The Hindu Business Line : On the crime trail

The Chinese government has one of the most restrictive Internet policies as evidenced by its penchant for shutting out Web sites and placing various other restraints on the sites that it actually permits. What is striking is that the country has the technology to ensure detection of any violation of the conditions under which the Web functions there.

More interestingly, almost all computer majors from the West, including Microsoft, Yahoo!, et al, have acquiesced with such a practice. This has drawn flak from elements who swear by an absolutely free Internet.

In this backdrop, one would expect Chinese authorities to have a near total control over undesirable activities in cyberspace by its citizens. This does not, however, seem to be the case if one goes by the number of attacks suspected to have emanated from the Chinese mainland.

in the spotlight

Three recent cyber attacks are attributed to the Chinese, although there is nothing to indicate that the government itself had a hand in them. In the first of these, unauthorised access to the Web server and e-mail traffic of the Save Darfur Coalition (SDC) was detected a few weeks ago. (The SDC has won international recognition and support for its persistent efforts to expose the ongoing genocide in western Sudan’s Darfur region.) This has drawn the attention of the FBI in the US, which is probing the source of intrusion.

Readers may know that the SDC has been mounting pressure on the Chinese government to intervene in Sudan so as to put an end to the genocide. An SDC spokesman suspects that the recent attacks originated from China as the IP addresses of transgressing computers belonged to that country. What has annoyed SDC is that its partners have also been targets of attacks that tricked them into opening malicious mails or malicious Web sites.

A few pro-Tibet organisations have also complained that their systems were being targeted systematically. According to one complaint, pro-Tibet elements have received e-mails which, on their face, looked as if they were coming from supporting organisations, when they were actually from hostile sources.

The attack code used in these cases is reported to have exploited a flaw in Adobe’s Acrobat software.

UK charge

The next accusation of Chinese involvement comes from the UK, where the Royal Institute of British Architects (RIBA) believes its member database had been hacked a fortnight ago by a Chinese organisation widely known for its ability to unleash massive spam on unsuspecting Web sites. The motive? No fraud is suspected.

The RIBA considers that the attack was mainly to capture the e-mail addresses of some of its members.

It further believes that the databases of more than 1,000 organisations in the UK as well as the US had been similarly violated in the recent past.

Closer home

What should be of greater concern closer home is a media report that computers in our Embassy in Beijing had recently been hacked. In the absence of official corroboration, it may not be appropriate to view this as a genuine report. The Ministry of External Affairs (MEA) has actually denied that such an attack ever took place. According to it, all MEA computers were stand-alone machines to which only a few officials have access.

What, however, imparts some credibility to the media report is the information that an Indian technical team was likely to visit Beijing shortly to investigate the alleged happening. If this were true, we need to look at the whole state of computer security in our sensitive government departments. This is especially so in the context of strains seen in Indo-Chinese relationship flowing from unrest among Tibetans in India.

Interestingly, a new CNN reports refers to a meeting its correspondent had with three young hackers in Zhoushan Island, south of Shanghai. These three men operate a Web site that instructs one on how to hack Web sites.

According to Xiao Chen, one of the youths, no Web site is invulnerable, indicating that the site owned by him along with others had the potential to bring down any others claiming to be proof against hacking.

Chen claims that the site owned by the group has about 10,000 registered users and gets nearly 50,000 hits a day. This could be an exaggeration. But experts in the business confirm that the Web site does have a flourishing business, and it allows free software downloads for intruding into other systems.

According to the CNN reporter, there is no evidence to believe that this site has any links with the Chinese government. This is again a statement that the West may not readily accept!

Matter of concern for China

The suspicion that China is now home to many who are bent upon disturbing peace and equilibrium in cyberspace should be disconcerting to the Chinese authorities themselves. This is especially so when the stage is ready for the prestigious Beijing Olympic Games due in August.

The event has an elaborate official Web site to disseminate essential information to the rest of the world, protecting it may be problematic. If cyber miscreants operate freely from China without any tight government control, there is a real danger to the mega event that depends so heavily on complicated computer systems.

Mounting Tibetan dissent in many parts of the world would especially require the most rigorous security standards here.

How well the systems can cope with possible attacks is a matter of conjecture.

The writer is a former CBI Director who is currently Adviser (Security) to TCS Ltd.

More Stories on : Security | Economic Offences | Security Musings

Article E-Mail :: Comment :: Syndication :: Printer Friendly Page

Stories in this Section
The language of business

Turn on SaaS

ERP — the common thread

.Net Framework installation

On the crime trail

Office@home

Quiz

Secrets of the X-teams