Cyber spying, cyber espionage, or cyber-collection is the act or practice of obtaining secrets and information without the permission and knowledge of the holder of the information using methods on the Internet, networks or individual computers through the use of proxy servers,[1]cracking techniques and malicious software including Trojan horses and spyware.[2][3] Cyber espionage can be used to target various actors- individuals, competitors, rivals, groups, governments, and others- in order to obtain personal, economic, political or military advantages. It may wholly be perpetrated online from computer desks of professionals on bases in far away countries or may involve infiltration at home by computer trained conventional spies and moles or in other cases may be the criminal handiwork of amateur malicious hackers and software programmers.[2]
Cyber spying started as far back as 1996, when widespread deployment of Internet connectivity to government and corporate systems gained momentum. Since that time, there have been numerous cases of such activities.[4][5][6]
Detailsedit
Cyber spying typically involves the use of such access to secrets and classified information or control of individual computers or whole networks for a strategic advantage and for psychological, political and physical subversion activities and sabotage.[7] More recently, cyber spying involves analysis of public activity on social networking sites like Facebook and Twitter.[8]
Such operations, like non-cyber espionage, are typically illegal in the victim country while fully supported by the highest level of government in the aggressor country. The ethical situation likewise depends on one's viewpoint, particularly one's opinion of the governments involved.[7]
Platforms and functionalityedit
Cyber-collection tools have been developed by governments and private interests for nearly every computer and smart-phone operating system. Tools are known to exist for Microsoft, Apple, and Linux computers and iPhone, Android, Blackberry, and Windows phones.[9] Major manufacturers of Commercial off-the-shelf (COTS) cyber collection technology include Gamma Group from the UK[10] and Hacking Team from Italy.[11] Bespoke cyber-collection tool companies, many offering COTS packages of zero-day exploits, include Endgame, Inc. and Netragard of the United States and Vupen from France.[12] State intelligence agencies often have their own teams to develop cyber-collection tools, such as Stuxnet, but require a constant source of zero-day exploits in order to insert their tools into newly targeted systems. Specific technical details of these attack methods often sells for six figure sums.[13]
Common functionality of cyber-collection systems include:
Data scan: local and network storage are scanned to find and copy files of interest, these are often documents, spreadsheets, design files such as Autocad files and system files such as the passwd file.
Capture location: GPS, WiFi, network information and other attached sensors are used to determine the location and movement of the infiltrated device
Bug: the device microphone can be activated in order to record audio. Likewise, audio streams intended for the local speakers can be intercepted at the device level and recorded.
Hidden Private Networks that bypass the corporate network security. A compute that is being spied upon can be plugged into a legitimate corporate network that is heavy monitored for malware activity and at same time belongs to a private wifi network outside of the company network that is leaking confidential information off of an employee's computer. A computer like this is easily set up by a double-agent working in the IT department by install a second Wireless card in a computer and special software to remotely monitor an employee's computer through this second interface card without them being aware of a side-band communication channel pulling information off of his computer.
Camera: the device cameras can be activated in order to covertly capture images or video.
Keylogger and Mouse Logger: the malware agent can capture each keystroke, mouse movement and click that the target user makes. Combined with screen grabs, this can be used to obtain passwords that are entered using a virtual on-screen keyboard.
Screen Grabber: the malware agent can take periodic screen capture images. In addition to showing sensitive information that may not be stored on the machine, such as e-banking balances and encrypted web mail, these can be used in combination with the key and mouse logger data to determine access credentials for other Internet resources.
Encryption: Collected data is usually encrypted at the time of capture and may be transmitted live or stored for later exfiltration. Likewise, it is common practice for each specific operation to use specific encryption and poly-morphic capabilities of the cyber-collection agent in order to ensure that detection in one location will not compromise others.
Bypass Encryption: Because the malware agent operates on the target system with all the access and rights of the user account of the target or system administrator, encryption is bypassed. For example, interception of audio using the microphone and audio output devices enables the malware to capture to both sides of an encrypted Skype call.[14]
Exfiltration: Cyber-collection agents usually exfiltrate the captured data in a discrete manner, often waiting for high web traffic and disguising the transmission as secure web browsing. USB flash drives have been used to exfiltrate information from air gap protected systems. Exfiltration systems often involve the use of reverse proxy systems that anonymize the receiver of the data.[15]
Replicate: Agents may replicate themselves onto other media or systems, for example an agent may infect files on a writable network share or install themselves onto USB drives in order to infect computers protected by an air gap or otherwise not on the same network.
Manipulate Files and File Maintenance: Malware can be used to erase traces of itself from log files. It can also download and install modules or updates as well as data files. This function may also be used to place "evidence" on the target system, e.g. to insert child pornography onto the computer of a politician or to manipulate votes on an electronic vote counting machine.
Combination Rules: Some agents are very complex and are able to combine the above features in order to provide very targeted intelligence collection capabilities. For example, the use of GPS bounding boxes and microphone activity can be used to turn a smart phone into a smart bug that intercepts conversations only within the office of a target.
Compromised cellphones. Since, modern cellphones are increasingly similar to general purpose computer, these cellphones are vulnerable to the same cyber-collect attacks as computer systems, and are vulnerable to leak extremely sensitive conversational and location information to an attackers.[16] Leaking of cellphone GPS location and conversational information to an attacker has been reported in a number of recent cyber stalking cases where the attacker was able to use the victim's GPS location to call nearby businesses and police authorities to make false allegations against the victim depending on his location, this can range from telling the restaurant staff information to tease the victim, or making false witness against the victim. For instance if the victim were parked in large parking lot the attackers may call and state that they saw drug or violence activity going on with a description of the victim and directions to their GPS location.
Infiltrationedit
There are several common ways to infect or access the target:
An Injection Proxy is a system that is placed upstream from the target individual or company, usually at the Internet service provider, that injects malware into the targets system. For example, an innocent download made by the user can be injected with the malware executable on the fly so that the target system then is accessible to the government agents.[17]
Spear Phishing: A carefully crafted e-mail is sent to the target in order to entice them to install the malware via a Trojan document or a drive by attack hosted on a web server compromised or controlled by the malware owner.[18]
Surreptitious Entry may be used to infect a system. In other words, the spies carefully break into the target's residence or office and install the malware on the target's system.[19]
An Upstream monitor or sniffer is a device that can intercept and view the data transmitted by a target system. Usually this device is placed at the Internet service provider. The Carnivore system developed by the U.S. FBI is a famous example of this type of system. Based on the same logic as a telephone intercept, this type of system is of limited use today due to the widespread use of encryption during data transmission.
A wireless infiltration system can be used in proximity of the target when the target is using wireless technology. This is usually a laptop based system that impersonates a WiFi or 3G base station to capture the target systems and relay requests upstream to the Internet. Once the target systems are on the network, the system then functions as an Injection Proxy or as an Upstream Monitor in order to infiltrate or monitor the target system.
A USB Key preloaded with the malware infector may be given to or dropped at the target site.
Cyber-collection agents are usually installed by payload delivery software constructed using zero-day attacks and delivered via infected USB drives, e-mail attachments or malicious web sites.[20][21] State sponsored cyber-collections efforts have used official operating system certificates in place of relying on security vulnerabilities. In the Flame operation, Microsoft states that the Microsoft certificate used to impersonate a Windows Update was forged;[22] however, some experts believe that it may have been acquired through HUMINT efforts.[23]
Bill Schiller, Asia Bureau (Apr 1, 2009), "Chinese ridicule U of T spy report - But government officials choose words carefully, never denying country engages in cyber-espionage", Toronto Star (Canada), Toronto, Ontario, Canada, retrieved 2009-04-04
Kelly, Cathal (Mar 31, 2009), "Cyberspies' code a click away - Simple Google search quickly finds link to software for Ghost Rat program used to target governments", Toronto Star (Canada), Toronto, Ontario, Canada, retrieved 2009-04-04
, infotech.indiatimes.com (Times of India), March 30, 2009, archived from the original on April 2, 2009, retrieved April 1, 2009
Cooper, Alex (March 30, 2009), "We can lead in cyber spy war, sleuth says; Toronto investigator helped expose hacking of embassies, NATO", Toronto Star (Canada), Toronto, Ontario, Canada, retrieved 2009-03-31
, archived from the original on 2021-11-09, retrieved 2017-03-06
Steve Herman (30 March 2009), Exiled Tibetan Government Expresses Concern over Cyber-Spying Traced to China, New Delhi: GlobalSecurity.org, retrieved 2009-03-31
"Chinese government accused of cyber spying", Belfast Telegraph, 30 March 2009
Harvey, Mike (March 29, 2009), "'World's biggest cyber spy network' snoops on classified documents in 103 countries", The Times, London, retrieved 2009-03-30
Major cyber spy network uncovered, BBC News, 29 March 2009, retrieved 2009-03-30
SciTech Cyber spy network 'smoking gun' for China: expert, CTV Canada, March 29, 2009, retrieved 2009-03-30
Kim Covert (March 28, 2009), "Canadian researchers uncover vast Chinese cyber spy network", National Post, Don Mills, Ontario, Canada, Canwest News Service[dead link]
US warned of China 'cyber-spying', BBC News, 20 November 2008, retrieved 2009-04-01
Mark Hosenball (June 2, 2008), "Intelligence - Cyber-Spying for Dummies", Newsweek
Walton, Gregory (April 2008). . World Association of Newspapers. Archived from the original on 2009-08-11. Retrieved 2009-04-01.
German court limits cyber spying, BBC News, 27 February 2008
Rowan Callick; Jane Macartney (December 7, 2007), , The Australian, archived from the original on August 13, 2009, retrieved March 31, 2009
cyber, spying, cyber, espionage, cyber, collection, practice, obtaining, secrets, information, without, permission, knowledge, holder, information, using, methods, internet, networks, individual, computers, through, proxy, servers, cracking, techniques, malici. Cyber spying cyber espionage or cyber collection is the act or practice of obtaining secrets and information without the permission and knowledge of the holder of the information using methods on the Internet networks or individual computers through the use of proxy servers 1 cracking techniques and malicious software including Trojan horses and spyware 2 3 Cyber espionage can be used to target various actors individuals competitors rivals groups governments and others in order to obtain personal economic political or military advantages It may wholly be perpetrated online from computer desks of professionals on bases in far away countries or may involve infiltration at home by computer trained conventional spies and moles or in other cases may be the criminal handiwork of amateur malicious hackers and software programmers 2 Contents 1 History 2 Details 3 Platforms and functionality 4 Infiltration 5 Examples of operations 6 See also 7 References 8 Sources 9 External linksHistory editCyber spying started as far back as 1996 when widespread deployment of Internet connectivity to government and corporate systems gained momentum Since that time there have been numerous cases of such activities 4 5 6 Details editCyber spying typically involves the use of such access to secrets and classified information or control of individual computers or whole networks for a strategic advantage and for psychological political and physical subversion activities and sabotage 7 More recently cyber spying involves analysis of public activity on social networking sites like Facebook and Twitter 8 Such operations like non cyber espionage are typically illegal in the victim country while fully supported by the highest level of government in the aggressor country The ethical situation likewise depends on one s viewpoint particularly one s opinion of the governments involved 7 Platforms and functionality editCyber collection tools have been developed by governments and private interests for nearly every computer and smart phone operating system Tools are known to exist for Microsoft Apple and Linux computers and iPhone Android Blackberry and Windows phones 9 Major manufacturers of Commercial off the shelf COTS cyber collection technology include Gamma Group from the UK 10 and Hacking Team from Italy 11 Bespoke cyber collection tool companies many offering COTS packages of zero day exploits include Endgame Inc and Netragard of the United States and Vupen from France 12 State intelligence agencies often have their own teams to develop cyber collection tools such as Stuxnet but require a constant source of zero day exploits in order to insert their tools into newly targeted systems Specific technical details of these attack methods often sells for six figure sums 13 Common functionality of cyber collection systems include Data scan local and network storage are scanned to find and copy files of interest these are often documents spreadsheets design files such as Autocad files and system files such as the passwd file Capture location GPS WiFi network information and other attached sensors are used to determine the location and movement of the infiltrated device Bug the device microphone can be activated in order to record audio Likewise audio streams intended for the local speakers can be intercepted at the device level and recorded Hidden Private Networks that bypass the corporate network security A compute that is being spied upon can be plugged into a legitimate corporate network that is heavy monitored for malware activity and at same time belongs to a private wifi network outside of the company network that is leaking confidential information off of an employee s computer A computer like this is easily set up by a double agent working in the IT department by install a second Wireless card in a computer and special software to remotely monitor an employee s computer through this second interface card without them being aware of a side band communication channel pulling information off of his computer Camera the device cameras can be activated in order to covertly capture images or video Keylogger and Mouse Logger the malware agent can capture each keystroke mouse movement and click that the target user makes Combined with screen grabs this can be used to obtain passwords that are entered using a virtual on screen keyboard Screen Grabber the malware agent can take periodic screen capture images In addition to showing sensitive information that may not be stored on the machine such as e banking balances and encrypted web mail these can be used in combination with the key and mouse logger data to determine access credentials for other Internet resources Encryption Collected data is usually encrypted at the time of capture and may be transmitted live or stored for later exfiltration Likewise it is common practice for each specific operation to use specific encryption and poly morphic capabilities of the cyber collection agent in order to ensure that detection in one location will not compromise others Bypass Encryption Because the malware agent operates on the target system with all the access and rights of the user account of the target or system administrator encryption is bypassed For example interception of audio using the microphone and audio output devices enables the malware to capture to both sides of an encrypted Skype call 14 Exfiltration Cyber collection agents usually exfiltrate the captured data in a discrete manner often waiting for high web traffic and disguising the transmission as secure web browsing USB flash drives have been used to exfiltrate information from air gap protected systems Exfiltration systems often involve the use of reverse proxy systems that anonymize the receiver of the data 15 Replicate Agents may replicate themselves onto other media or systems for example an agent may infect files on a writable network share or install themselves onto USB drives in order to infect computers protected by an air gap or otherwise not on the same network Manipulate Files and File Maintenance Malware can be used to erase traces of itself from log files It can also download and install modules or updates as well as data files This function may also be used to place evidence on the target system e g to insert child pornography onto the computer of a politician or to manipulate votes on an electronic vote counting machine Combination Rules Some agents are very complex and are able to combine the above features in order to provide very targeted intelligence collection capabilities For example the use of GPS bounding boxes and microphone activity can be used to turn a smart phone into a smart bug that intercepts conversations only within the office of a target Compromised cellphones Since modern cellphones are increasingly similar to general purpose computer these cellphones are vulnerable to the same cyber collect attacks as computer systems and are vulnerable to leak extremely sensitive conversational and location information to an attackers 16 Leaking of cellphone GPS location and conversational information to an attacker has been reported in a number of recent cyber stalking cases where the attacker was able to use the victim s GPS location to call nearby businesses and police authorities to make false allegations against the victim depending on his location this can range from telling the restaurant staff information to tease the victim or making false witness against the victim For instance if the victim were parked in large parking lot the attackers may call and state that they saw drug or violence activity going on with a description of the victim and directions to their GPS location Infiltration editThere are several common ways to infect or access the target An Injection Proxy is a system that is placed upstream from the target individual or company usually at the Internet service provider that injects malware into the targets system For example an innocent download made by the user can be injected with the malware executable on the fly so that the target system then is accessible to the government agents 17 Spear Phishing A carefully crafted e mail is sent to the target in order to entice them to install the malware via a Trojan document or a drive by attack hosted on a web server compromised or controlled by the malware owner 18 Surreptitious Entry may be used to infect a system In other words the spies carefully break into the target s residence or office and install the malware on the target s system 19 An Upstream monitor or sniffer is a device that can intercept and view the data transmitted by a target system Usually this device is placed at the Internet service provider The Carnivore system developed by the U S FBI is a famous example of this type of system Based on the same logic as a telephone intercept this type of system is of limited use today due to the widespread use of encryption during data transmission A wireless infiltration system can be used in proximity of the target when the target is using wireless technology This is usually a laptop based system that impersonates a WiFi or 3G base station to capture the target systems and relay requests upstream to the Internet Once the target systems are on the network the system then functions as an Injection Proxy or as an Upstream Monitor in order to infiltrate or monitor the target system A USB Key preloaded with the malware infector may be given to or dropped at the target site Cyber collection agents are usually installed by payload delivery software constructed using zero day attacks and delivered via infected USB drives e mail attachments or malicious web sites 20 21 State sponsored cyber collections efforts have used official operating system certificates in place of relying on security vulnerabilities In the Flame operation Microsoft states that the Microsoft certificate used to impersonate a Windows Update was forged 22 however some experts believe that it may have been acquired through HUMINT efforts 23 Examples of operations editStuxnet Flame Duqu Bundestrojaner Rocra 24 25 Operation High Roller 26 Cozy Bear a well resourced highly dedicated and organized cyber espionage group that F Secure believes has been working for the Russian Federation since at least 2008 27 28 29 See also editChaos Computer Club Chinese intelligence operations in the United States Computer security Computer surveillance Cyber security regulation Cyber spying on universities Cyber threat intelligence Cyberwarfare Employee monitoring software GhostNet Industrial espionage Proactive Cyber Defence Stalkerware Surveillance Titan Rain Vulkan files leakReferences edit Residential proxy network use cases GeoSurf Retrieved 28 September 2017 a b Cyber Espionage PC Magazine Cyberspying Techopedia Pete Warren State sponsored cyber espionage projects now prevalent say experts The Guardian August 30 2012 Nicole Perlroth Elusive FinSpy Spyware Pops Up in 10 Countries New York Times August 13 2012 Kevin G Coleman Has Stuxnet Duqu and Flame Ignited a Cyber Arms Race Archived 2012 07 08 at the Wayback Machine AOL Government July 2 2012 a b Messmer Ellen Cyber Espionage A Growing Threat to Business Archived from the original on January 26 2021 Retrieved Jan 21 2008 Five Ways the Government Spies on You The LockerGnome Daily Report 7 November 2011 Archived from the original on 18 October 2019 Retrieved 9 February 2019 Vernon Silver Spyware Matching FinFisher Can Take Over IPhones Bloomberg August 29 2012 FinFisher IT Intrusion Archived from the original on 2012 07 31 Retrieved 2012 07 31 Hacking Team Remote Control System Archived from the original on 2016 12 15 Retrieved 2013 01 21 Mathew J Schwartz Weaponized Bugs Time For Digital Arms Control Information Week 9 October 2012 Ryan Gallagher Cyberwar s Gray Market Slate 16 Jan 2013 Daniele Milan The Data Encryption Problem Archived 2022 04 08 at the Wayback Machine Hacking Team Robert Lemos Flame stashes secrets in USB drives Archived 2014 03 15 at the Wayback Machine InfoWorld June 13 2012 how to spy on a cell phone without having access Pascal Gloor Un lawful Interception Archived 2016 02 05 at the Wayback Machine SwiNOG 25 07 November 2012 Mathew J Schwartz Operation Red October Attackers Wielded Spear Phishing Information Week January 16 2013 FBI Records The Vault Surreptitious Entries Federal Bureau of Investigation Kim Zetter Flame spyware infiltrating Iranian computers CNN Wired May 30 2012 Anne Belle de Bruijn Cybercriminelen doen poging tot spionage bij DSM Elsevier July 9 2012 Mike Lennon Microsoft Certificate Was Used to Sign Flame Malware Archived 2013 03 07 at the Wayback Machine June 4 2012 Paul Wagenseil Flame Malware Uses Stolen Microsoft Digital Signature NBC News June 4 2012 Red October Diplomatic Cyber Attacks Investigation Securelist January 14 2013 Kaspersky Lab Identifies Operation Red October Archived 2016 03 04 at the Wayback Machine Kaspersky Lab Press Release January 14 2013 Dave Marcus amp Ryan Cherstobitoff Dissecting Operation High Roller Archived 2013 03 08 at the Wayback Machine McAfee Labs the Dukes timeline Archived from the original on 2015 10 13 Retrieved 2015 10 13 The Dukes Whitepaper PDF F Secure Press Room Global Sources editBill Schiller Asia Bureau Apr 1 2009 Chinese ridicule U of T spy report But government officials choose words carefully never denying country engages in cyber espionage Toronto Star Canada Toronto Ontario Canada retrieved 2009 04 04 Kelly Cathal Mar 31 2009 Cyberspies code a click away Simple Google search quickly finds link to software for Ghost Rat program used to target governments Toronto Star Canada Toronto Ontario Canada retrieved 2009 04 04 All about Chinese cyber spying infotech indiatimes com Times of India March 30 2009 archived from the original on April 2 2009 retrieved April 1 2009 Cooper Alex March 30 2009 We can lead in cyber spy war sleuth says Toronto investigator helped expose hacking of embassies NATO Toronto Star Canada Toronto Ontario Canada retrieved 2009 03 31 Chinese based cyber spy network exposes need for better security archived from the original on 2021 11 09 retrieved 2017 03 06 Steve Herman 30 March 2009 Exiled Tibetan Government Expresses Concern over Cyber Spying Traced to China New Delhi GlobalSecurity org retrieved 2009 03 31 Chinese government accused of cyber spying Belfast Telegraph 30 March 2009 Harvey Mike March 29 2009 World s biggest cyber spy network snoops on classified documents in 103 countries The Times London retrieved 2009 03 30 Major cyber spy network uncovered BBC News 29 March 2009 retrieved 2009 03 30 SciTech Cyber spy network smoking gun for China expert CTV Canada March 29 2009 retrieved 2009 03 30 Kim Covert March 28 2009 Canadian researchers uncover vast Chinese cyber spy network National Post Don Mills Ontario Canada Canwest News Service dead link US warned of China cyber spying BBC News 20 November 2008 retrieved 2009 04 01 Mark Hosenball June 2 2008 Intelligence Cyber Spying for Dummies Newsweek Walton Gregory April 2008 Year of the Gh0st RAT World Association of Newspapers Archived from the original on 2009 08 11 Retrieved 2009 04 01 German court limits cyber spying BBC News 27 February 2008 Rowan Callick Jane Macartney December 7 2007 Chinese fury at cyber spy claims The Australian archived from the original on August 13 2009 retrieved March 31 2009External links editCongress to Investigate Google Charges Of Chinese Internet Spying AHN Archive of Information Warfare Monitor Tracking Cyberpower University of Toronto Canada Munk Centre Portal nbsp Internet Retrieved from https en wikipedia org w index php title Cyber spying amp oldid 1221317396, wikipedia, wiki, book, books, library,
