Cyber Attacks
In 2008, organizations advocating for human rights in Tibet and China experienced
escalated cyber attacks during politically explosive events, such as the crackdown on
Tibetan protesters in March, and in the lead-up to the Olympic Games in August. The
preferred method of these attackers was reportedly e-mail viruses, which are more
likely to be undetected by commercial antivirus software because they are handcrafted. 176 From field research conducted at the offices of the Tibetan Government in
exile in Dharamsala and several Tibetan missions abroad, researchers at the SecDev
Group and the Citizen Lab at the University of Toronto discovered an extensive
malware-based cyber-espionage network that also used ‘‘contextually relevant e-mails’’
to gain ‘‘complete, real-time’’ control of at least 1,295 infected computers in 103 countries. 177 This network, which they called GhostNet, sent e-mails to specific targets containing a Trojan called Gh0st RAT, which in taking full control of infected computers
allowed GhostNet to search and download specific files and covertly operate attached
devices such as microphones and Web cameras. Among the high-value infections,
comprising close to 30 percent of the computers affected, were many foreign affairs
ministries, embassies, regional organizations (such as the ASEAN Secretariat), and
news organizations. Although the complicity or awareness of Chinese authorities could
not be conclusively established, researchers tracked the instances of Gh0st RAT to commercial Internet access accounts located on the island of Hainan in China.
ONI Testing Results
The ‘‘Great Firewall of China’’ uses a variety of overlapping techniques for blocking
content containing a wide range of material considered politically sensitive by the
Chinese government. While China employs filtering techniques used by many other
countries, including domain name system (DNS) tampering and Internet protocol (IP)
blocking, it is unique in the world for its system of filtration, targeting Internet connections when triggered by a list of banned keywords. Known as a TCP reset, this content
filtering by keyword targets content regardless of where it is hosted.
Reset filtering using TCP is based on inspecting the content of IP packets for keywords that would trigger blocking, either in the header or the content of the message. When a router in the Great Firewall identifies a bad keyword, it sends reset
packets to both the source and destination IP addresses in the packet, breaking the
connection.
China employs targeted yet extensive filtering of information that could have a
potential impact on the Communist Party’s control over social stability, and is therefore predominantly focused on Chinese-language content relating to China-specific
issues. For the government, information constituting a threat to public order extends
well beyond well-publicized sensitive topics, such as the June 1989 military crackdown,
China
467
In 2008, organizations advocating for human rights in Tibet and China experienced
escalated cyber attacks during politically explosive events, such as the crackdown on
Tibetan protesters in March, and in the lead-up to the Olympic Games in August. The
preferred method of these attackers was reportedly e-mail viruses, which are more
likely to be undetected by commercial antivirus software because they are handcrafted. 176 From field research conducted at the offices of the Tibetan Government in
exile in Dharamsala and several Tibetan missions abroad, researchers at the SecDev
Group and the Citizen Lab at the University of Toronto discovered an extensive
malware-based cyber-espionage network that also used ‘‘contextually relevant e-mails’’
to gain ‘‘complete, real-time’’ control of at least 1,295 infected computers in 103 countries. 177 This network, which they called GhostNet, sent e-mails to specific targets containing a Trojan called Gh0st RAT, which in taking full control of infected computers
allowed GhostNet to search and download specific files and covertly operate attached
devices such as microphones and Web cameras. Among the high-value infections,
comprising close to 30 percent of the computers affected, were many foreign affairs
ministries, embassies, regional organizations (such as the ASEAN Secretariat), and
news organizations. Although the complicity or awareness of Chinese authorities could
not be conclusively established, researchers tracked the instances of Gh0st RAT to commercial Internet access accounts located on the island of Hainan in China.
ONI Testing Results
The ‘‘Great Firewall of China’’ uses a variety of overlapping techniques for blocking
content containing a wide range of material considered politically sensitive by the
Chinese government. While China employs filtering techniques used by many other
countries, including domain name system (DNS) tampering and Internet protocol (IP)
blocking, it is unique in the world for its system of filtration, targeting Internet connections when triggered by a list of banned keywords. Known as a TCP reset, this content
filtering by keyword targets content regardless of where it is hosted.
Reset filtering using TCP is based on inspecting the content of IP packets for keywords that would trigger blocking, either in the header or the content of the message. When a router in the Great Firewall identifies a bad keyword, it sends reset
packets to both the source and destination IP addresses in the packet, breaking the
connection.
China employs targeted yet extensive filtering of information that could have a
potential impact on the Communist Party’s control over social stability, and is therefore predominantly focused on Chinese-language content relating to China-specific
issues. For the government, information constituting a threat to public order extends
well beyond well-publicized sensitive topics, such as the June 1989 military crackdown,
China
467