutan. They also discovered hacked systems in the embassies of India, South Korea, Indonesia, Romania, Cyprus, Malta, Thailand, Taiwan, Portugal, Germany and Pakistan.

Investigators from the  Information Warfare Monitor (IWM) initally investigated reports of spying against the Tibetan community and its exiled leader. But soon the investigation widened. Compromised computers were even found at the offices of Deloitte and Touche in New York.

According to the IWM report:

"GhostNet represents a network of compromised computers resident in high-value political, economic, and media locations spread across numerous countries worldwide. At the time of writing, these organisations are almost certainly oblivious to the compromised situation in which they find themselves. The computers of diplomats, military attachés, private assistants, secretaries to Prime Ministers, journalists and others are under the concealed control of unknown assailant(s)."

 

"The GhostNet system directs infected computers to download a Trojan known as Ghost Rat that allows attackers to gain complete, real-time control. These instances of Ghost Rat are consistently controlled from commercial internet access accounts located on the island of Hainan, in the People’s Republic of China."

 

 

A key to Ghostnet gaining access to and control of computers again lay in lax security and tried and trusted techniques.

"Contextually relevant emails are sent to specific targets with attached documents that are packed with exploit code and Trojan horse programmes designed to take advantage of vulnerabilities in software installed on the target’s computer."

In other words, someone opened emails they shouldn't have!

More worryingly, the IWM report suggests that this system may not be the only type of its kind - that there may be multiple systems running around the world -though all may not be the work of the Chinese.

The full report can be downloaded from our file section: http://snuffles.org/file-manager/doc_download/4-ghostnet-report-from-iwm.html

Link to Information Warfare Monitor: http://www.infowar-monitor.net/