Toronto/Shanghai: Turning the tables on a China-based computer espionage gang, Canadian and US computer security researchers have monitored a spying operation for the past eight months, observing while the intruders pilfered classified and restricted documents from the highest levels of the Indian defence ministry.

In a report issued Monday night, the researchers, based at the Munk School of Global Affairs at the University of Toronto, provide a detailed account of how a spy operation it called the Shadow Network systematically hacked into personal computers in government offices on several continents.

Spy network: Members of a Canadian research group that uncovered a computerized intelligence breach, (from left) Ronald Deibert, Greg Walton, Nart Villeneuve and Rafal Rohozinski at the University of Toronto. Tim Leyes/NYT

The intruders even stole documents related to the travel of Nato (North Atlantic Treaty Organization) forces in Afghanistan, illustrating that even though the Indian government was the primary target of the attacks, one chink in computer security can leave many nations exposed.

“It’s not only that you’re only secure as the weakest link in your network," said Rafal Rohozinski, a member of the Toronto team. “But in an interconnected world, you’re only as secure as the weakest link in the global chain of information."

The spy operation appears to be different both from the Internet intruders identified by Google and from a surveillance ring known as Ghostnet, also believed to be operating from China, which the Canadian researchers identified in March of last year. Ghostnet used computer servers largely based on the island of Hainan to steal documents from the Dalai Lama, the exiled leader of Tibet, and government and corporations in at least 103 countries.

The Ghostnet investigation led the investigators to this second Internet spy operation, which is the subject of their new report, titled Shadows in the Cloud: An investigation into cyber-espionage 2.0. The new report shows the India-focused spy ring made extensive use of social networks such as Twitter, Google Groups, Blogspot, Baidu Blogs and Yahoo Mail, to automate the control of computers once they had been infected.

The Canadian researchers cooperated in their investigation with a volunteer US group of security experts at the Shadowserver Foundation, which focuses on Internet criminal activity.

The researchers said the second spy ring was more sophisticated and difficult to detect than the Ghostnet operation.

By examining a series of email addresses, the investigators traced the attacks to hackers who appeared to be based in Chengdu, which is home to a large population from neighbouring Tibet. Researchers believe one hacker used the code name lost33 and that he may have been affiliated with the city’s prestigious University of Electronic Science and Technology. The university publishes books on computer hacking and offers courses in “network attack and defence technology" and “information conflict technology", according to its website.

The People’s Liberation Army also operates a technical reconnaissance bureau in the city and helps fund the university’s research on computer network defence. A spokesman for the university could not be reached Monday because of a national holiday.

The investigators linked the account of another hacker to a Chengdu resident whose name appeared to be Li. Reached by telephone on Monday, Li denied taking part in computer hacking. Li, who declined to give his full name, said he must be confused with someone else. He said he knew little about computer hacking. “That is not me," he said. “I’m a wine seller."

The Canadian researchers stressed that while the new spy ring focused primarily on India, there were clear international ramifications.

Rohozinski noted that civilian personnel working for Nato and the reconstruction mission in Afghanistan usually travel through India and that Indian government visa issuing computers were compromised in both Kandahar and Kabul in Afghanistan.

“That is an operations security issue for both Nato and the International Security Assistance Force," said Rohozinski, who is also chief executive of the SecDev group, a Canadian computer security consulting and research firm.

The report notes that documents the researchers recovered were found with “Secret", “Restricted", and “Confidential" notices. “These documents," the report says, “contain sensitive information taken from a member of the (Indian) National Security Council Secretariat concerning secret assessments of India’s security situation in the states of Assam, Manipur, Nagaland and Tripura, as well as concerning the Naxalites and the Maoists."

Other documents contained personal information about a member of India’s military intelligence agency.

The researchers also found evidence that Indian embassy computers in Kabul, Moscow, Dubai and the high commission of India in Abuja, Nigeria, were compromised.

Also compromised were computers used by the Indian Military Engineer Services in Bengdubi, Kolkata, Bangalore and Jalandhar; the 21st Mountain Artillery Brigade in Assam; and three air force bases. Computers at two Indian military colleges were also taken over by the spy ring.

Even after eight months of watching the spy ring, the Toronto researchers said they could not determine exactly who was using the Chengdu computers to infiltrate the Indian government.

“But an important question to be entertained is whether the PRC (People’s Republic of China) will take action to shut the Shadow network down," the report says. “Doing so will help to address long-standing concerns that malware ecosystems are actively cultivated, or at the very least tolerated, by governments like the PRC who stand to benefit from their exploits though the black and grey markets for information and data."


Vikas Bajaj from Mumbai contributed to this story.