Study Claims Chinese Cyber Spies Control, Steal Data From Foreign Governments

March 29, 2009 9:03 a.m. EST

Toronto, Canada (AHN) - China's cyber espionage operation has been stealing sensitive information from government office computers in 103 countries, according to Canadian researchers.

A team of researchers at the University of Toronto has found that China's GhostNet system had sent e-mails containing malware to target computers. The malware prompts the infected computer to download a Trojan program called ghost RAT, which allow attackers to control the computers and bring its data to servers in mainland China.

"Our investigation reveals that GhostNet is capable of taking full control of infected computers, including searching and downloading specific files, and covertly operating attached devices, including microphones and web cameras," Canada.com quoted the researchers as saying in their report entitled "Tracking GhostNet: Investigating a Cyber Espionage Network."

"Up to 30 per cent of the infected hosts are considered high-value targets and include computers located at ministries of foreign affairs, embassies, international organizations, news media, and NGOs," according to the report published Saturday in the Information Warfare Monitor and available online.

Among the compromised computers are those in the private office of the Dalai Lama and the Tibetan Government in Exile in India. The Dalai Lamai, Tibet's spiritual leader , campaigning for the independence of his homeland from Chinese rule.

The GhostNet was discovered while the Canadian researchers were doing a case study on Chinese spying on Tibetan institutions.

The report's authors, including Ron Deibert, director of the Citizen Lab at the University of Toronto's Munk Centre, told Canada.com that there is no evidence the spies were working for the Chinese government.