The Social Graph of Malware

The (short) life and times of Google in China. In January, 2006, Google announced they would be opening a special Chinese-language version of the Google search engine, as google.cn. Among their many reasons were the desire to provide services to this huge chunk of the world’s population, in spite of having to comply with Chinese censorship in order to do so. This was clearly a difficult decision for Google execs, and probably equally difficult for Google’s users to accept. (This includes many users inside China, who found it difficult to accept.  [See also the Google China article on Wikipedia]

• Initial announcement (January 2006) that Google would be operating google.cn according to Chinese law (i.e. censoring and filtering results). And as reported by C|Net.

Filtering our search results clearly compromises our mission. Failing to offer Google search at all to a fifth of the world’s population, however, does so far more severely.

• The initial uproar (in the US at least)
• Google defends its decision in a committee hearing of the US congress.

“Figuring out how to deal with China has been a difficult exercise for Google. The requirements of doing business in China include self-censorship – something that runs counter to Google’s most basic values and commitments as a company. Despite that, we made a decision to launch a new product for China – Google.cn – that respects the content restrictions imposed by Chinese laws and regulations. Understandably, many are puzzled or upset by our decision.”

• Nart Villeneuve points out that Google.cn is filtering search results (January 2006) but that no specific (Chinese) laws have been cited that require that they do so.
• Reporters Without Borders took a strong position:

“By offering a version without ‘subversive’ content, Google is making it easier for Chinese officials to filter the Internet themselves. A Web site not listed by search engines has little chance of being found by users,” the group said in a statement. “The new Google version means that even if a human rights publication is not blocked by local firewalls, it has no chance of being read in China.”

• Announcement (on January 12th 2009) that (Chinese) hackers had penetrated some systems and Google was considering its options. In this announcement David Drummond (SVP Corporate Development and Chief Legal Officer) described two aspects of the penetration. One was the compromise of some dissident gmail accounts. The other was the compromise of some proprietary intellectual property of 20 or more companies. Not clear which of these was the primary motivator.

First, this attack was not just on Google. As part of our investigation we have discovered that at least twenty other large companies from a wide range of businesses–including the Internet, finance, technology, media and chemical sectors–have been similarly targeted.

Second, we have evidence to suggest that a primary goal of the attackers was accessing the Gmail accounts of Chinese human rights activists.

Third, as part of this investigation but independent of the attack on Google, we have discovered that the accounts of dozens of U.S.-, China- and Europe-based Gmail users who are advocates of human rights in China appear to have been routinely accessed by third parties.

• Note that they didn’t say they are pulling out of China, they said:

“we will be discussing with the Chinese government the basis on which we could operate an unfiltered search engine within the law, if at all.”

• Whatever the case, they apparently turned off the filtering at google.cn.
• China fails to turn off access to google.cn

• Analysis of, and fallout from, the penetrations
• Background material— CitizenLab reveals Ghostnet
• Mikko Hypponen (F-Secure) says this was a common type of attack (poisoned zero-day PDF exploits in which files are sent to targeted individuals)
• There is a Computerworld report that the actual penetrated system was one that reports to the FBI and law-enforcement

• That’s because they apparently were able to access a system used to help Google comply with search warrants by providing data on Google users, said a source familiar with the situation, who spoke on condition of anonymity because he was not authorized to speak with the press. “Right before Christmas, it was, ‘Holy s***, this malware is accessing the internal intercept [systems],’” he said. That, in turn led to a Christmas Eve meeting led by Google co-founder Larry Page to assess the situation. Three weeks later, the company had decided that things were serious enough that it would risk walking away from the largest market of Internet users in the world.

  NPR says this was about the cybertheft of intellectual property, not dissident gmail accounts. They report on “stepped up” cyber offensives on the part of (presumably) Chinese government or industry to obtain research secrets from multinational companies.