Chinese based botnet discovered, larger than previously thought

About a year ago, a group of security researchers in Toronto affiliated with the Munk Centre for International Studies uncovered the existence of an international botnet called Ghostnet, and discovered that it may be a Chinese espionage tool used against Tibetan citizens. It was one of the largest botnet networks at the time, and the Chinese government has repeatedly denied accusations that they were behind the espionage, despite the sociopolitical nature of the targets. 

Now, a year later, the same group of researchers have discovered a previously unknown branch of the Ghostnet Network that primarily targets India. After extensive research and monitoring, they have determined that the GhostNet network is more sophisticated and robust than previously assumed. 

Called GhostNet 2.0 by some, the control servers sending commands to infected PCs all over the world were using cloud-based social networking services like Twitter, Facebook, and Google to communicate with the botnet, raising concerns that the open nature of the cloud will lead to dangerous opportunities for botnet herders around the globe to more easily conceal their actions. 

According to Ars Technica, The accusations against China for backing the botnet remain inconclusive. The report points to the location of the likely origin of the attacks, Chengdu Province, and explains that it's a site of an Army technical reconnaissance bureau. However, the location is also close a known organized crime community in Chongquing, another possible explanation. The Chinese government has been known to hire independent contractors to do their cyber-work, so the culprit could very well be a mix of the two theories.  

Regardless of who is behind GhostNet, there is no denying that it's a huge leap forward in the sophistication of the botnet industry. As more and more services head toward the cloud, and as more and more services adopt more open models, the botnet herders will no doubt jump on the opportunity to copy GhostNet, and use the open infrastructures to their advantage. 

 

Report a problem with article
Previous Story

Apple iPad to launch internationally on April 24?

Next Story

Impulse Top 10 for Week of April 3rd

31 Comments

Commenting is disabled on this article.

christopherCN said,
so basically, can anyone tell me how would it affect me, what does it do too?

my sentiment exactly. plus, the only intelligent comment i've seen so far. the rest are probably auto-generated by the US-based Idiotnet ... Hm. Guess we are doomed, then.

Edited by Albert, Apr 7 2010, 4:53pm :

christopherCN said,
so basically, can anyone tell me how would it affect me, what does it do too?

It affects you if you care at all about any of the following:
- Internet Security
- Chinese Politics
- World Politics
- Internet Politics
- Tibet
- Google
- Apparently India
- Facebook & Twitter

This kind of revelation will undoubtedly affect any/all of the above items.
Saying "how does this affect me?" is by far one of the most unintelligent things you can do.
Finding a massive, sophisticated, potentially government-run botnet is a massive revelation that will affect us all... if not now, then in the near future, as the things in the itemized list above will react to the news.

So, in summary, you are both idiots.

christopherCN said,
so basically, can anyone tell me how would it affect me, what does it do too?

The public was quite complacent about world affairs in the first half of the twentieth century. Didn't work out too well.

christopherCN said,
so basically, can anyone tell me how would it affect me, what does it do too?

The public was quite complacent about world affairs in the first half of the twentieth century. Didn't work too well.

cyberdrone2000 said,

It affects you if you care at all about any of the following:
- Internet Security
- Chinese Politics
- World Politics
- Internet Politics
- Tibet
- Google
- Apparently India
- Facebook & Twitter

This kind of revelation will undoubtedly affect any/all of the above items.
Saying "how does this affect me?" is by far one of the most unintelligent things you can do.
Finding a massive, sophisticated, potentially government-run botnet is a massive revelation that will affect us all... if not now, then in the near future, as the things in the itemized list above will react to the news.

So, in summary, you are both idiots.

so in other words, it's all conspiratorial & speculative without concrete evidence or proofs, originated from person or groups with their own hidden agendas.

hm. you know, i am glad i'm an idiot rather than a paranoid.

Edited by Albert, Apr 9 2010, 5:03am :

s3n4te said,
Anyone see the amazing asian women ad right next to the story? lol

I got a Forefront security ad. I guess it's based on your browsing history?

the big difference is that it uses social networking tools to help communicate with the infected machines. Typically, this is done using their own software, which is easier to track. If you use an obscure Google group, you're covering your tracks better, and possibly making communication and control easier in general.

As the name implies, a botnet is a robotic social network. This is where robots meet and catch up through the internet. Ghostnet is a botnet for robot ghosts. This is the most popular botnet in China, as China has the highest proportion of robot ghosts.

As the article says, Ghostnet is mixing with human sites such as Facebook. This is bad as humans and robots have different beliefs about the world, such as the robot belief that all humans should have the flesh burnt from their bones. This causes many flame wars on Facebook, which is really annoying.

Edited by AfroTrance, Apr 7 2010, 3:19pm :

AfroTrance said,
As the name implies, a botnet is a robotic social network. This is where robots meet and catch up through the internet. Ghostnet is a botnet for robot ghosts. This is the most popular botnet in China, as China has the highest proportion of robot ghosts.

As the article says, Ghostnet is mixing with human sites such as Facebook. This is bad as humans and robots have different beliefs about the world, such as the robot belief that all humans should have the flesh burnt from their bones. This causes many flame wars on Facebook, which is really annoying.

/sigh & rub face

AfroTrance said,
As the name implies, a botnet is a robotic social network. This is where robots meet and catch up through the internet. Ghostnet is a botnet for robot ghosts. This is the most popular botnet in China, as China has the highest proportion of robot ghosts.

As the article says, Ghostnet is mixing with human sites such as Facebook. This is bad as humans and robots have different beliefs about the world, such as the robot belief that all humans should have the flesh burnt from their bones. This causes many flame wars on Facebook, which is really annoying.


AHAHAHA. That made my day! Best. Explanation. Ever.

In all seriousness though, a botnet is simply a network of trojan-infected PCs that can be used to perform tasks en-masse, such as sending spam e-mails, accessing a website repeatedly to make it inaccessible to anyone else (called a DDOS attack) and other nefarious things.

The article is saying that sites like facebook and twitter are being used to control the Chinese botnet, making it harder to determine where and who the people controlling it are.

AfroTrance said,
As the name implies, a botnet is a robotic social network. This is where robots meet and catch up through the internet. Ghostnet is a botnet for robot ghosts. This is the most popular botnet in China, as China has the highest proportion of robot ghosts.

As the article says, Ghostnet is mixing with human sites such as Facebook. This is bad as humans and robots have different beliefs about the world, such as the robot belief that all humans should have the flesh burnt from their bones. This causes many flame wars on Facebook, which is really annoying.

Re-imaging of the Second Reniscence (Animatrix)?

Shishant said,
Sad Chinese people cant play fair.

So true. It's no longer like the good old days when the CIA and the KGB played by the rules.

Pixil Eyes said,
So this is how the Borg race started. Oh my.

Yes, and the Chinese can start and finish something in "five . . . ten minute."

grewnd33 said,

Yes, and the Chinese can start and finish something in "five . . . ten minute."

Hahaha. Although, for me it's always "10 ... 15 minute."