Ajay Kumar: Created a new article

2023-09-25T18:46:26Z

Created a new article

New page

{{short description|China-based computer espionage operation}}
The''' Shadow Network''' is a [[Chinese intelligence activity abroad|China-based computer espionage operation]] that stole classified documents and emails from the [[Indian government]], the office of the [[Dalai Lama]], and other high-level government networks.<ref name=":0">{{Cite web|url = http://www.huffingtonpost.com/2010/04/06/shadow-network-hacker-ope_n_526625.html|title = 'Shadow Network' Of Chinese Hackers Steal Dalai Lama's Emails: REPORT|date = 6 April 2010|access-date = 1 Nov 2014|website = The Huffington Post|last = Anna|first = Cara}}</ref><ref name=":1">{{Cite web|url = https://www.theguardian.com/technology/2010/apr/06/cyber-spies-china-target-india|title = Cyber-spies based in China target Indian government and Dalai Lama|date = 6 April 2010|access-date = 1 Nov 2010|website = The Guardian|last = Branigan|first = Tania}}</ref> This incident is the second [[cyber espionage]] operation of this sort by China, discovered by researchers at the [[Information Warfare Monitor]], following the discovery of [[GhostNet]] in March 2009.<ref name=":2">{{Cite magazine|url = https://www.wired.com/2010/04/shadow-network/|title = Spy Network Pilfered Classified Docs From Indian Government and Others|date = 6 April 2010|access-date = 1 Nov 2014|magazine = Wired|last = Zetter|first = Kim}}</ref><ref name=":3">{{Cite web|url = http://news.bbc.co.uk/2/hi/technology/8605548.stm|title = Shadow cyber spy network revealed|date = 6 April 2010|access-date = 1 Nov 2014|website = BBC News}}</ref><ref name=":4">{{Cite web|url = https://www.nytimes.com/2010/04/06/science/06cyber.html?pagewanted=all&_r=1&|title = Researchers Trace Data Theft to Intruders in China|date = 5 April 2010|access-date = 1 Nov 2014|website = The New York Times|last1 = Markoff|first1 = John|last2 = Barboza|first2 = David}}</ref> The Shadow Network report "Shadows in the Cloud: Investigating Cyber Espionage 2.0" was released on 6 April 2010, approximately one year after the publication of "Tracking GhostNet."<ref name=":5">{{Cite web|url = https://www.scribd.com/doc/29435784/SHADOWS-IN-THE-CLOUD-Investigating-Cyber-Espionage-2-0|title = SHADOWS IN THE CLOUD: Investigating Cyber Espionage 2.0|date = 6 April 2010|access-date = 4 Nov 2010|website = Scribd|publisher = The SecDev Group|page = 2}}</ref>

The cyber spying network made use of Internet services,<ref name=":4" /> such as [[social networking]] and [[cloud computing]] platforms.<ref name=":3" /> The services included [[Twitter]], [[Google Groups]], [[Baidu]], [[Yahoo Mail]], [[Blogspot]], and [[blog.com]],<ref name=":4" /> which were used to host [[malware]]<ref name=":6">{{Cite web|url = http://www.cnet.com/news/report-india-targeted-by-spy-network/|title = Report: India targeted by spy network|date = 6 April 2010|access-date = 1 Nov 2014|website = CNET|last = Mills|first = Elinor}}</ref> and infect computers with malicious software.<ref name=":3" />

== Discovery ==
The Shadow Net report<ref>{{Cite web|url = https://www.scribd.com/doc/29435784/SHADOWS-IN-THE-CLOUD-Investigating-Cyber-Espionage-2-0|title = SHADOWS IN THE CLOUD: Investigating Cyber Espionage 2.0|date = 6 April 2010|access-date = 1 Nov 2014|website = Scribd|publisher = The SecDev Group}}</ref> was released following an 8-month collaborative investigation between researchers from the Canada-based Information Warfare Monitor and the United States [[Shadowserver]] Foundation.<ref name=":2" /><ref name=":6" /><ref>{{Cite web|url = https://www.theglobeandmail.com/technology/canadian-researchers-reveal-online-spy-ring-based-in-china/article1215984/|title = Canadian researchers reveal online spy ring based in China|date = 6 April 2010|access-date = 1 Nov 2014|website = The Globe and Mail|last = Robertson|first = Grant}}</ref> The Shadow Network was discovered during the GhostNet investigation,<ref name=":2" /> and researchers said it was more sophisticated and difficult to detect.<ref name=":2" /><ref name=":4" /> Following the publication of the GhostNet report, several of the listed command and control servers went offline;<ref name=":2" /><ref name=":7">{{Cite web|url = https://www.telegraph.co.uk/news/worldnews/asia/china/7559103/Chinese-hackers-steal-Dalai-Lamas-emails.html|title = Chinese hackers steal Dalai Lama's emails|date = 6 April 2010|access-date = 1 Nov 2010|website = The Telegraph|last = Moore|first = Malcolm}}</ref> however, the cyber attacks on the Tibetan community did not cease.<ref name=":7" />

The researchers conducted field research in [[Dharamshala]], India, and with the consent of the Tibetan organizations, they were able to monitor the networks in order to collect copies of the data from compromised computers and identify command and control servers used by the attackers.<ref name=":6" /><ref>{{Cite web|url = https://www.scribd.com/doc/29435784/SHADOWS-IN-THE-CLOUD-Investigating-Cyber-Espionage-2-0|title = SHADOWS IN THE CLOUD: Investigating Cyber Espionage 2.0|date = 6 April 2010|access-date = 1 Nov 2014|website = Scribd|publisher = The SecDev Group|page = 9}}</ref> The field research done by the Information Warfare Monitor and the Shadowserver Foundation found that computer systems in the Office of His Holiness the Dalai Lama (OHHDL) had been compromised by multiple malware networks, one of which was the Shadow Network.<ref>{{Cite web|url = https://www.scribd.com/doc/29435784/SHADOWS-IN-THE-CLOUD-Investigating-Cyber-Espionage-2-0|title = SHADOWS IN THE CLOUD: Investigating Cyber Espionage 2.0|date = 6 April 2010|access-date = 1 Nov 2014|website = Scribd|publisher = The SecDev Group|page = 13}}</ref>

Further research into the Shadow Network revealed that, while India and the Dalai Lama's offices were the primary focus of the attacks,<ref name=":4" /> the operation compromised computers on every continent except Australia and Antarctica.<ref name=":0" /><ref>{{Cite web|url = https://www.scribd.com/doc/29435784/SHADOWS-IN-THE-CLOUD-Investigating-Cyber-Espionage-2-0|title = SHADOWS IN THE CLOUD: Investigating Cyber Espionage 2.0|date = 6 April 2010|access-date = 1 Nov 2014|website = Scribd|publisher = The SecDev Group|page = 32}}</ref>

The research team recovered more than 1,500 e-mails from the Dalai Lama's Office<ref name=":0" /><ref name=":3" /> along with a number of documents belonging to the Indian government.<ref name=":0" /> This included classified security assessments in several Indian states, reports on Indian missile systems,<ref name=":7" /> and documents related to India's relationships in the Middle East, Africa, and Russia.<ref name=":0" /><ref name=":4" /> Documents were also stolen related to the movements of [[NATO]] forces in Afghanistan,<ref name=":4" /> and from the [[United Nations Economic and Social Commission for Asia and the Pacific]] (UNESCAP).<ref name=":3" /><ref name=":4" /> The hackers were indiscriminate in what they took, which included sensitive information as well as financial and personal information.<ref name=":3" />

== Origin ==
The attackers were tracked through e-mail addresses<ref name=":3" /> to the Chinese city of [[Chengdu]] in Sichuan province.<ref name=":0" /><ref name=":2" /> There was suspicion, but no confirmation, that one of the hackers had a connection to the [[University of Electronic Science and Technology]] in Chengdu.<ref name=":1" /> The account of another hacker was linked to a Chengdu resident who claimed to know little about the hacking.<ref name=":4" />

== References ==
<references />

== External links ==
* [https://www.shadowserver.org/wiki/ Shadowserver Foundation]
* [https://citizenlab.org/ Citizen Lab]
* [http://new.secdev.com/ The SecDev Group]
* [http://www.infowar-monitor.net/ Information Warfare Monitor]

{{Hacking in the 2010s}}

[[Category:Cyberwarfare by China]]
[[Category:Spyware]]
[[Category:Cyberattacks]]
[[Category:Cyberwarfare]]
[[Category:Espionage projects]]
[[Category:Cybercrime in India]]

Shadow Network - Revision history

Ajay Kumar: Created a new article