Hello,

We noticed you're browsing in private or incognito mode.

To continue reading this article, please exit incognito mode or log in.

Not a subscriber? Subscribe now for unlimited access to online articles.

David Talbot

A View from David Talbot

How a Simple Google Search Unmasked a Chinese Cyber Espionage Network

In a new book, a leading researcher tells how cyber forensic work investigates militarization and espionage.

  • June 4, 2013

Cyber warfare and espionage has been a top national security concern for several years, with senior U.S. officials recently accusing the Chinese military (see “Pentagon Points Finger at Chinese Army Over Computer Attacks”).  But for all the sophistication of these attacks, there have been growing indications that the attackers are often amateurish (see “Exposé of Chinese Data Thieves Reveals Sloppy Tactics”).

One of the major centers for forensic work into computer espionage has been the Citizen Lab, an interdisciplinary research center at the University of Toronto. A new book, Black Code: Inside the Battle for Cyberspace, by lab director Ron Deibert is shedding further light into how espionage artists have been unmasked–as well as how the technologies developed by western companies have been so readily adapted to violate human rights (see “Regimes Use U.S. Tech to Censor Citizens, Study Finds”).

Deibert told me today that one big surprise was indeed how easy it sometimes was to see exactly what the Chinese hackers were doing.   For example, four years ago researchers at the lab tried to discern exactly how hackers–starting with some compromised networks in the Tibetan exile capital of Dharamsala, India–had managed to penetrate Indian national security agencies as well as collect extensive data on Tibetan, Indian, and human-rights figures (see “Moore’s Outlaws”).  It turns out that the key to the puzzle was a Google search.  As the researchers sniffed traffic from compromised computers, a 22-character string kept appearing.  So they entered the term into the Google search bar and saw that it was the address of a Chinese website.  They then visited the site and found open directories, lacking password protections, that showed everything else the network was doing, if not who they actually were.  “China-based espionage networks are actually very sloppy. We’ve seen this over and over again–sloppy careless steps that allowed us to see what they were doing. There is a huge outsourcing of the cyber criminal underworld, and it is not as sophisticated as one might assume, which may mean it’s not that closely directed by the government – at least not the ones that we see.”  And it also said something about the level of hyperbole by security companies.  “A lot of companies like to trumpet their unique investigative powers, but cracking one of the cyber espionage networks came down to a researcher in a university lab Googling something,” he added. 

Hear more from Google at EmTech Digital.

Register now
More from Connectivity

What it means to be constantly connected with each other and vast sources of information.

Want more award-winning journalism? Subscribe to Print + All Access Digital.
  • Print + All Access Digital {! insider.prices.print_digital !}*

    {! insider.display.menuOptionsLabel !}

    The best of MIT Technology Review in print and online, plus unlimited access to our online archive, an ad-free web experience, discounts to MIT Technology Review events, and The Download delivered to your email in-box each weekday.

    See details+

    12-month subscription

    Unlimited access to all our daily online news and feature stories

    6 bi-monthly issues of print + digital magazine

    10% discount to MIT Technology Review events

    Access to entire PDF magazine archive dating back to 1899

    Ad-free website experience

    The Download: newsletter delivery each weekday to your inbox

    The MIT Technology Review App

/3
You've read of three free articles this month. for unlimited online access. You've read of three free articles this month. for unlimited online access. This is your last free article this month. for unlimited online access. You've read all your free articles this month. for unlimited online access. You've read of three free articles this month. for more, or for unlimited online access. for two more free articles, or for unlimited online access.