Thoughts on GhostNet

I thought it would be useful to provide some concluding thoughts on GhostNet as a means to wrap up today's in class discussion.

• Its important to note that the real work in these type of social malware attacks is not in the vulnerability discovery and exploit creation process. Rather the real work is in the social engineering phase - that is the research conducted that enables the hackers to design an email, or other form of communication, that convinces the target to infect him or herself.
  
• While these attacks illustrate an attack on confidentiality, from a technical perspective there is nothing that prevented the hackers from attacking both integrity and availability. In the case of GhostNet, it is highly likely that the hackers were interested only in stealing information and therefore did not want to alert the targets to their presence by conducting a denial of service attack or by altering the function of the targeted network.
• While there is both technical and circumstantial evidence that attributes these attacks to China, there is not necessarily enough evidence to attribute these attacks to the Chinese government.  The fact that the botnet was not encrypted and that the command and control servers were openly accessible appear to indicate that a traditional government organization tasked with espionage was not directly responsible for carrying out the attacks.  Nation-states would typically guard their sources and methods with zeal in an effort to protect its access to intercepted communications.  That the GhostNet was openly accessible appears to indicate that patriotic hackers were responsible for the attacks. However, this does not mean that the patriotic hackers were operating with the implied consent of the Chinese government and providing the stolen information directly to Chinese intelligence.