In March 2009 researchers at the University of Toronto uncovered a network of over 1200 compromised computers spread across 103 different countries. Nearly 30% of the infected hosts were identified as high-value targets, including ministries of foreign affairs, embassies, international organizations, news media, and NGOs. This presentation will detail the GhostNet investigation from the field work at Tibetan institutions in Dharamsala, India through to the discovery of the attackers’ command and control interface and the aftermath including the victim notification process. Throughout the talk I will explore alternative explanations and address some of the misconceptions surrounding the GhostNet report.
