ndtvTurning the tables on a China-based computer espionage gang, Canadian and United States computer security researchers have monitored a spying operation for the past eight months, observing while the intruders pilfered classified and restricted documents from the highest levels of the Indian Defence Ministry.
In a report issued Monday night, the researchers, based at the Munk School of Global Affairs at the University of Toronto, provide a detailed account of how a spy operation it called the Shadow Network systematically hacked into personal computers in government offices on several continents.
The Toronto spy hunters not only learned what kinds of material had been stolen, but were able to see some of the actual documents, including classified assessments about security in several Indian states, and confidential embassy documents about India's relationships in West Africa, Russia and the Middle East. The intruders breached the systems of independent analysts, taking reports on several Indian missile systems. They also obtained a year's worth of the Dalai Lama's personal e-mail messages.
The intruders even stole documents related to the travel of NATO forces in Afghanistan, illustrating that even though the Indian government was the primary target of the attacks, one chink in computer security can leave many nations exposed.
"It's not only that you're only secure as the weakest link in your network," said Rafal Rohozinski, a member of the Toronto team. "But in an interconnected world, you're only as secure as the weakest link in the global chain of information."
As recently as early March, the Indian communications minister, Sachin Pilot, told reporters that government networks had been attacked by China, but that "not one attempt has been successful." But on March 24, the Toronto researchers said, they contacted intelligence officials in India and told them of the spy ring they had been tracking. They requested and were given instructions on how to dispose of the classified and restricted documents.
On Monday, Sitanshu Kar, a spokesman for the Indian Defence Ministry, said officials were "looking into" the report but had no official statement.
The attacks look like the work of a criminal gang based in Sichuan province, but like all cyberattacks, it is easy to mask the true origin, the researchers said. Given the sophistication of the intruders and the targets of the operation, the researchers said, it is reasonable to suspect that the Chinese government approved of the spying.
When asked about the new report on Monday, a propaganda official in Sichuan's capital, Chengdu, said "it's ridiculous" to suggest the Chinese government might have played a role. "The Chinese government considers hacking a cancer to the whole society," said the official, Ye Lao. Tensions have risen between China and the United States this year after a statement by Google in January that the company and dozens of other businesses had been the victims of computer intrusions coming from China.
The spy operation appears to be different both from the Internet intruders identified by Google and from a surveillance ring known as Ghostnet, also believed to be operating from China, which the Canadian researchers identified in March of last year. Ghostnet used computer servers largely based on the island of Hainan to steal documents from the Dalai Lama, the exiled leader of Tibet, and government and corporations in more than 103 countries.
The Ghostnet investigation led the investigators to this second Internet spy operation, which is the subject of their new report, titled "Shadows in the Cloud: An investigation into cyber-espionage 2.0." The new report shows the India-focused spy ring made extensive use of social networks like Twitter, Google Groups, Blogspot, blog.com, Baidu Blogs and Yahoo Mail, to automate the control of computers once they had been infected.
The Canadian researchers cooperated in their investigation with a volunteer U.S. group of security experts at the Shadowserver Foundation, which focuses on Internet criminal activity.
"This would definitely rank in the sophisticated range," said Steven Adair, a security research with the group. "While we don't know exactly who's behind it, we know they selected their targets with great care."
By gaining access to the control servers used by the second cybergang, the researchers observed the theft of a wide range of material, including classified documents from the Indian government and sensitive reports taken from Indian military analysts and corporations, as well as documents from agencies of the United Nations and other governments.
The researchers said the second spy ring was more sophisticated and difficult to detect than the Ghostnet operation.
By examining a series of e-mail addresses, the investigators traced the attacks to hackers who appeared to be based in Chengdu, which is home to a large population from neighboring Tibet. Researchers believe one hacker used the code name "lost33" and that he may have been affiliated with the city's prestigious University of Electronic Science and Technology. The university publishes books on computer hacking and offers courses in "network attack and defence technology" and "information conflict technology,'' according to its Web site.
The People's Liberation Army also operates a technical reconnaissance bureau in the city and helps fund the university's research on computer network defence. A spokesman for the university could not be reached Monday because of a national holiday.The investigators linked the account of another hacker to a Chengdu resident whose name appeared to be Mr. Li. Reached by telephone on Monday, Li denied taking part in computer hacking. Li, who declined to give his full name, said he must be confused with someone else. He said he knew little about computer hacking. "That is not me," he said. "I'm a wine seller."
The Canadian researchers stressed that while the new spy ring focused primarily on India there were clear international ramifications.
Rohozinski noted that civilian personnel working for NATO and the reconstruction mission in Afghanistan usually travel through India and that Indian government visa issuing computers were compromised in both Kandahar and Kabul in Afghanistan.
"That is an operations security issue for both NATO and the International Security Assistance Force," said Rohozinski, who is also chief executive of the SecDev group, a Canadian computer security consulting and research firm.
The report notes that documents the researchers recovered were found with "Secret," "Restricted," and "Confidential" notices. "These documents," the report says, "contain sensitive information taken from a member of the (Indian) National Security Council Secretariat concerning secret assessments of India's security situation in the states of Assam, Manipur, Nagaland and Tripura, as well as concerning the Naxalites and Maoists," two opposition groups.
Other documents contained personal information about a member of the Indian Directorate General of Military Information.
The government's Food Security Bill will be redrafted after three weeks and will include fresh suggestions from the Planning Commission and the Food Ministry.
At a meeting of the empowered panel on food security it was decided that the:
The Planning Commission will come back to the panel with the exact number of poor people in India who will benefit from the Act
The Food Ministry has also been told to study how 22 other countries enacted food-for-all laws
The panel met after Sonia made it clear she wants food allocation to be raised from 25 kg to 35 kg per family
Sonia wants Bill to ensure nutritious diet and not just wheat, rice for the poor
Government worried: Food subsidy bill will rise from Rs 55,578 crore to Rs 85,000 crore
Government worried: Revising BPL coverage means added burden of 40%
Speaking on this, Agriculture Minister Sharad Pawar said: Discussions on the BPL list are on. It was decided at the meeting that we will meet after three weeks by which the Planning Commission and the Food Ministry will submit the report to the group of ministers."
Speaking NDTV, the Supreme Court Commissioner on Food Security said that providing 35 kg of foodgrain to the poor was the top court's order not a recommendation and the government cannot change it.
"The government must be proactive in finding out who are the peopel who are not getting 35 kilos of foodgrains. The record of government in this connection is very poor," said NC Saxena, Supreme Court Commissioner on Food Security.
And reflecting the divergence of view between the Congress and the government, Rajya Sabha member Mani Shankar Aiyar said the government has failed to understand that inclusive growth needs inclusive governance.
"A community has to be empowered to secure its own entitlements. That is the whole purpose of bringing in Panchyati Raj and bringing in the Nagar Palikas.Inclusive growth is not possible without inclusive governance," said Mani Shankar Aiyar, Rajya Sabha MP
(malathi)