Overview of cyber attacks against Tibetan Communities

Published: 2008-03-24,
Last Updated: 2008-03-24 20:40:40 UTC
by Maarten Van Horenbeeck (Version: 1)

On Friday we reported on targeted attacks against various pro-Tibet non-gouvernmental organizations (NGO) and communities, as well as Falun Gong and the Uyghurs. In this somewhat long diary entry, I’ll break down those attacks and identify the things we’ve seen in working on these since early 2007.

This hopefully helps you identify the risk similar attacks would pose to your organization. The diary does not deal with one incident, but looks at overall findings.

1. The message

The sole goal of the message is to transport the exploit, and to convince the reader to click on it, so the malicious code can execute.

Several social engineering tricks have been seen:

• Messages make a strong statement on a well known individual or group, but do not mention its name. The attachment is then named after that individual. A state of 'cognitive dissonance' arises between the reader's pre-existent beliefs and the statement. This urges the reader to click the message;
• The writing style of the purported sender is well researched and mimicked;
• The content of the document matches the topic of the e-mail message;
• Legitimate, trusted, users are sometimes convinced to actually forward along a message back to specific targets;
• In a number of cases, “memes” distributed within the community have been reused. For instance, in a “viral” Word document was grabbed from a forum, edited to include the exploit and Trojan code, and forwarded onto other members of the community.
• Thank you. Please read complete Article here
  

A young Tibetan examines Chinese riot policemen standing guard in Kangding county, China (Teh Een Koon/AFP/Getty)