Speaker 1: Thinking Sideways is not brought you by the itch on
Speaker 1: my right leg. Instead, it's brought you by crime Con.
Speaker 1: That's right on June nine to June eleven at the
Speaker 1: j W. Marriott in Indianapolis. We're gonna be at crime
Speaker 1: Con along with a whole bunch of other podcasts and
Speaker 1: a whole bunch of other really cool crime investigators and reporters,
Speaker 1: people that you've been watching for years and you know
Speaker 1: you want to see, so you need to be there
Speaker 1: because it's gonna be cool. And as a special offer
Speaker 1: to our listeners, if you go to crime con dot
Speaker 1: com and enter the promo code sideways twenty, you'll get
Speaker 1: off your admission crime con dot com and sideways twenty
Speaker 1: Thinking Sideways. I'll group the ideas, I don't know, stories
Speaker 1: of things, we synthie don't know the answer tube. Hey guys,
Speaker 1: welcome to another episode of Thinking Sideways, the podcast I
Speaker 1: Am Devon, joined this week by Joe and Steve. This
Speaker 1: week Okay, special episodes, Special episode starring uh, Steve and Joe.
Speaker 1: I just want to know who the other two guys are,
Speaker 1: because really, he's spreading crumbs all over my chair. It's
Speaker 1: really annoying. From that ham sandwich, I think faster. I
Speaker 1: kind of suspect we're being transitioned out, dude. Yeah, well,
Speaker 1: hello retirement. This week we're going to talk about a
Speaker 1: mystery that's going to make half of you really happy
Speaker 1: and half of you turn off immediately. Um. And that's
Speaker 1: an internet mystery, because everybody loves a mystery that's in
Speaker 1: the tubes. I like them. I think they're super interesting.
Speaker 1: Some of our listeners like them, but it turns out
Speaker 1: a lot of our listeners hate them, and that's why
Speaker 1: we're like not top rated in true crime. But I
Speaker 1: should say this before you turn it off. There is
Speaker 1: a little international intrigue involved. There's some spice stuff going on,
Speaker 1: maybe German warfare, possible state actors involved or possibly not.
Speaker 1: You know it doesn't it does a computer virus counters
Speaker 1: term warfare? Yeah, I guess. I mean if Beatles do,
Speaker 1: I guess you know why not? Right? All right? This
Speaker 1: week we're going to talk about ghost net, which is
Speaker 1: also yousing wa in Chinese, but we're going to call
Speaker 1: it ghost net better not saying that a bunch of
Speaker 1: times ghost I like it. It sounds like a movie
Speaker 1: ready jump from the Lady at the top of the
Speaker 1: stairs that is only seen like once a year. Ghost
Speaker 1: kind of ghost, yes, kind of ghost. Fishing with a
Speaker 1: net failed bad joke, yes, pretty bad. All right, I'll
Speaker 1: get out of the way alright. In two thousand nine,
Speaker 1: researchers from the Universe, City of Toronto's Monk Center and
Speaker 1: the Cambridge University. From here on out, we're going to
Speaker 1: refer to them as the info Wars Monitor concluded a
Speaker 1: tenish month joint investigation that was requested by a representative
Speaker 1: of the o h Hdlice of Office of His Holiness
Speaker 1: the Dalai lama Um. And this this meeting took place,
Speaker 1: The request took place in Geneva, which is a safe
Speaker 1: space for for some people. The investigation under uncovered one
Speaker 1: of the most widespread hack hacks in history, perhaps the
Speaker 1: most widespread hack in history, certainly, I would say the
Speaker 1: most widespread hack that we're aware of. That that we're
Speaker 1: aware of, which means it was yeah, and that just
Speaker 1: means that it wasn't the best hack but computer and
Speaker 1: at least a hundred and three countries, yes you heard
Speaker 1: me right, one hundred and three countries were affected, and
Speaker 1: researchers think that it was almost individual hope. In general,
Speaker 1: it is believed that China was the perpetrator of this attack,
Speaker 1: but no one can be certain, and I have my doubts,
Speaker 1: which is why I thought this would be a good mystery.
Speaker 1: And these computers mostly belonged to embassies governmental ministries, and
Speaker 1: then almost all of the Dali Lama's exile centers were
Speaker 1: affected as well. And the thing is um. Even though
Speaker 1: ghost net was discovered as recently as two thousand eleven,
Speaker 1: at least one government UM Canada has uncovered an instance
Speaker 1: of ghost net, or the bug that is referred to
Speaker 1: as ghost net. UM. They discovered an instance of that
Speaker 1: and it was in the Canadian official Finance department. Was
Speaker 1: the was where the computer that was infected was discovered. UM.
Speaker 1: This is, of course, according to an anonymous source, because
Speaker 1: governments don't readily admit things like this, and the computer
Speaker 1: was probably a hand me down from the Foreign ministry. Yeah,
Speaker 1: probably are interested in the Canadian finances. I saw something about.
Speaker 1: It was like a year or so after all this
Speaker 1: got done, another one was found in India, and I
Speaker 1: think another onrustration in Iran. So I mean it's it
Speaker 1: keeps popping up. Yeah, despite the fact that and we'll
Speaker 1: talk about in a little bit, we're going to kind
Speaker 1: of delve into the wise and house of this um
Speaker 1: and we'll talk about how why it was so prevalent
Speaker 1: um and it's because it was a pretty dang good hack.
Speaker 1: So let's jump in to the first how we're gonna
Speaker 1: talk about tech. So we're going to talk about tech
Speaker 1: cool and it's gonna be a little boring. I'm sorry.
Speaker 1: I don't think it's boring, but I think a lot
Speaker 1: of people are gonna thinks I see lots of I
Speaker 1: see lots of joking, yoke opportunity in the title of
Speaker 1: this that is the sub end. Yeah, I think the
Speaker 1: work out well. So first we're going to talk about Trojans.
Speaker 1: And for those of you who don't know, trojans are
Speaker 1: giant horses that once roamed the land before shedding their
Speaker 1: physical form and evolving into an internet based life form.
Speaker 1: You left out the soldiers and sidde. Yeah, they reproduced
Speaker 1: by sending out math emails and hoping that some duddy
Speaker 1: dummy will download them, thus giving them access to anything
Speaker 1: that the computers attached to and becoming mini Trojan's. Yeah,
Speaker 1: that's how that works, right, that's what they are, not exactly.
Speaker 1: It's a cute description, but it's actually not the worst description.
Speaker 1: I will agree with that. So everybody knows, you know,
Speaker 1: what a trojan horses, right, I would hope. And so
Speaker 1: basically this is just a trojan. Virus is a delivery system,
Speaker 1: so that it's it's like a little hitt now like
Speaker 1: the horse, you know, you know, you let it into
Speaker 1: your city and then you just go to bed and
Speaker 1: then overnight it's bits how some soldiers you know, kind
Speaker 1: of like that. It's computer. It's bits out a little
Speaker 1: line of code that builds itself like a virus. And
Speaker 1: so this can be this can install trojans can install
Speaker 1: anything from like small bits of spyware, two key logging tech,
Speaker 1: two bugs that will totally completely take over your computer.
Speaker 1: And in our case, the trojan known as ghost rat
Speaker 1: and yes that is a zero instead of an oh.
Speaker 1: Ghost rat and the ghost Rat allowed hackers to gain
Speaker 1: total and real time control of any computer running Windows.
Speaker 1: It only infected Windows computers, which is you know, was
Speaker 1: one of the original selling points of max is that
Speaker 1: they don't get infected. But that's unfortunately, Yeah, ghost Rat
Speaker 1: could even utilize UM computers as surveillance machines by clandestinely
Speaker 1: turning on the audio recorders and the cameras and camera. Yeah. Well,
Speaker 1: and they could record both of those things, you know,
Speaker 1: remotely or whatever. But basically, yeah, they would just turn
Speaker 1: on the camera and the mic and be able to
Speaker 1: totally surveil a room, any room that the computer is in. UM.
Speaker 1: And that's one of the origins of you know, people
Speaker 1: like me, even though I have MAC put little pieces
Speaker 1: of tape over their camera because you can turn the
Speaker 1: camera on without the little light showing that the cameras
Speaker 1: on being on, and then somebody surveilling you. If you
Speaker 1: watch the TV show Black Mirror, season three, episode three
Speaker 1: goes right down exactly what you're talking about in terms
Speaker 1: of gathering information and using it against people. I was
Speaker 1: going to say that if you watched Mr Robot, it's
Speaker 1: like the first freaking episode has an instance of this,
Speaker 1: and in that case, that hacker was gathering surveillance information
Speaker 1: to blackmail people like they were gathering out with pictures
Speaker 1: or somebody from blackmail somebody. UM. But there are obviously
Speaker 1: larger implications and uses for surveying just survey. Yeah, that's
Speaker 1: what there's one of the new smart TVs that has
Speaker 1: you know, you can talk to it, Panasonic whatever do this,
Speaker 1: and people have figured out how to hack those so
Speaker 1: that they're just it's a it's a listening device. So
Speaker 1: that was one of the things with connects to because
Speaker 1: they's always recording. I don't want to think about I
Speaker 1: just can't wait for this in the future courtroom drama
Speaker 1: where Alexis brought in as a witness. Absolutely didn't just happen, ye,
Speaker 1: did it? Apple? Well? Yeah, no, Actually I'm talking about
Speaker 1: Alexa actually sitting in the witness box, you know. But
Speaker 1: I think I but this kind of stuff, you know,
Speaker 1: we have we've all heard of the Internet of things.
Speaker 1: You get you connect your fridge and your TV and
Speaker 1: your microwave and your toaster to the Internet, and then
Speaker 1: you can control it from your smartphone. And it turns
Speaker 1: out that's a really bad thing because this security and
Speaker 1: the encryption on those devices turns out it's really really
Speaker 1: bad because initially everybody was like, who's gonna hack your fridge?
Speaker 1: Except we've seen those instances where there's the nanny cam
Speaker 1: and the teddy Bear that you can use your smartphone
Speaker 1: with and then somebody walks in the room and the
Speaker 1: bear is talking and rush into the baby. I mean,
Speaker 1: like it's totally a thing because they just seemed so innocuous,
Speaker 1: these little devices. I'm not a big believer in the
Speaker 1: Internet of Things personally. Oh no, Internet of things is dumb. Yeah,
Speaker 1: I disagree. I like the Internet of Things. I think
Speaker 1: that there's some improvements that can be made, certainly, but
Speaker 1: I think that that's just part of you know, new
Speaker 1: way of technology implementation. But but just another fun thing
Speaker 1: in the news. It was in a just a week
Speaker 1: or two ago, the cops bust to the guy with
Speaker 1: the pacemaker because he was making his big alibi was
Speaker 1: there was a fire and he was like, you know,
Speaker 1: like struggling to escape from the fire or something. I
Speaker 1: can't remember exactly what it was, but they managed to
Speaker 1: download download information from his pacemaker, the pacemaker's record. The
Speaker 1: pacemaker basically said, no, this guy's heart wasn't beating fast
Speaker 1: at all. Oh my god, and yeah he was busted
Speaker 1: and crazy. Yeah. So yeah, all these digital devices there,
Speaker 1: they're recording the crap out of your life. Yeah. Okay,
Speaker 1: So anyway, long story short, that's why you should put
Speaker 1: tape over your camera and don't say anything sensed eve
Speaker 1: around your computer because it's listening all the time. I
Speaker 1: don't have mine on. My camera's always exposed. I say
Speaker 1: all kinds of things to my computer. I know. And
Speaker 1: that's why people secretly have pictures of us. They have
Speaker 1: even better pictures to Steve so ghost rat back to
Speaker 1: the story, was a specific kind of trojan, and it
Speaker 1: is most often referred to as an APT or an
Speaker 1: advanced persistent threat. Often trojans will be sent out just
Speaker 1: kind of you know, like those emails from Thenigerian Prince
Speaker 1: just just yeah, really, just as many people as they
Speaker 1: can possibly send them to on the hope that a
Speaker 1: couple of people will be real dumb and infect their
Speaker 1: computer and then they go for heavy payload real quick,
Speaker 1: and then um they get eradicated from the computer. But
Speaker 1: the hackers already have what they wanted. Oftentimes, as we
Speaker 1: were talking about with you know, trying to get information
Speaker 1: that you could blackmail somebody with, or you know, any
Speaker 1: financial records or just passwords or things like that. UM
Speaker 1: apt s, however, are pretty much the opposite of that.
Speaker 1: Um They're usually targeted at one organization, be it a
Speaker 1: corporation or government or ministry or something like that, and
Speaker 1: they usually have inside intel on how to get into
Speaker 1: the system. Pretty frequently apt s are executed with um
Speaker 1: like old school espionage skills, stick in a USB, stick
Speaker 1: in a computer, well, more like social engineering to get
Speaker 1: to the point where that guy can stick that USB
Speaker 1: stick in to a computer or even you know, so
Speaker 1: that they know social engineering. You mean what Okay, so
Speaker 1: social engineering is a term that generally refers to the
Speaker 1: old school manipulation of people. Yeah, basically, yeah, but I
Speaker 1: know what social engineering used to be called. But in
Speaker 1: like special social engineering you're talking about, Actually it's still
Speaker 1: the same thing, okay, Yeah, where you know, you try
Speaker 1: you convince people to do things that they shouldn't necessarily
Speaker 1: do by talking to them in person. I mean, you know,
Speaker 1: it's similar to you know, you can call somebody and
Speaker 1: and start a conversation with them and get information out
Speaker 1: of them by pretending like you know what you're talking about.
Speaker 1: You know, little things like that, Or you can dress
Speaker 1: up like a janitor and pretend like you're supposed to
Speaker 1: be in that corporate office and walk around and nine
Speaker 1: times that attend, nobody's going to be like, hey, excuse me,
Speaker 1: you're not the weal, guy, what are you doing here?
Speaker 1: They're just going to ignore you, and you're going to
Speaker 1: get away with doing a lot of research or intel
Speaker 1: work or you know again sticking a USB in a
Speaker 1: place that doesn't exist or it shouldn't exist. I mean,
Speaker 1: and this is the other thing, right, is that let's
Speaker 1: a lot of places say you should never put like
Speaker 1: a used to b C d s or floppy disks
Speaker 1: or anything like that that you don't know what it's
Speaker 1: on it, don't put it in your computer because that
Speaker 1: used to be a pretty standard delivery system for these
Speaker 1: little bugs, because it would just install into your computer
Speaker 1: and then all of a sudden, you've infected every People
Speaker 1: would go to Starbucks and leave a flash drive and
Speaker 1: some somebody would like, oh, who's flash dry? I don't know, Well,
Speaker 1: let's see what's on it. Maybe I can find out
Speaker 1: who belongs to. So they did a study of some
Speaker 1: university recently where they left a bunch of the flash
Speaker 1: drives just laying around campus and uh and if you downloaded,
Speaker 1: you've got instructions on just bring it back to this department.
Speaker 1: They found that like half the people that pick these
Speaker 1: things up stuck them into their computers. Yeah, yeah, unbelievable. Yeah. Well,
Speaker 1: and that's where the kind of social engineering thing can
Speaker 1: can come in handy rate is if you call if
Speaker 1: you have a target, a high value target, you know, right,
Speaker 1: is like the CEO of a company who has proven
Speaker 1: to be maybe not as tech savvy as they should be,
Speaker 1: and you know, yeah CEO of Sideways Co. And you
Speaker 1: want to somehow infect that person's computer. Well, you can
Speaker 1: go through the arduous process of trying to figure out
Speaker 1: if there's a backdoor exploit tech wise where you can
Speaker 1: you know, get into the pack of the mainframe, you know,
Speaker 1: blah blah blah, or or even easier, right, you can
Speaker 1: call his secretary and say, I am supposed to be
Speaker 1: in this meeting with him. I'm so sorry, Or my
Speaker 1: supervisor is supposed to be in my meet in this
Speaker 1: meeting with your CEO and he's running late, and I
Speaker 1: just need to know, like where they're meeting, please can
Speaker 1: you tell me? And the secretary will take pity on
Speaker 1: you if you tried enough times, and you'll and she'll say, oh,
Speaker 1: they're meeting at the Starbucks. You'll go leave a flash
Speaker 1: drive where he's going to find it, and and that's
Speaker 1: like an old school kind of social engineering technique, right
Speaker 1: where you you make somebody give pity on you and
Speaker 1: there you go. But yeah, or you can send a
Speaker 1: phishing email, which is what we're going to talk about
Speaker 1: a little bit. So all of that to say that
Speaker 1: that's one way that um A pt s are delivered
Speaker 1: is by social engineering, and the other way is by
Speaker 1: spending a lot of money or manpower to expose those
Speaker 1: backdoor vulnerabilities that exist in all systems, and not necessarily backdoor,
Speaker 1: but vulnerabilities that exist in like every single system. There's
Speaker 1: always some way that a system is a little messed up.
Speaker 1: It's not cheap route typically because on the dark web
Speaker 1: you can buy a lot of different bits of script
Speaker 1: and code or full on assault packages for systems, but
Speaker 1: that's not a cheap endeavor. Yeah, it sounds like from
Speaker 1: the research that I have been doing just around this project,
Speaker 1: not for my own anything, don't worry. Um it sounds
Speaker 1: like there are a lot of people who make a
Speaker 1: lot of money basically make their living on finding these
Speaker 1: exploits and not exploiting them and just putting it out
Speaker 1: there on forums and saying, hey guys, just you know,
Speaker 1: I have a way to get into this goes to
Speaker 1: the highest bidder and letting a bidding war happen, and
Speaker 1: then you know, eventually somebody will say, I will give
Speaker 1: you three million dollars for that one thing. And the
Speaker 1: zero vulnerabilities. Yeah, zero dave vulnerabilities is the technical term
Speaker 1: that I've been avoiding because I don't I don't know,
Speaker 1: because I don't know how many people are going to
Speaker 1: know it. Um And yeah, it's it's a lot of
Speaker 1: manpower or a lot of money to go that route.
Speaker 1: It's much easier just call somebody secretarian you know, and
Speaker 1: fishing you know. Um. So yeah, the all of that
Speaker 1: to say again that a p t S are typically
Speaker 1: very well financed. It is a long term investment because
Speaker 1: the goal is to surveil for a very long amount
Speaker 1: of time. It's not to it's it's really quantity and
Speaker 1: quality over just like sheer volume extracting volume. All I mean,
Speaker 1: correct me if I'm wrong. This is the way I
Speaker 1: understood a pt S, and tell me if I'm wrong.
Speaker 1: Here is I looked at it is is there's two
Speaker 1: types of ways to to rob a bank. There's the
Speaker 1: smash and grab, where you go in you grab as
Speaker 1: much as you can, and you run and whatever you get,
Speaker 1: you get or your bank employee, and you just start
Speaker 1: funneling funds and embezzling a thousand dollars a day and
Speaker 1: do it for as long as you can, because chances
Speaker 1: are you're not going to get noticed and you're gonna
Speaker 1: get more long term, I would I would add it's
Speaker 1: more like it's a subtler approach. It's more like somebody
Speaker 1: getting a job out of bank to funnel five bucks
Speaker 1: a day. Yeah, I mean a little tiny amount. I
Speaker 1: mean like even just like dropping a roll of coins
Speaker 1: into your purse every day for six or seven years
Speaker 1: before you get caught, and then obviously like not spending
Speaker 1: any money. So by the end of your process, you
Speaker 1: you have a ton of money. You have a huge
Speaker 1: value there. So that that's a really good analogy. Yeah, okay,
Speaker 1: you have to have a lot of coins to make
Speaker 1: it worth it. Remember all the quarters is ten bucks. Yeah,
Speaker 1: so ten bucks a day for seven years, eight years,
Speaker 1: that's what three thousand dollars a year as auxiliary income.
Speaker 1: I don't know, that's like three thousand bucks a months, right,
Speaker 1: My math skills are hideous six a year, Yeah, that's right. Right,
Speaker 1: because ten all a day. Okay, never mind, that's more
Speaker 1: than I thought. Yeah, okay, it was like it's only
Speaker 1: three grand years. That's yeah. Yeah, it's not enough to
Speaker 1: retire it. It's not nothing, especially as auxiliary income. Right. Yeah,
Speaker 1: So this is kind of vague, and we've kind of
Speaker 1: like gone in a bunch of different directions. But that's
Speaker 1: because a pt s are pretty vague in nature, and
Speaker 1: the way that they're deployed is oftentimes very different. Again,
Speaker 1: because you don't want to be detected. Well let's say, yeah,
Speaker 1: it's like an espionage you know, it's like you don't
Speaker 1: want to protect your sources. You don't want people to
Speaker 1: know that they've actually been penetrated. So you know, you
Speaker 1: don't just when you get something and you get some information,
Speaker 1: you don't just run out and act on it because
Speaker 1: it tells the other side that, well, compromise. And I
Speaker 1: would encourage our listeners to remember the thing that Joe
Speaker 1: just said when we get into theories. That occurred to
Speaker 1: me too, because I've read ahead a little bit too. Yeah,
Speaker 1: that's good. I'm glad that you've read. Um. So, there
Speaker 1: is a fifty three page report that was put out
Speaker 1: by INFO War Monitor by Professor Ron Deep who's the
Speaker 1: director at the Citizen Lab at the Monk Center for
Speaker 1: International Studies at the University of Toronto, and Raffael Rojozinski,
Speaker 1: I think, who's the principal and CEO at the SECTV Group.
Speaker 1: I read all fifty three pages of this and let
Speaker 1: me tell you, it was not easy reading. Read myself
Speaker 1: good and I really deeply encourage if this is a
Speaker 1: mystery that grabs you, you should read this whole report
Speaker 1: because it's really interesting. But if you are just enjoying
Speaker 1: listening to the sound of my voice, don't. I wouldn't
Speaker 1: encourage you to read it. We will link it on
Speaker 1: the website. I just played this episode over and over
Speaker 1: and over again. Yeah. Um, so the next little bit
Speaker 1: here we're gonna do is basically like a too long
Speaker 1: didn't read of the fifty three pages of the report,
Speaker 1: because I think it's important that we talked about the
Speaker 1: report and the investigation that happened. The investigation took place
Speaker 1: in two parts. One the first part from June to
Speaker 1: November in two thousand eight, um, and then the second
Speaker 1: part was December two thousand eight to March two thousand nine,
Speaker 1: and again as I mentioned the whole you know, pushed
Speaker 1: to do this was because there was a request from
Speaker 1: the Office of His Holiness the Dalai Lama. And yes,
Speaker 1: I am going to say that every single time. I
Speaker 1: read it that way in my head every time. So
Speaker 1: I'm glad you gonna keep doing two the other way.
Speaker 1: Uh So June to November two tho. The first part
Speaker 1: was an on site investigation in which investigators took time
Speaker 1: to figure out what the typical computer and infosecurity practices
Speaker 1: looked like at the organizations that were infected or that
Speaker 1: they thought were infected. At this point, they didn't really
Speaker 1: know how many were well, they didn't know what they
Speaker 1: were dealing They didn't really know what they were dealing with,
Speaker 1: but they were trying to identify. Is they're a good
Speaker 1: password protocol. Is it possible that somebody just guessed on
Speaker 1: passwords right that got this information? Is there a different
Speaker 1: way that this information could be leaking? Is somebody inside
Speaker 1: the office? Yeah? Or even you know, just things like
Speaker 1: did somebody lose a computer and I didn't want to
Speaker 1: admit it, or you know, are you guys not shredding
Speaker 1: your sensitive document? You know, really just and suspicious things
Speaker 1: were happening to. Yeah, the organization itself in terms of
Speaker 1: reactions and preemptive reactions and stuff. Yeah, we're gonna talk
Speaker 1: about that in a second, but them to ask for
Speaker 1: the help. Yeah. But basically what the investigators or researchers
Speaker 1: were trying to do at the get go was what
Speaker 1: they used to do on ghost Hunters, right where when
Speaker 1: they would like film something suspicious and they'd be like,
Speaker 1: all right, how can we recreate this with like normal environments?
Speaker 1: And then when they couldn't, they said, okay, there's a
Speaker 1: ghost here. Or in our case, when they couldn't account for,
Speaker 1: you know, the leaks that were happening, they said, computer okay,
Speaker 1: it was the computer. Okay, something is wrong with your computers.
Speaker 1: This part of the investigation was again primarily carried out
Speaker 1: in the Tibetan government in exile, so at the office
Speaker 1: of His Holiness the Dali lama Um. Since he hadn't
Speaker 1: requested the investigation or his office had requested the investigation,
Speaker 1: they were pretty sure that there was something going on there.
Speaker 1: From their investigators designed their investigation this post November December.
Speaker 1: They did intense on site interviews again to see if
Speaker 1: there were any other reasons for leaks? Did you use
Speaker 1: your computer to just tell us you probably look at
Speaker 1: people's bank accounts? Probably did they take a close look
Speaker 1: at the d L himself. That's what I'm wondering. What
Speaker 1: was Yeah maybe, yeah, I somehow suspect not but maybe
Speaker 1: interrogation so um okay. And then also from December two
Speaker 1: eight till March two nine, investigators analyze the information that
Speaker 1: had been gathered in the first phase UM and they
Speaker 1: found some interesting stuff. Again, I'm not going to go
Speaker 1: into great detail because I don't feel like I need
Speaker 1: to talk for another hour, but I will say you
Speaker 1: should read the report. It's all in there. Basically, they
Speaker 1: were able to curate a list of systems that were
Speaker 1: infected and with the with with ghost rapt and UH,
Speaker 1: they were trying to see if they could figure out
Speaker 1: who was perpetuating the attack. They were able to find
Speaker 1: out that seventy of the servers from which the attack
Speaker 1: was being sent were hosted in China. However, yeah, that
Speaker 1: sounds right mostly, but yeah, primarily the China servers were
Speaker 1: in chained, do I Primarily That doesn't necessarily mean that
Speaker 1: China was involved or the government of China was involved.
Speaker 1: Because you know, servers in like South Carolina were also
Speaker 1: involved um as well as Sweden, South Korea, and Taiwan.
Speaker 1: Most of these servers were set up on what's called
Speaker 1: a dynamic domain name system, which is dynamic DNS or
Speaker 1: d d NS C d n S, which Joe is
Speaker 1: going to talk about a little bit so that you
Speaker 1: can drink some water given to give devon or break
Speaker 1: here and yeah, not much to talk about really, it's
Speaker 1: really simple. I mean the main name services where there's
Speaker 1: you got the name of your website dub dub dub
Speaker 1: Devin dot com. But then you've got the actual IP address,
Speaker 1: which is some numbers with dots in between them, usually
Speaker 1: like three and then three and three and then three
Speaker 1: two yeah or two or whatever. But yeah, and then
Speaker 1: but since i P addresses are not necessarily permanent, it
Speaker 1: used to be in the old days, it was kind
Speaker 1: of a manually updated system, and then they had to
Speaker 1: go something a little more automated. And now you've got
Speaker 1: this system that's really flexible called dynamic don domain name services,
Speaker 1: where uh so you plug a device into your network
Speaker 1: at home and that's connected to your router so that
Speaker 1: that device, like say it's a webcam is going to
Speaker 1: have an IP address, right, and so well what do
Speaker 1: you do? You got to set it up and you
Speaker 1: know and like send an email to the Domain Name
Speaker 1: Service guys and say, hey, would you recognize my IP
Speaker 1: camera and sign it a name or an IP address?
Speaker 1: Not not the way it works anymore. So now your
Speaker 1: device gets in there, you've got software and your router
Speaker 1: that sends out a ping and that gets and then
Speaker 1: gets back from a remote server it's IP address, a
Speaker 1: new IP address, and then your software sends out an
Speaker 1: update to a DNS server that updates. They're essentially their catalog,
Speaker 1: their directory that's got said Devin dot com. And then
Speaker 1: it's got you know this, that's got this IP address
Speaker 1: next to it. That's your new IP address them and
Speaker 1: I presumably if you I guess, if you reboot that thing,
Speaker 1: you might wind up with a new IP address. And
Speaker 1: then so it's time for that thing to send out
Speaker 1: a new update to the DNS server again. And so
Speaker 1: there's a lot of that going on right now, a
Speaker 1: lot of updates being sent to these these dynamics, the
Speaker 1: DNS services. So essentially the i p s are not
Speaker 1: nearly as permanent as they were say ten years ago.
Speaker 1: Would that be a correct a correct interpretation of that. Yeah,
Speaker 1: although there are some you know, I mean, if you
Speaker 1: want to, like you know, IBM S website, I'm pretty
Speaker 1: much going to change pretty much that. I'm sure that's
Speaker 1: pretty permanent. Yeah, but for a lot of us who
Speaker 1: are always you know, getting new devices, changing providers maybe
Speaker 1: or getting new devices and things and adding on devices
Speaker 1: and stuff, then yeah, they're just constantly being updated. That way.
Speaker 1: It makes it a lot more flexible and fast. So
Speaker 1: that that that explains something that we've experienced internally, which
Speaker 1: is one of us will get a new phone or
Speaker 1: we'll update the OS on our phone, and internally we
Speaker 1: have an l system that will alert us when somebody
Speaker 1: knew is there, and that's that's the kind of thing.
Speaker 1: And if anybody does that, you get that kind of notification.
Speaker 1: It sounds like, if I'm understanding correctly, it's that very
Speaker 1: simple to us. Now, very simple process is just simply
Speaker 1: that d d S. Yeah, And of course there's a
Speaker 1: reason you get that that notification is because d DNS
Speaker 1: has been abused a lot, you know, by hackers and
Speaker 1: such and so and so. Even though it's a great
Speaker 1: thing it's very convenient, handy. It can be used to
Speaker 1: like cover your tracks, for example, and then redirect people
Speaker 1: to a server they don't even know that they're going to.
Speaker 1: And so yeah, it's a it can be used for
Speaker 1: sneaky purposes even though it's a very handy tool. And
Speaker 1: so that is why it is suspicious that all of
Speaker 1: these servers were d D and asked particularly what ten
Speaker 1: years ago relatively new um, But it's not necessarily suspicious.
Speaker 1: That makes sense. Yeah, and to me, yeah, now finally,
Speaker 1: and the main target for this heck does seem to
Speaker 1: be the office of His holiness, the Dali lama Um.
Speaker 1: This is his personal office location. Well, there are a
Speaker 1: government in exile, but it's not his governmental office. It's
Speaker 1: his personal office, like the person who says, like, here's
Speaker 1: your coffee, Do you need me to go buy you
Speaker 1: new underwear? Like whatever? I mean. It's not like there's
Speaker 1: huge secrets following through his home office. And that's probably
Speaker 1: some interesting conversations going on in there there maybe, but
Speaker 1: the payload would be much more if they were to
Speaker 1: go through like the government or the government extile office
Speaker 1: for instance, But we don't know that necessarily, and they're
Speaker 1: not also doing that, I would think they would be.
Speaker 1: So we are. We're getting ahead of ourselves in terms
Speaker 1: of where else could it be. But yeah, exactly, so, yeah,
Speaker 1: we'll get there and serious, I guess, And I think
Speaker 1: that's really the right place to talk about that. UM,
Speaker 1: So let's talk about the social engineering component of this.
Speaker 1: It turns out this is not actually the first investigation
Speaker 1: that info War Monitor, or at least people associated with
Speaker 1: the Infowar Monitor UM had aided with. In regards to
Speaker 1: the Office of His Holiness the Dalai Lama. In September
Speaker 1: of two thousand two, Tibetan groups said that they were
Speaker 1: targets of malware UM from China. They specified it was
Speaker 1: from China. They said there was an attempt to spare
Speaker 1: on their networks and otherwise disrupt their work, and they
Speaker 1: were pretty much just brushed off. There wasn't like a
Speaker 1: very intense investigation. And then in two thousand five, one
Speaker 1: of the people who was deeply involved in the two
Speaker 1: thousand eight nine investigation team decided to start archiving malware,
Speaker 1: specifically specifically the malware attacks on the Tibetan organizations and
Speaker 1: try to UM kind of assess their pay load like
Speaker 1: what these malicious attacks were getting, so that actually was
Speaker 1: very helpful in kind of tracking what might be new
Speaker 1: and what what kind of things were happening UM and
Speaker 1: how people were gaining access to the Office of His
Speaker 1: Holiness the Dalai Lama. In early two thousand and eight
Speaker 1: during the Beijing Olympics, this researcher that we were just
Speaker 1: talking about was able to gain access to a control
Speaker 1: server and then trace to the Office of His Holiness
Speaker 1: the Dali Llama through the control server of the malware UM.
Speaker 1: And like, just to clarify because people may not understand,
Speaker 1: the control server is the server that the trojan, horse, virus, malware,
Speaker 1: whatever we want to call it in the computer that's
Speaker 1: infected is reporting to it's that's the control servers and
Speaker 1: what it's squirting data too, Is that right? Yeah? Or
Speaker 1: is the one that's controlling or making it, you know,
Speaker 1: dance a fancy jig if that's what they tell it
Speaker 1: to do. Basically, I don't think it necessarily scores. It's
Speaker 1: if it's sending data out and they can sent it
Speaker 1: to anywhere really all kinds of other places, but it's
Speaker 1: the one that's telling it where to score the datah. Yeah,
Speaker 1: it's just giving it orders yet. Okay, yes, so it's
Speaker 1: the captain of this silly little robotic ship that we're on. Yeah,
Speaker 1: and that's assuming that it really is a control server
Speaker 1: and not some innocent computer that's been hijacked temporarily. Yeah,
Speaker 1: that's so complicated trying to figure out these Internet things.
Speaker 1: It is, it really is. UM. And so from this
Speaker 1: historic kind of archiving of attacks and and successful malware
Speaker 1: installations in you know, in the Tibetan government, Um, the
Speaker 1: investigators were able to ascertain that the trojan emails that
Speaker 1: were being sent out because that that was the chosen
Speaker 1: method of getting malware onto computers for his the office
Speaker 1: of His Holiness, the Dalai Lama. And they were getting
Speaker 1: more and more sophisticated. You know. They started out by
Speaker 1: being like, hey, open this attachment and then came to
Speaker 1: this thing that I have a screenshot of here, um,
Speaker 1: which was how ghost rat came. It was one of
Speaker 1: the emails that came ghost rat. So it came from
Speaker 1: quote unquote campaigns at free Tibet dot com, which is
Speaker 1: an actual email address that was actually like utilized for
Speaker 1: free Tibet, which would have actually had contact with people
Speaker 1: in the Office of His Holiness the Dalai Lama. So
Speaker 1: I mean, like, by all intents and purposes, totally legit, right,
Speaker 1: it would have been almost impossible to tell that it
Speaker 1: wasn't from this actual campaign. And I say all of
Speaker 1: this to say that it's totally reasonable that they got
Speaker 1: infected because it was just like it would have been
Speaker 1: impossible to tell. In fact, only eleven of thirty four
Speaker 1: tested malware and anti virus softwares were able to detect
Speaker 1: ghost rat. It was that deeply embedded in the little
Speaker 1: as a trojan that I mean even most of the
Speaker 1: software able to detect it or designed to detect it
Speaker 1: were they were unable to do that, which is crazy.
Speaker 1: It was it was sophisticated enough. It's super sophisticated. It
Speaker 1: was a clever little rat. You know, rats are good
Speaker 1: at hiding a little crevices, they are. Yeah. So this email, um,
Speaker 1: I just put in here so we can look at
Speaker 1: I'm just going to quickly describe this email just so
Speaker 1: for you guys to be able to kind of visualize
Speaker 1: what it would have looked like. It says it's from
Speaker 1: campaigns at freed to bet dot org, not calm sorry. Um.
Speaker 1: The subject is translation of Freedom Moment Movement I D
Speaker 1: Book for Tibetans and Exile. And then it has basically
Speaker 1: what is a format for a letter that's in the body,
Speaker 1: and then it says attachment it's the same thing dot doc,
Speaker 1: which would lead one to believe that, you know, here's
Speaker 1: here's our English translation of this resource for you to
Speaker 1: be using as a template. Right, here's what it looks
Speaker 1: like in the body, and attached is a document that
Speaker 1: you can edit because it's got places where you would
Speaker 1: need to say, like this my name not you know,
Speaker 1: insert your name here. Right. That's I mean, that's a
Speaker 1: pretty high level of sophistication. I would fall for it,
Speaker 1: to be totally honest with you, So, I mean, yeah,
Speaker 1: I would fall for this, and I think you guys
Speaker 1: probably would. If I actually read by emails, I would yeah,
Speaker 1: And I know you don't, ye. So, um, you guys
Speaker 1: ready for theories? I am cool. Well, we'll talk about
Speaker 1: theories in a minute. It's everybody's favorite thing to hear
Speaker 1: me say. Um. First, let's take a quick break. Add
Speaker 1: that brown thing and the yellow thing. Now, put in
Speaker 1: the squishy red thing, pour in the smelly white liquid,
Speaker 1: stand there and wait for a bit. Now quickly cut
Speaker 1: up the orange thing, another brown thing, and the sticky
Speaker 1: green thing and the other green thing, and mess them
Speaker 1: all together until they're unrecognizable. Oh and purry back over there,
Speaker 1: because you're a red thing is smoking, which isn't a
Speaker 1: good sign. Now take it all and dump it into
Speaker 1: a pan and push it into the oven. Whatever you do,
Speaker 1: don't forget to set the timer this time. Remember how
Speaker 1: much smoke there was in the house last time you forgot.
Speaker 1: And when the timer goes off, pull it out and
Speaker 1: toss it onto the plates. When asked what it is,
Speaker 1: just mumble a couple of syllables. When asked what that is,
Speaker 1: just say French. Is this how it feels when you
Speaker 1: try to make a meal from scratch? Well it doesn't
Speaker 1: have to not. All ingredients are created equal, and thankfully,
Speaker 1: for less than ten dollars a meal. Blue Apron delivers
Speaker 1: delicious quality food courtesy of over a hundred and fifty
Speaker 1: local farms, fisheries, and ranchers across the United States, right
Speaker 1: to your door. It's no wonder why they are the
Speaker 1: number one fresh ingredient and recipe delivery service in the country.
Speaker 1: Some of the meals available in April, which I had
Speaker 1: and it was fantastic. Was the parmesan crusted chicken and
Speaker 1: creamy fettuccini and roasted broccoli. Okay, well I don't actually
Speaker 1: like broccoli, so I didn't eat that part, but the
Speaker 1: rest of it was great. So check out this week's
Speaker 1: menu and get your first three meals free with free
Speaker 1: shipping by going to blue Apron dot com slash thinking.
Speaker 1: You'll love how it good, it feels and taste to
Speaker 1: create incredible home cooked meals with Blue Apron. So don't wait,
Speaker 1: that's blue Apron dot com slash thinking Blue Apron a
Speaker 1: better way to cook. So you stop burning things and
Speaker 1: we're back. Hi, I'm not looking for that sandwich anymore. Yeah,
Speaker 1: that other guy ate it now that I know that
Speaker 1: dive ate it hat. That guy the worst TV is
Speaker 1: the worst. He's right up there with oh such a
Speaker 1: thing as new sandwiches do? I think it might be
Speaker 1: time to move on. Um, So we're gonna do typical
Speaker 1: Devon fashion. Right, We've got two headings. One is China
Speaker 1: and one is not China. So let's talk about China first.
Speaker 1: As in, you mean China is responsible, that's what you
Speaker 1: mean by China responsible or China not responsible. I just
Speaker 1: want to talk about China. Well, okay, let's talk about
Speaker 1: the end. Let's talk about the history of China. Yeah. Actually,
Speaker 1: let's talk about the history of China a little bit,
Speaker 1: because we don't give us a lot of Actually, well,
Speaker 1: it is actually a little pertinent to this case, and
Speaker 1: that I mean, I'm hoping I guess at least that
Speaker 1: most of you would already know why China might be
Speaker 1: responsible for an attack of malicious nature on the exile
Speaker 1: government of Tibet or the office of His Holiness the
Speaker 1: Dali Lama. But if you don't, let me educate you
Speaker 1: a little bit. Well, there's sticks, Yeah, there's the there's
Speaker 1: bumper stickers, so that's a bigger and there's the flags,
Speaker 1: which I've seen all over town. Yeah, so that they
Speaker 1: don Yeah, they're doing it. They're totally working, really working
Speaker 1: really well. No, Okay, So Tibet and China have been
Speaker 1: fighting pretty much since like um ever, thirteen sixty eight
Speaker 1: I think is the date. So it's generally accepted that
Speaker 1: prior to thirteen sixty eight, Tibet and China were two
Speaker 1: different places. And then it's also generally accepted that since
Speaker 1: nineteen fifty nine with um will help from the CIA
Speaker 1: and stuff that became a part of the People's Republic
Speaker 1: of China. Yeah. Yeah, there's a huge debate that happens
Speaker 1: around this. I would say it's similar to the debate
Speaker 1: around the whole Palestine and Israel thing, but generally less bloody. Yeah, exactly,
Speaker 1: because monks are much less likely to throw bombs accurate, Yes,
Speaker 1: I mean correct, Yeah, it resistance through peace, yeah yeah,
Speaker 1: but yeah, but essentially, yeah, the Chinese want that wanted
Speaker 1: basically to run the place, and so they've been colonizing
Speaker 1: and moving their population and kind of suppressing the native
Speaker 1: culture of that. Yeah, that's that's not like colonialism at all,
Speaker 1: not at all. So the Dali Lama is pretty central
Speaker 1: to this, as he is functionally the leader of Tibet.
Speaker 1: I think we're on our Dali Lama. I'm sorry, I
Speaker 1: don't think we are as of today's recording. As of
Speaker 1: today's recording, well, and if and if our current fourteenth
Speaker 1: Doali Lama is to believe believed, he will probably be
Speaker 1: the last. But more on that another time. Um. But
Speaker 1: you know, the government is in exile and they are
Speaker 1: not recognized as a government by pretty much any government. Yeah. Uh.
Speaker 1: And so there's this kind of although it's kind of
Speaker 1: a David and Goliath thing, right, I mean, there's this
Speaker 1: giant China who's saying, no, Tibet, you're part of us,
Speaker 1: and then literally the rest of their world is saying no, no, Tibet,
Speaker 1: you're part of China, and Tibet's like but no. And
Speaker 1: so somehow China should be responsible for this attack on
Speaker 1: this tiny little thing. That is kind of I mean,
Speaker 1: there's yeah, so I guess that's that's the reason why,
Speaker 1: although I don't I don't really buy into that, but
Speaker 1: I know that, you know, the Chinese, for example, the
Speaker 1: whole Taiwan is has been going on for many decades,
Speaker 1: and really, when you think about it, why the hell
Speaker 1: shouldn't the Taiwan ease go their own way? I know
Speaker 1: they claimed to be China too, but you know, what
Speaker 1: the hell they want to They want to live on
Speaker 1: their island and then have their gig. Why the hell not.
Speaker 1: But for some reason, the mainland's very touchy about it,
Speaker 1: you know. I mean, I but I agree the same
Speaker 1: with Tbet, but I mean politics aside, it's kind of
Speaker 1: it's odd to me that somebody would say, there's this
Speaker 1: giant country that has functionally one debate, right, there is
Speaker 1: functionally no debate on whether Tibet is its own thing
Speaker 1: or not. And yet they are still thinking, Oh, you
Speaker 1: know what would be fun, Let's infect all of these
Speaker 1: computers all around the globe just to like see what's
Speaker 1: going on. I I don't know. So basically powerless organization.
Speaker 1: Basically it's they're they're going after what is essentially somebody
Speaker 1: who has no pull anymore. Well, there's some religious pull,
Speaker 1: but governmental politically, there's very little. I do actually think
Speaker 1: that the Chinese are keeping an eye on in the
Speaker 1: dollar Lama and the government nextile China's paranoid. But so
Speaker 1: let's talk about some of the evidence that people present
Speaker 1: to support that China was in charge of these are
Speaker 1: responsible for these attacks. By the way, I just realized
Speaker 1: this entire episode is going to get us banned in China.
Speaker 1: Oh sorry, Chinese listeners, Dan, I already bought my Yeah,
Speaker 1: I can't do my I can't do my episode about
Speaker 1: the Fallen Gong anymore. So, uh, China, it turns out
Speaker 1: actually acted on some information that was most likely gathered
Speaker 1: from ghost Rat. The Office of his holiness, the Dalai
Speaker 1: Lama sent an invitation to a diplomat, and China pretty
Speaker 1: much immediately contacted said diplomat and said, um, hey, we
Speaker 1: heard that the Dalai Lama invited you to this thing.
Speaker 1: Don't go. And wasn't there an instance where they had
Speaker 1: internally talked about sending somebody to China and China preemptively
Speaker 1: denied any possible visa or travel requests or something like that.
Speaker 1: And then there was another instance where a woman who
Speaker 1: was Chinese who was living in Taiwan on wanted to
Speaker 1: go back and visit her family in China, and when
Speaker 1: she tried to cross over, some border governmental officials presented
Speaker 1: her with like year's worth of chat logs of hers
Speaker 1: and said like, you can't come in here, or you
Speaker 1: have to stop interacting with people. But that one there
Speaker 1: was something that they could have gotten, the information could
Speaker 1: have Yes, that's true, Um, they could have. So actually,
Speaker 1: let's just talk about this real quick. Um. One of
Speaker 1: the researchers that was on the Info War Monitor research
Speaker 1: team was a white hat hacker. You guys know what
Speaker 1: a white hat hackers? Good guy. It's somebody who um,
Speaker 1: a company would pay to expose their zero day vulnerabilities
Speaker 1: and their back doors and things like that so that
Speaker 1: they can patch them before black hat hackers can actually
Speaker 1: infiltrate ye infiltrate their system. Basically, he's the guy that
Speaker 1: you pay to come rob your house so he can
Speaker 1: tell you how he robbed your house so that you
Speaker 1: off leaving that window open. Oh, it's like that. It
Speaker 1: takes a criminal show or whatever like that, except for
Speaker 1: on computers. Would I would like to have been on
Speaker 1: that show. You know, it's like, Okay, I'm gonna break
Speaker 1: into his house by driving my car through the wall.
Speaker 1: That show was so dumb because he would walk up
Speaker 1: and like doors and locked. Great. So one of these
Speaker 1: researchers was a white hat hacker named Nart Villaneus, and
Speaker 1: he's actually the guy who figured out this other thing
Speaker 1: that we were just talking about, and that is that
Speaker 1: China was spying on their citizens with um the Chinese
Speaker 1: state sponsored version of Skype. Who would have guessed that,
Speaker 1: but they were like basically logging every single conversation and
Speaker 1: chat that was happening through this system and keeping it
Speaker 1: on file to use against their citizens if they ever
Speaker 1: needed to. Basically, like what everybody says is like the
Speaker 1: n s A is doing was actually happening in China.
Speaker 1: I'm not surprised me neither. So this guy not. When
Speaker 1: he was looking at the code for ghost rat and
Speaker 1: during this investigation, found this string of twenty two characters
Speaker 1: you know, in the malicious file. And I don't know why,
Speaker 1: but he literally searched Google for it. But it gets better,
Speaker 1: literally searched Google for it, and even more mind boggling,
Speaker 1: Google actually returned something to him. They actually the search
Speaker 1: found something, and Google sent him to a group of
Speaker 1: computers off the coast of China that was unsecured and
Speaker 1: without a password and basically housed the dashboard that let
Speaker 1: him control all of the computers that were infected by
Speaker 1: ghost rat. M hmm, that's interesting. I know I heard
Speaker 1: about that too, and it does seem like they would
Speaker 1: secure that it does so they were basically what Nart
Speaker 1: did is he gave. He did He left a little
Speaker 1: piece of bait, Yeah, a little honeypot for the hackers
Speaker 1: to make sure that what he was viewing was actually
Speaker 1: what he thought he was viewing. Um, they took the
Speaker 1: bait and so on March twelve, two nine, he was
Speaker 1: able to briefly gain control of one of the hackers
Speaker 1: computers um and he watched a series of commands. Presumably
Speaker 1: somebody in China was entering rummaging through the files that
Speaker 1: were left in this honeypot, finding nothing, the hacker disappeared,
Speaker 1: but they were able to find this little dashboard. We
Speaker 1: have a dashboard on our website, right, it's you know,
Speaker 1: the back end kind of controlling, and the entire dashboard
Speaker 1: was in Chinese. And you know, they were able to,
Speaker 1: like I said, manipulate the more than twelve hundred almost
Speaker 1: computers that were infected by Ghostrat. At that point I
Speaker 1: was reading about that, I was like, they went to
Speaker 1: sort of a lengthy trial and error process trying to
Speaker 1: figure out when all these different things did because it
Speaker 1: was all in Chinese. That's kind of surprised. They never
Speaker 1: just didn't go find somebody who spoke Chinese. But you know,
Speaker 1: for me, I know, I'm presenting this as evidence for
Speaker 1: it being China, but that just seems so dang convenient,
Speaker 1: doesn't it. So they so let me just make sure
Speaker 1: before because I have some questions and maybe some pros
Speaker 1: and cons to this theory. But they traced it was
Speaker 1: through Nort I think is his name. He was the
Speaker 1: one who figured out that the servers were in chang
Speaker 1: Do or wherever it was it was. It was not
Speaker 1: chind Do, that one. That one was on off the coast.
Speaker 1: It was on an island off the coast China. But
Speaker 1: so it was in China, and so they figured that out.
Speaker 1: But in all of their investigations of this of ghost
Speaker 1: ghost Raight or ghost net, did were they able to
Speaker 1: tell what the initial source of the infection was. No,
Speaker 1: not as far as I can tell, because that I mean,
Speaker 1: I don't know either. I didn't see any By the
Speaker 1: time they found it, it was all over the place. Yeah,
Speaker 1: And so that I mean, I think the thing of
Speaker 1: ghost rat is that it it wasn't necessarily how you
Speaker 1: are You may be thinking of it a different way.
Speaker 1: You know, on TV, like one computer gets infected and
Speaker 1: then it gets into the server and infects everything on
Speaker 1: the servers rats and that makes ghost net right. But
Speaker 1: the infection on this didn't necessarily spread from single like
Speaker 1: you know, patient zero to server out to the things
Speaker 1: on the server. It may have and I suspect did
Speaker 1: on many occasions, they were single infection points. I was
Speaker 1: introduced in a lot of places. I guess I was
Speaker 1: just trying to figure out if they could catalog what
Speaker 1: the earliest was, was to try and figure out where
Speaker 1: it came from, because I don't think they were able
Speaker 1: to ascertain how long ghost Net had been on any
Speaker 1: given unit. Okay, yeah, no, no, that That's what I
Speaker 1: was after because it makes me wonder if you know, well,
Speaker 1: could somebody have been leaving a breadcrumb trail back to
Speaker 1: a dummy server that is in China. So that's where
Speaker 1: I'm like, well, maybe it isn't actually China's fault. But
Speaker 1: but then I look at it and the other side
Speaker 1: is that there's a lot of stuff that happens in
Speaker 1: China that is done based on societal pressures. Do you
Speaker 1: remember it's um did you guys ever read the about
Speaker 1: the Great Chinese Famine? You know, Mao does this thing.
Speaker 1: He says, we've got to we've got to do all
Speaker 1: this stuff, we gotta make all this food, and people,
Speaker 1: not wanting to look shameful to Mao, overestimate how much
Speaker 1: they can make, and because they're falling short, that creates
Speaker 1: this giant famine. And I wonder if the same thing
Speaker 1: couldn't happen from an informational perspective of the whoever's in
Speaker 1: charge says, listen, you have to infect you know, a hundred,
Speaker 1: let's say just five hundred. Can you get five Oh,
Speaker 1: we could definitely get eight hundred and get all kinds
Speaker 1: of information. So they're they're just bombarding all these computers
Speaker 1: that have no useful information. But the idea is they're
Speaker 1: being They're telling their superiors we have infected x thousands,
Speaker 1: and we are monitoring x thousands, and we're getting all
Speaker 1: this great data, when indeed it turns out they're not
Speaker 1: really getting anything of note, they're working really hard for it.
Speaker 1: Did you see where I'm going with this? Is like
Speaker 1: it could be a campaign just to look like it's
Speaker 1: a successful campaign. Well, another another thing that could be is, uh,
Speaker 1: you know, it could just be sending a message. I mean,
Speaker 1: given their behavior, if it was a Chinese uh, and
Speaker 1: given the fact that they essentially kind of established this
Speaker 1: network that would be great for intelligence gathering, and then
Speaker 1: it just kind of like blew their own network. Maybe
Speaker 1: it was just all about sending a message. It might
Speaker 1: have been a They got this on a lot of
Speaker 1: computers in a lot of different places. And then just
Speaker 1: you know, send a message to Dalai Lama and the
Speaker 1: government and ext silence says, hey, we can watch everything
Speaker 1: you do, and you know it's just another bullying technique. Yeah,
Speaker 1: I mean they do watch officially. Unofficially, I guess actually
Speaker 1: they do watch a lot of stuff. But I also
Speaker 1: think that's too much data to watch. And that's why
Speaker 1: I just wonder if this is an oddball, off handed
Speaker 1: campaign to just look like they're watching even more foreign computers.
Speaker 1: So look, we we can control it, because China has
Speaker 1: said we're going to go to war on the internet,
Speaker 1: even though officially they say they don't do that. There's
Speaker 1: all kinds of reporting, the lots of lots of research
Speaker 1: and development on that stuff. Yeah, so it it makes
Speaker 1: me wonder if maybe it is is just this weirdo
Speaker 1: thing that is going on, which if it's somebody who
Speaker 1: doesn't is it very good at it and they're like, well,
Speaker 1: we've got it, We've got infect as many as we can.
Speaker 1: They may be not dotting all of their eyes and
Speaker 1: crossing all of their tease, which means that would explain
Speaker 1: for me at least why that, um what was it?
Speaker 1: The control panel site was not password protected because they
Speaker 1: were just they were just oblivious to the fact that
Speaker 1: they could get traced. Well, I mean, I guess a
Speaker 1: few counterpoints there, right. One is, um, this, as mentioned,
Speaker 1: was an incredibly sophisticated trojan horse, and I get like,
Speaker 1: genuinely cannot imagine the kind of person who can design
Speaker 1: a trojan horse that is basically undetectable for the majority
Speaker 1: of the malar softwares out there, but doesn't know, Hey,
Speaker 1: maybe put a password on your dashboard that control rolls
Speaker 1: all of those things. Secondly, they were able to trace
Speaker 1: back to a lot of servers as mentioned, because they
Speaker 1: knew where the servers were and all of those were
Speaker 1: heavily encrypted except for this one, right, And so like
Speaker 1: for there to have been just this one off just
Speaker 1: for me seems more suspicious that it isn't than it is.
Speaker 1: Does that make sense? It doesn't that it isn't China,
Speaker 1: that it's like a red herring than it is. But
Speaker 1: but it also makes me think of the October what
Speaker 1: is this stupid that website? October one? Thank you could
Speaker 1: not keep the number straight? Yes, okay, do you remember
Speaker 1: in the beginning I found in the source code that
Speaker 1: they were they were reflected from another site for like
Speaker 1: a couple of days. Is their tester before they loaded
Speaker 1: it all actually on their server, so I could see
Speaker 1: it being the same thing, is what we set up
Speaker 1: this control panel, it was our tester will pick set
Speaker 1: later and we'll delete that and remove that. But let's
Speaker 1: work on this and then you completely space it out.
Speaker 1: I see that happen with major companies all the time.
Speaker 1: You know, we set up the dummy log in the
Speaker 1: test environment, and then we linked to the real environment
Speaker 1: and forget to kill that link, and so somebody can
Speaker 1: get in through. I mean, there's all kinds of stuff
Speaker 1: like that. Yeah, that's fair. Stakes do get made. They do,
Speaker 1: But I don't think it's trying to I think it's
Speaker 1: somebody else. Well that's a big question. I actually don't
Speaker 1: know who else. I think who is. I just think
Speaker 1: it's not China because I really, I really think it's
Speaker 1: just way too freaking convenient for me. I just think
Speaker 1: it's too convenient, especially because, as you were saying, right,
Speaker 1: if your goal is a long standing intelligence gathering operation
Speaker 1: and you see an invitation go out to this person,
Speaker 1: you are not going to go to that person and say, hey,
Speaker 1: by the way that email that literally just came through,
Speaker 1: don't accept it. You're gonna just you know, maybe even
Speaker 1: wait a couple of days, like use some kind of
Speaker 1: intelligence there where somebody who's competent in that role would
Speaker 1: do that would wait, Yeah, somebody who's incompetent and doesn't
Speaker 1: know how to handle that information would react. Or somebody
Speaker 1: who was handed that information again as a red herring,
Speaker 1: will react to that information versus somebody who knows the
Speaker 1: kind of resources that were plugged into getting that information. Right.
Speaker 1: But it's also a nice way to cover up another
Speaker 1: intelligence source. Yeah, if you have actually spies and rats
Speaker 1: within the organization, then you know you've got this thing here.
Speaker 1: It's like our guy is close to being unmasked. Okay,
Speaker 1: well we'll unmask our our computer penetration thing here, which
Speaker 1: would account for that, and that keeps our guys safe.
Speaker 1: So that's another way. This is like the whole that's
Speaker 1: the thing about the whole intelligence business. You know, it
Speaker 1: gets complicated, it's very complete. It's entirely possible to well.
Speaker 1: And this is why I asked earlier as if they
Speaker 1: were able to determine who was one of the early
Speaker 1: infections was because it would be very clever to me
Speaker 1: to infect yourself in one of your non vital computers
Speaker 1: in the early batches, to make yourself look like a victim.
Speaker 1: And it's found. Oh my gosh, you know, look at us,
Speaker 1: We're a victim, just like everybody else. This is so weird.
Speaker 1: They hacked this oddball computer. Oh look at this, We've
Speaker 1: got all this grain inflating everybody. Nobody'll look at us
Speaker 1: on the way telling the world, Hey, we're important. Obviously
Speaker 1: we're very important. But if it's the long game, you
Speaker 1: don't tell anybody. You just keep pulling the information and
Speaker 1: using what you're gathering, like you're talking about, but nobody
Speaker 1: looks at you. Investigate. I think Joe suggesting that Tibet
Speaker 1: infected their own systems to make themselves look more important
Speaker 1: than they are. See, I don't think. I don't think that.
Speaker 1: I don't think that the office of his Holy List
Speaker 1: of Dalai Lama would do that because it's to me
Speaker 1: a little counter to what I understand their goals and
Speaker 1: missions are. But maybe you're right, Maybe it is a
Speaker 1: last ditch effort to to to buy for attention. I
Speaker 1: don't know, or there are other reasons, you know, I
Speaker 1: don't think that they're necessarily behaving like a bunch of
Speaker 1: shallow and monks there. And you know, that's the way
Speaker 1: the world is, you know, sometimes the shortest path that's
Speaker 1: through the mud, you know, even if you're like, you know,
Speaker 1: his holdiness of Dalai Lama. So let's just briefly talk
Speaker 1: about the other people that it has been suggested it
Speaker 1: could be. One is a uh as you were suggesting, Steve,
Speaker 1: kind of patriotic hackers who aren't actually state sponsored, but
Speaker 1: you know, are are hacking on behalf of China for instance, right.
Speaker 1: Or Russia. I mean, we see this with a lot
Speaker 1: of Russia, lots of patriotic hackers in Russia and America
Speaker 1: as well. Um, and so then the next one would
Speaker 1: be Russia. I don't know why, but Russia does seem
Speaker 1: like posters. Maybe that's because maybe it's because I'm American
Speaker 1: and I've been raised to believe that. But I think
Speaker 1: pretty much everybody, well, I mean I think everybody. Yeah,
Speaker 1: and again I don't see the benefit. It's not like
Speaker 1: Tibet is going to bomb China, right, I mean, there's
Speaker 1: not a lot of resources there. But but hey, I mean,
Speaker 1: maybe they just want to create or foster instability in
Speaker 1: the area, and that's a pretty good way to do it.
Speaker 1: But but ghost at is was I mean, what they
Speaker 1: found in those third less just shy of computers. They
Speaker 1: were all computers that were in I'm going to use
Speaker 1: the word network though it's not computer network, but they
Speaker 1: were in the same kind of political network. They were.
Speaker 1: They were embassy computers and stuff like that, right, So
Speaker 1: they had a reason to be communicating, which means that
Speaker 1: it's a it's a rather small pool to spread the
Speaker 1: infection across, but that doesn't mean that that infection hadn't
Speaker 1: also been dropped in other pools that had different spheres
Speaker 1: of contact than what the office of His Holiness the
Speaker 1: Dalai Lama had, because he's gonna have a very small
Speaker 1: group of people to contact, whereas you know, Billy the
Speaker 1: manager at kmart is going to have all of the
Speaker 1: kmart employees and and regional guys to talk to. You Like,
Speaker 1: it's spheres of inference. So this thing could be all
Speaker 1: over and nobody would really know. It might still be
Speaker 1: all over. It might just be that they didn't want
Speaker 1: to put it at a seminar into everywhere. It was
Speaker 1: just the Dalai Lama's office had the crappiest security in
Speaker 1: the world, and that's became ground zero for the infection.
Speaker 1: So what's the theory that stems from that? I guess
Speaker 1: what I'm getting at is, I don't I'm this is
Speaker 1: for it's not necessarily China. Is that this this bomb
Speaker 1: could have been dropped in a whole lot of small
Speaker 1: ponds and it just happens to be that we founded
Speaker 1: on this one group computer group that all are connected
Speaker 1: and have a connection to China because of that. Got it? Okay?
Speaker 1: Another possibility is the CIA, because again see everything right,
Speaker 1: they're kind of pot stirs, just like Russia. And then
Speaker 1: the final kind of idea is UM a stateless for
Speaker 1: profit group. Although again, you know, if we're gonna go
Speaker 1: run with Steve's theory, that makes more sense. But like, yeah,
Speaker 1: the office of His Holiness, the Dali Lama, Like I
Speaker 1: don't really get the profit there, But the Dalai Lama's
Speaker 1: office could have been an accident. Yeah, that's yeah, if
Speaker 1: we're going to run with that, I mean, it's it's random.
Speaker 1: Who do I get if I land in Joe's computer
Speaker 1: and I get all of Joe's contacts and Joe's contact
Speaker 1: all our jobless schmucks. Well, then I get no valuable information.
Speaker 1: But I land in Devon's inbox, and I get on
Speaker 1: Devon's computer, and Devon's connected to a whole bunch of
Speaker 1: high level ceo as. Whoo, I just hit the jackpot, baby. Yeah. Well,
Speaker 1: I mean with the one exception of the sophistication of
Speaker 1: the phishing emails, right, I mean, that's seriously targeted at
Speaker 1: the office of His holiness, the Dalai Lama and the
Speaker 1: Free to Bet Society at large list It is very
Speaker 1: likely that that email was copied from an email that
Speaker 1: some official source connected to the organization sent out. So
Speaker 1: anybody can get a hold of those kind of emails
Speaker 1: through the dark. Well, hey, I get these things from
Speaker 1: Viacom all the time, and I send out emails looking
Speaker 1: like Viacom or PayPal. We all get those faux PayPal emails. Yeah,
Speaker 1: but they're not half as sophist kid as these ones are. Actually,
Speaker 1: I've been getting some really good ones lately. I've seen
Speaker 1: some really good phishing scams. That's how you're telling us
Speaker 1: that all of our money is gone. No, no, no,
Speaker 1: it is not from the New Gold Teeth that I
Speaker 1: have in my grill either not at all. Okay, yeah, so,
Speaker 1: I mean again I don't really see the benefit. But
Speaker 1: a stateless, kind of for profit hacking group would make
Speaker 1: sense to me. I don't really see it either. I mean,
Speaker 1: what would they be doing. They could steal their data
Speaker 1: and then ransom, which happens occasionally system and ransom, and
Speaker 1: they haven't done that. So yeah, I don't know where
Speaker 1: exactly where the profit comes down. I mean, although again,
Speaker 1: you know, the fact that these servers are kind of
Speaker 1: all over the world does speak to the fact that
Speaker 1: it could be a you know, a vast reaching organization
Speaker 1: of people. But again, why so, I well, I don't
Speaker 1: think it's China. I don't know who I think it is.
Speaker 1: I'm gonna go with Russia because this Mirka and I
Speaker 1: have to blame everything on the Russians. There you go.
Speaker 1: It's awfully hard to tell me. Right now, we've got
Speaker 1: the big, you know, the so called Russian hacking scandal
Speaker 1: right here in America, and it's probably entirely bogus. I mean,
Speaker 1: there's no it's hard to say because it was just
Speaker 1: this revelation the CIA has techniques and software that allow
Speaker 1: them to do all kinds of hacking and leave Russian
Speaker 1: fingerprints behind and the little traces that looked like it
Speaker 1: might have been the Ruskies. Uh, it's it's hard to
Speaker 1: tell if that if there was any hacking at all,
Speaker 1: and said maybe somebody didn't just leak a bunch of information.
Speaker 1: I mean, it's just impossible to tell. Well, and there's
Speaker 1: there's there's a whole another way that this could be
Speaker 1: anybody other than China, and that is through Um, you
Speaker 1: guys have heard of mirrors, server mirrors, So for folks
Speaker 1: that don't know, this is how you get stuff off
Speaker 1: the Internet is there's a server that's got it, but
Speaker 1: there's a server somewhere which is a mirror image of it.
Speaker 1: And this is how our podcast gets out. Is it's
Speaker 1: what's called the CD and a content delivery network, and
Speaker 1: there's servers all over that a mirror each other, so
Speaker 1: that not everybody is pulling the data from the same
Speaker 1: server a k A. What happened to us for about
Speaker 1: six or nine months at one point because I didn't
Speaker 1: understand how the Internet work. Well, there's mirror servers, but
Speaker 1: I found out that there is also what is known
Speaker 1: as a witness server, and have you heard of this before.
Speaker 1: So he said yes. You said no, I said yes.
Speaker 1: He said now, okay, so explain it to Joe. Okay.
Speaker 1: So the way I understand what a witness Oh yeah,
Speaker 1: that won't get me in trouble. Y okay to him.
Speaker 1: So what I understand, sir, is that a witness server
Speaker 1: is a server that watches a group of servers. So
Speaker 1: it's one of them should be the primary server, and
Speaker 1: it watches all the others, and if something happens or
Speaker 1: goes wrong with the main server, that's uh, it will
Speaker 1: tell them, oh, switch to server number two. That's called
Speaker 1: fail over. So it's directing the it's saying, oh, you're
Speaker 1: number one. You get the majority of the traffic now,
Speaker 1: and you need to mirror and look like server three,
Speaker 1: four and five need to look like server one. But
Speaker 1: what I don't know is if it's possible to have
Speaker 1: a server in the network that the mirror is controlling,
Speaker 1: but the other mirrors do not know exist. So theoretically
Speaker 1: all the mirrors should know. What you know that they
Speaker 1: have five compatriots, but there could be a dark sixth
Speaker 1: compatriots out there. I mean, frankly, I'm sure that there's
Speaker 1: ways to mirror the witness I mean, or to spoof
Speaker 1: it actually would be a better term, so that you
Speaker 1: could just take over a whole set of servers and
Speaker 1: just kick the old guy offline and say, oh, hey, guys, sorry,
Speaker 1: I just renewed my I P here. I am I'm dynamics.
Speaker 1: So it's happening a lot here, I am, I'm in
Speaker 1: control of you. Now do all these changes and oops,
Speaker 1: we're going to switch over to the server over here.
Speaker 1: Server one, which has got all the content on it
Speaker 1: is theoretically supposedly no longer online script runs. It shoots
Speaker 1: all its day DA out, but officially it's off of
Speaker 1: its group network, so when it comes back in, the
Speaker 1: group doesn't know it's done. It like there's a whole
Speaker 1: bunch of really simple and really complex and clever ways
Speaker 1: that that kind of server arrangement could drop off. And
Speaker 1: then it looks like it's you know, the service are
Speaker 1: all housed in these places, and the one guy that
Speaker 1: we don't know about in Virginia is the site that
Speaker 1: all of that data is getting shot to. Yeah, I know,
Speaker 1: which is why I I'm I'm totally on board with
Speaker 1: the theory that it is not China I feel like
Speaker 1: they are the easy, easy answer. Yeah. Well again, I'm
Speaker 1: not sure who the hell else would be interested. But
Speaker 1: even even there's a lot of other political powers who
Speaker 1: would love to have information to potentially leverage. I mean,
Speaker 1: look at what we did. We we tracked all kinds
Speaker 1: of stupid stuff for fifty years in the intelligence community.
Speaker 1: That was for not but it was all for the
Speaker 1: hope that maybe one day that would pay off. Well.
Speaker 1: And if they were really smart hackers who were doing
Speaker 1: some kind of spoofing or server spoofing or anything like that,
Speaker 1: and you were targeting Tibet, of course you would say
Speaker 1: that everything was in China because it's the easy target
Speaker 1: from Tibet. So and if it was you know, if
Speaker 1: it was Palestine and Israel. So if they were to
Speaker 1: find this in Palestine, everybody would say, well, obviously it's
Speaker 1: Israel who's doing this. So you would leave the bread crumbs.
Speaker 1: Let's say, look it was them, it's their fault. Nobody
Speaker 1: notices where my system is shooting the external data to,
Speaker 1: you know, although you know, and that could be very
Speaker 1: very much true. Although I'm not sure that the Chinese
Speaker 1: would really give a damn about covering their tracks I
Speaker 1: think that the Tibetan's going to do well. But it's
Speaker 1: not the Tibetans that they'd be worried about, Joe. They
Speaker 1: would be worried about reprisals or reprimands from from other
Speaker 1: government bodies. And maybe those aren't the right where, you know,
Speaker 1: but they don't want I mean to a degree their
Speaker 1: brazen really care about public opinion. But to another extent
Speaker 1: they have to play by some of the set rules,
Speaker 1: whether they want to or not. Well, so I mean
Speaker 1: that's the That's the thing, right, is that like they
Speaker 1: functionally aren't covering their tracks. I mean they are being clandestine, right,
Speaker 1: They are hiding a little bit that you know, if
Speaker 1: if they were the people who did this, right, they
Speaker 1: have hidden this on people's computers, but everything tracks back
Speaker 1: to them, that tracks back to servers in China. So
Speaker 1: it can't be proved to be government. They're not government servis.
Speaker 1: But so it's not as though there's some you know,
Speaker 1: they were like spoofing or like buying server space and
Speaker 1: like other places to hide the fact that it was China. Again,
Speaker 1: if it was China, right, the their servers right there,
Speaker 1: they track right back to China. They're on Chinese soil,
Speaker 1: therefore they must be sanctioned by China. I'm the only
Speaker 1: thing they're hiding is the thing that has to be
Speaker 1: hidden to get information. So I guess I don't see
Speaker 1: them actually covering their tracks if it is them, but
Speaker 1: I don't. I don't think it's them. Okay, So yeah,
Speaker 1: a new question again. It could be a lot of people.
Speaker 1: Could be the CIA, just for the sheer freaking hell
Speaker 1: of it. Yeah, I think it's probably the Chinese did
Speaker 1: it just for the heck of it. Could be some intern,
Speaker 1: some CI A intern. Hey, I wrote this program, boss, Yeah,
Speaker 1: just send it out to somebody. See, holy crap, it works.
Speaker 1: Speaking of interns, are we sure that Justin isn't the
Speaker 1: one who did this? Probably was, Yeah, I don't know.
Speaker 1: I've seen him trying to type on his phone, that's true. Okay,
Speaker 1: anything else, for the good of the order of this podcast,
Speaker 1: what are we ordering? I'd like a new sandwich chips um. So,
Speaker 1: as I said, we're going to post the link to
Speaker 1: the fifty three page pdf UM as well some other
Speaker 1: link on the website. That website is Thinking Sideways podcast
Speaker 1: dot com. You can also find links to merch there.
Speaker 1: If you want to buy, like a sticker or a
Speaker 1: shirt or or anything like that, you can do that. There.
Speaker 1: We are on iTunes. You can basically download and listen
Speaker 1: to us anywhere or stream us anywhere. And frankly, if
Speaker 1: you've gotten to this point and you don't know how
Speaker 1: to listen to us, then I need you to write
Speaker 1: us an email because I'd like to know that. Um.
Speaker 1: But if whatever service you're using allows you to subscribe,
Speaker 1: you should do that. If it allows you to leave
Speaker 1: a rating and a review, you should do that. A
Speaker 1: child how to do that if they're the one who
Speaker 1: brought you here, um, five star ratings. By the way,
Speaker 1: we're on social media. We've got Facebook page and a group.
Speaker 1: If you're looking for discussion, join the group. If you're
Speaker 1: looking for I actually don't know why anyone would like
Speaker 1: our page, so an interesting links, interesting links in our ssodes,
Speaker 1: So like the page, joined the group. We're on Twitter.
Speaker 1: We're Thinking Sideways. We also have a subreddit that's a
Speaker 1: little sleepy right now, but that's Thinking Sideways. There's a
Speaker 1: trend here. You can email us Thinking Sideways podcast at
Speaker 1: gmail dot com. We take suggestions, we take feedback, we
Speaker 1: take general praise. We take questions, we take you name it,
Speaker 1: we take it. Money. No, we don't take money anymore, money, photographs,
Speaker 1: anything you want to send us, we'll take it. That's fine,
Speaker 1: and we'll probably respond even nine percent of the time
Speaker 1: we did. H Yeah, as long as you're not sending
Speaker 1: us ghost rat, we're good. Please don't send us. Appreciate that.
Speaker 1: All of that having been said, I think we're going
Speaker 1: to go ahead and ghost on out of here. Me
Speaker 1: and my USB drive. What I was waiting for one
Speaker 1: of you to do the Monty Python clickity clack, coconut
Speaker 1: horse noise for the Trojan chicken. The Trojan Chicken. Yeah, okay,
Speaker 1: bye guys. By