Malicious e-mail and other cyberattacks on Tibet advocacy groups in the United States are linked to Internet servers used in past hacker intrusions traced by U.S. law enforcement to China.
The link, made by security experts on the basis of publicly available data, is the first direct evidence the recently intensified attacks against the Tibet groups, reported by United Press International a week ago, were launched from China. But it remains unclear to what extent -- if any -- the Chinese government or military is implicated.
The news follows charges last week from the Save Darfur Coalition, a group opposing Chinese policy in Darfur, they had been the target of intrusion attempts "which appeared to originate in China and seemed intent on subversively monitoring, probing and disrupting coalition activities."
The recent cyberattacks on several Tibet groups were analyzed by a security researcher for the SANS Internet security organization, Maarten Van Horenbeeck, who followed cyberattacks against Tibet organizations, and advocates for other Chinese ethnic groups such as the Uighurs, for many years.
Van Horenbeeck told United Press International that the attacks used e-mails purporting to come from known associates of the victims with attachments containing malicious code -- so-called Trojan horse software -- that stole e-mail and contact data, passwords and other information and covertly sent it on the Internet to special command servers. One domain address that came up as the destination for data stolen from supporters of the Students for a Free Tibet group was familiar to him. Cvnxus.8800.org has been used by hackers "again and again" over the years, he said.
Since earlier this month, the domain has been "moving around," he said. But until March 8, it was based on a server previously identified by the FBI as the source for an e-mail attack aimed at U.S. defense contractors launched in August last year, according to a report from the Air Force Association.
The link, though a narrow one, is significant because of the well-acknowledged difficulty of attributing cyberattacks. Hackers can take control of computers, or even whole servers, without the knowledge of their owners and use them to launch attacks.
China has some of the world's tightest government restrictions on the use of the Internet, which makes many observers skeptical hacker gangs could operate from within China without government approval or acquiescence.
The attacks against the Tibet groups were "very professional and well-coordinated," Van Horenbeeck said, though he said no definitive evidence linked the Chinese government to the attacks.
Some of the e-mails used highly sophisticated "social engineering techniques" to trick their victims into opening the attachment, he said.
Rather than just faking the e-mail address of an associate as the sender of a general message, these e-mails would refer to discussions that the intended victim had conducted with that associate on open Internet bulletin boards or e-mail lists, Van Horenbeeck said, suggesting the hackers had done a great deal of research on individual targets.
"These were very sophisticated," he said, adding that unlike conventional hacker attacks, these were not aimed at defacing the group's Web site or driving it offline with a series of crude denial-of-service bombardments. "These attacks were designed to steal data," he said.
He said they might also be designed to "disrupt (the groups') operations by making people wary of using their e-mail, which is a vital tool for their coordination."
Some of the attacks did seem designed to undermine trust in e-mail. Last week a security professional working with one group posted a message to a Tibet discussion list warning people to expect an increase in e-mail and other attacks. The following day hackers sent another message, faked to look as if it came from the same address, containing a security document as a Word attachment. The attachment contained a Trojan horse malware package, Van Horenbeeck said.
Similarly sophisticated social engineering techniques were noted by security researchers at MessageLabs last month in e-mail malware sent to members of an Olympic committee.
"These are otherwise perfectly valid documents," Maksym Shipka, senior architect at MessageLabs, told SCMagazine, an IT security trade publication. "It's real information. It's a continuation of actual email conversations. Yet the document is bad."
Shipka said the e-mail was so convincing that recipients forwarded it to other members of the committee.
The Trojans and other malicious software used in the Tibet attacks are similar to those used in attacks against the unclassified computer networks of U.S. defense contractors, the Department of Energy's nuclear labs and other sensitive government agencies, but experts caution against reading too much into this, saying that the software is easily available on hacker Web sites.
Protests spread from Tibet into three neighboring provinces Sunday as Tibetans defied a Chinese government crackdown, while the Dalai Lama decried what he called the "cultural genocide" taking place in his homeland.
Demonstrations widened to Tibetan communities in Sichuan, Qinghai and Gansu provinces, forcing authorities to mobilize security forces across a broad expanse of western China.
In Qinghai province, riot police sent to prevent protests set off tensions when they took up positions outside a monastery in Tongren. Dozens of monks, defying a directive not to gather in groups, marched to a hill where they set off fireworks and burned incense in what one monk said was a protest, according to an Associated Press reporter at the scene.
In a sign that authorities were preparing for trouble, AP and other foreign journalists were ordered out of the Tibetan parts of Gansu and Qinghai provinces by police who told them it was for their "safety."
Meanwhile, police in the Tibetan capital, Lhasa, searched buildings as a Monday deadline loomed for people who took part in a violent anti- Chinese uprising last week to surrender or face severe punishment.
Tibet's governor Champa Phuntsok said Monday that 16 people died and dozens were wounded in the violence, which broke out in Lhasa on Friday. He described 13 as "innocent civilians," and said another three people died jumping out of buildings to avoid arrest. China's state media said earlier that 10 civilians were killed.
He also said security forces did not carry or use weapons.
Speaking from India, the Dalai Lama, the spiritual leader of Tibetans, called for an international investigation into China's crackdown on demonstrators in Lhasa, which his exiled government claims left 80 people dead.
"Whether intentionally or unintentionally, some kind of cultural genocide is taking place," the Dalai Lama said, referring to an influx of Chinese migration into Tibetan areas and restrictions on Buddhist practices—policies that have generated deep resentment among Tibetans.
Tensions also boiled over outside the county seat of Aba in Sichuan province when armed police tried to stop Tibetan monks from protesting, according to a witness who refused to give his name.
The witness said a policeman had been killed and three or four police vans had been set on fire. Eight bodies were brought to a nearby monastery while others reported that up to 30 protesters had been shot, according to activist groups the Tibetan Center for Human Rights and Democracy and the London-based Free Tibet Campaign. The claims could not be confirmed.
Sunday's demonstrations follow nearly a week of protests in Lhasa that escalated into violence Friday, with Tibetans attacking Chinese and torching their shops, in the longest and fiercest challenge to Chinese rule in nearly two decades.
Complicating Beijing's task, the spreading protests fall two weeks before China's celebrations for the Beijing Olympics kick off with the start of the torch relay, which will pass through Tibet.
Though many were small in scale, the widening Tibetan protests are forcing Beijing to pursue suppression while on the run, from town to town and province to province across its vast western region. Sunday's lockdown in Tongren required police imported from other towns, the locals said.
The Chinese government attempted to control what the public saw and heard about protests that erupted Friday. Access to YouTube.com, usually readily available in China, was blocked after videos appeared on the site Saturday showing foreign news reports about the Lhasa demonstrations, montages of photos, and scenes from Tibet-related protests abroad.
Television news reports by CNN and the BBC were periodically cut during the day, and the screens went black during a live speech by the Dalai Lama carried on the networks.
China's communist government had hoped Beijing's hosting of the Aug. 8-24 Olympics would boost its popularity at home as well as its image abroad. Instead the event already has attracted the scrutiny of China's human rights record.
Thubten Samphel, a spokesman for the Dalai Lama's government, said multiple people inside Tibet had counted at least 80 corpses since the violence broke out Friday. He did not know how many of the bodies were protesters. The figures could not be independently verified because China restricts foreign media access to Tibet.
In Lhasa, hundreds of armed police and soldiers patrolled the streets on Sunday. Hong Kong Cable TV reported some 200 military vehicles, carrying 40 to 60 armed soldiers each, drove into the city center.
Footage showed the streets were mostly empty other than the security forces. Messages on loudspeakers warned residents to "discern between enemies and friends, maintain order" and "have a clear stand to oppose violence, maintain stability."
James Miles, a BBC correspondent in Lhasa, said troops carrying automatic rifles were "letting off the occasional shot." He said people were scared to come out of their homes for fear of being hit by a bullet.
Westerners who were told to leave Lhasa and arrived by plane in the city of Chengdu said they heard gunshots and explosions throughout Saturday and overnight.
"The worst day was yesterday. It was completely chaotic. There was running and screaming in the street," said Gerald Scott Flint, director of the medical aid group Volunteer Medics Worldwide, who had been in Lhasa four days. Flint said he could see fires burning six or more blocks away.
Tashi Wangdi, president of the Office of Tibet that represents the Dalai Lama in New York, called the departure of tourists worrisome.
"I think there will be total blackout of information to the outside world," he said. "Our worry is they will be more brutal and will use more force now."
The unrest in Tibet began March 10 on the anniversary of a 1959 uprising against Chinese rule of the region. Tibet was effectively independent for decades before communist troops entered in 1950.
The Tibetan communities living far outside what China calls modern Tibet are parts of former provinces of past Tibetan kingdoms, and many inhabitants still revere the Dalai Lama.
"We want freedom. We want the Dalai Lama to come back to this land," said a monk from Rongwo in Tongren. The monks display his pictures, though they have been ordered to remove them.
Inspired by the protests in Lhasa, monks and Tibetans in the town of Xiahe in Gansu province staged two days of protests, one peaceful in which they raised Tibetan national flags, the other in which government offices were smashed and police tear-gassed the crowd of more than 1,000.
Authorities clamped a curfew on Xiahe overnight. Patrols of riot police, in black uniforms, helmets and flak jackets, and armed police in green uniforms carrying batons marched through the town Sunday in groups of 10 and 20.
Smaller protests were reported in two other nearby towns, witnesses said, in both cases drawing truckloads of armed police.
In the Gansu provincial capital of Lanzhou, more than 100 Tibetan students staged a sit-down protest on a playing field at Northwest Minorities University, according to the activist group Free Tibet.
Malicious e-mail and other cyberattacks on Tibet advocacy groups in the United States are linked to Internet servers used in past hacker intrusions traced by U.S. law enforcement to China.
