Twitter can cost you money

[Papa_Complex]

OK, maybe not. This story hit the news here a week ago and I don't know if you folks down south have heard about it.

Hackers used Twitter, email to crack computers
Report by Canadian researchers finds ‘dark, hidden core’ to social media

With the release of their second investigation in as many years, University of Toronto researchers who uncovered a complex cyber-espionage network based in China are again urging Canada to address the growing problem or face the consequences of a future attack.

“Cyberspace is being militarized,” said Ron Deibert, director of the Citizen Lab at the Munk School of Global Affairs and a lead researcher.

The investigative team from U of T and Ottawa-based SecDev Group released a report Tuesday that reveals how sophisticated hackers used Twitter, email and blogs to steal confidential national security data from India and spy on the Dalai Lama’s email.

“What the ... report shows is that the social media clouds of cyberspace we rely upon today have a dark hidden core,” Deibert said.

The investigation into the Shadow network of hackers expands on last year’s GhostNet investigation, which discovered that more than 1,000 computers in more than 100 countries had been strategically targeted by hackers in China. Targets included foreign governments and NATO.

Deibert said the latest report should “offer a wake-up call” to the Canadian government, “or we may find that we are the next victim of the Shadows and GhostNets of cyberspace.”

To make their point more urgently, Deibert and his colleagues use the analogy of arms control to address issues of cyberspace security.

“For its part, the Canadian government has neither a domestic cyber-security strategy nor a foreign policy for cyberspace,” he said.

Decrying the “vacuum” of cyber-security policy internationally, Deibert suggested creating a treaty of cyberspace that would define the ‘rules of engagement,’ such as how governments respond to information attacks. They believe other arms-control mechanisms, such as those used to monitor nuclear testing, could offer lessons on how to monitor cyber attacks.

International cooperation is crucial, Deibert said, because the networks are global. To track attacks, information has to be shared across borders. “That’s why we have been pushing for Canada to urgently consider a foreign policy for cyberspace.”

The competitive climate that inhibits cooperation also creates a global grey market whereby freelance hackers can sell stolen documents to governments, he said.

The report found the Chinese hackers stole very sensitive data, including documents from Indian national security and the Dalai Lama's offices in Tibet. The data includes information provided to India by third-party nationals, including Canadian visa applicants.

Though the hackers were traced to China, the researchers repeated several times that they found no hard evidence linking the attacks to the Chinese government.

But they didn’t rule out the possibility that the sensitive information would make it into government hands eventually.

“The relationship between the Chinese state and this hacking community is very unclear,” said Nart Villaneuve.

Although the Chinese foreign ministry called the report groundless, researchers said they have had “healthy cooperation” with the Chinese Computer Emergency Response Team, or CERT, who deal with cyber crime in the country.

Villeneuve said officials indicated they will investigate the evidence in the report.

The researchers said their report suggests there’s been a shift away from the traditional criminal enterprises of hackers — who typically phish for credit card numbers and banking information — toward attacks on politically sensitive targets.

They hope a global summit on cyber-security, to be hosted by the University of Toronto this fall, will offer an opportunity to discuss these issues.

With files from the Canadian Press