Apr 17 2008

BREAKING: Upcoming Chinese hacker attack on CNN building steam

Published by at 6:25 pm under Nationalism,Tibet,US attacks

UPDATE: It looks like the organizers might be trying to put a stop to the attack due to the number of people who are aware of it. Translating some of it now.
UPDATE to UPDATE While the group may be trying to call off the attack, it might be too late. CNN is now reporting that they have been targeted in an attempt to disrupt their web site.
FINAL UPDATE FOR THIS POST: See the newest release by the group planning attack on CNN here

First, I have added a clock with the Beijing local time because it crossed my mind that some people might be thinking the scheduled attack on CNN is going to take place on US date, time. Nope, Beijing local. So that means it is suppose to take place tomorrow. I will leave the clock up if you want to check back.

Second, many more Chinese sites, not just hacker, starting to call for the DDOS attack on CNN. Also they are starting to solidify their plans. Here are the details from one posting on the Guilin University of Electronic Technology bulletin board:

  1. Attack will start on 19 April 2008, at 8:00 pm
  2. DDOS attack on www.cnn.com
  3. The DDOS attack is going to last over three hours
  4. They need a large number of compromised computers to carry out the attack and are requesting everyone’s support in putting to together the number needed

The plan has many more details but unfortunately the language is too technical for me to translate.

Here are additional sites calling for the attack on CNN.

http://bbs.neteasy.cn/showthread.php?p=984976

http://www.coogo.net/bbs/showtopic-444648.aspx

http://www.ytjt.com.cn/bbs/redirect.php?tid=36644&goto=lastpost

http://www.ipark.cn/bbs/Post.asp?PostID=836336

http://blog.xuite.net/lemon_head/simple/16728332

http://tieba.baidu.com/f?kz=357748876

Probably many more out there.

UPDATE: Carl Jongsma, from Computer World, was kind enough to provide us a little press on this breaking situation.

UPDATE: Tried once again to contact CNN and warn them of the scheduled attack. If anyone has a better contact than just their news tip e-mail, please inform them.

UPDATE (APRIL 18 1556GMT; Jumper): Arbor Networks is using their tools to monitor the situation.  Take a look at Jose Nazario’s post here.

UPDATE: Since we have some smart people looking at the blog, I wanted to post below part of the Chinese hackers’ attack plan. This seems to be part of the DDoS call for large numbers of attacking computers. Will supply what I can about the Chinese, though it is possibly wrong. If someone knows what this is referring to please post in the comments and we will move it to the blog:

总群:29332975 (This refers to the total number)
复仇的火焰分群1:10093595 (Revenge of the flame group 1)
复仇的火焰分群2:60087657 (Revenge of the flame group 2)
复仇的火焰分群3:17697381 (Revenge of the flame group 3)
复仇的火焰分群4:52911651 (Revenge of the flame group 4)
复仇的火焰分群5:13283694 (Revenge of the flame group 5)
复仇的火焰分群6:52274747 (Revenge of the flame group 6)
复仇的火焰分群7:13735729 (Revenge of the flame group 7)
复仇的火焰分群8:28556275 (Revenge of the flame group 8 )
复仇的火焰分群9:8333214 (Revenge of the flame group 9)
复仇的火焰分群10:24207831 (Revenge of the flame group 10)
复仇的火焰分群11:18574877 (Revenge of the flame group 11)

UPDATE to UPDATE Jumper figured out that these were probably the QQ numbers for the group leaders of the attack. When I went back and looked at some of the sites calling for the DDoS attack, one did list it as QQ群 or QQ groups.

27 responses so far

27 Responses to “BREAKING: Upcoming Chinese hacker attack on CNN building steam”

  1. Eastwoodon 17 Apr 2008 at 10:02 pm

    I wonder if CNN is scrabbling together their resources?

  2. Heikeon 17 Apr 2008 at 10:10 pm

    You know Eastwood, I would really like to think that some anti-DDOS team at CNN was springing into action. However, what I really think is happening, is that every e-mail I send them is tagged as, “crazy guy”…delete. :)

  3. Eastwoodon 17 Apr 2008 at 10:44 pm

    “crazy guy”… “conspiracy theorist”… delete :lol:

  4. [...] Update:The Dark Visitor reports that the protest is gathering support–even outside of the hacker community. Among the sites calling for a DDoS attack are Guilin University of Electronic Technology. Check back at The Dark Visitor for breaking details. [...]

  5. [...] is going down At least that is the intention of some chinese dudes and probably is a form of ‘ethical hacking’ for some [...]

  6. [...] at the Dark Visitor blog, in a post entitled Upcoming Chinese hacker attack on CNN building steam, Heike shows that Chinese hackers are planning to target the US news outlet CNN with a coordinated [...]

  7. Heikeon 18 Apr 2008 at 11:19 am

    Jumper,

    That is wierd, I was just about to post an update on the same thing.

  8. [...] Upcoming Chinese hacker attack on CNN building steam (is this real?) [...]

  9. jumperon 18 Apr 2008 at 1:28 pm

    Heike,

    I’m inclined to suggest that these are the numbers of bots available for the attack but > 29 million is an unbelievable number. It would be cool though.

    Unless your post update is incomplete, the numbers in each group don’t add up to the total listed at the top. Could they be QQ numbers? They don’t have a fixed length. If they are QQ numbers, each number may correspond to the leader of each group.

  10. jumperon 18 Apr 2008 at 1:41 pm

    I think it may have been delayed to another time. See http://bbs.neteasy.cn/showthread.php?p=984976 . It seems to mean that they are planning to continue but that too many people know about the planned time. Not sure. Google’s Zhongwen isn’t much better than mine on this one…

  11. Jeffon 18 Apr 2008 at 1:48 pm

    So the Dos is going to take place 8:00AM Saturday morning. Good job guys most people will have no idea it happened because they will be asleep.

  12. Heikeon 18 Apr 2008 at 2:02 pm

    Jumper,

    You are right the guy is trying to call off the attack. I will get it translated and updated here in a bit. Also, it had a link back to his/her blog. This may have been the group organizing the thing. On the homepage it was showing that two of the attack groups were already full.

  13. [...] site Dark Visitor, which tracks the activities of Chinese computer hackers, is reporting that a Distributed Denial of [...]

  14. [...] “‘Crazy guy’” thinks CNN’s web site is about to be attacked by Chinese computers — more here. [...]

  15. Eastwoodon 18 Apr 2008 at 4:10 pm

    CNN “took measures to isolate the trouble by limiting the number of users who could access it from specific geographic areas”… that could effectively hinder the attackers’ progress… unless they have bots running in other parts of the world also?

  16. Sharkface217on 18 Apr 2008 at 5:12 pm

    Just a heads up, but the Wikipedia page for CNN has been updated regarding this event and Wikipedia pages for both The Dark Visitor and the Red Hacker Alliance have been created.

  17. Heikeon 18 Apr 2008 at 5:36 pm

    sharkface217,

    Thank you for telling us about this, I’ll have to take a look!

  18. seek3ron 18 Apr 2008 at 8:19 pm

    One small thing ….. if you know about it, what makes you think they (cnn) don’t? You think that cnn doesn’t have their own batch of geeks on staff?

    I figgure there is a fairly good chance that they knew about it before you did.

    This all seems faintly like another one of those “omg, theres a virus out there!” e-mail alerts to me (ref, good times and the like).

    More FUD …… not something that is needed, I think. There is enough of it in this day and age.

  19. Heikeon 18 Apr 2008 at 8:29 pm

    seek3r,

    Okay…no words. Well maybe a few…wasn’t/didn’t say that CNN wasn’t aware, they just didn’t have any reports about the upcoming attack.

  20. Al Hobbson 18 Apr 2008 at 8:35 pm

    It sounds to me like the idiots might just try it. I hope if they do some how someone will short circuit their computers

  21. Heikeon 18 Apr 2008 at 8:39 pm

    Al,

    This just might be the guy

  22. Konmingon 19 Apr 2008 at 10:00 pm

    Those numbers are QQ-group, a cross between instant messaging and IRC channel, with some similarities to internet forum.

  23. [...] UPDATE: Tried once again to contact CNN and warn them of the scheduled attack. If anyone has a bette… [...]

  24. [...] américaine : 17 avril / 18 [...]

  25. fornettion 30 Aug 2008 at 6:16 pm

    I do not believe this

  26. CyberPh34rAmaTorYon 08 Sep 2008 at 6:16 am

    Russia and China have the best hackers in the world today. The whitehats of america have not been able to block some of their attacks. September 06, 2008 – There was an attack on google, as was announced on the news that saturday morning.

    Every whitehat at an ITT that creates a way to block connections, theres always going to be a way to exploit a hole in the wall; Eventually, giving China or Russia what they need.

  27. [...] from our own little blog on the Chinese hacker attack on CNN that was scheduled for 8:00 pm on 20 April.  In 2008, 20 April was a non-work day in [...]