<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>The Dark Visitor &#187; China internet</title>
	<atom:link href="http://www.thedarkvisitor.com/category/china-internet/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.thedarkvisitor.com</link>
	<description></description>
	<lastBuildDate>Wed, 24 Feb 2010 10:27:28 +0000</lastBuildDate>
	<generator>http://wordpress.org/?v=2.9.2</generator>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
			<item>
		<title>Shanghai Jiaotong named as a source in Google compromise</title>
		<link>http://www.thedarkvisitor.com/2010/02/shanghai-jiaotong-named-as-a-source-in-google-compromise/</link>
		<comments>http://www.thedarkvisitor.com/2010/02/shanghai-jiaotong-named-as-a-source-in-google-compromise/#comments</comments>
		<pubDate>Fri, 19 Feb 2010 15:59:35 +0000</pubDate>
		<dc:creator>jumper</dc:creator>
				<category><![CDATA[China internet]]></category>
		<category><![CDATA[US attacks]]></category>
		<category><![CDATA[Javaphile]]></category>
		<category><![CDATA[Peng Yinan]]></category>
		<category><![CDATA[SJTU]]></category>

		<guid isPermaLink="false">http://www.thedarkvisitor.com/?p=2132</guid>
		<description><![CDATA[Loyal readers of TDV may remember Heike&#8217;s post about Peng Yinan, aka Coolswallow of Javaphile.  According to this NY Times article, the school that Yinan has occasionally taught at was discovered to have been involved in the Google compromise revealed last month.  At this point, it is only the IP addresses that seem [...]]]></description>
			<content:encoded><![CDATA[<p><a href="http://www.thedarkvisitor.com/wp-content/uploads/2010/02/pengyinannew1.jpg"><img src="http://www.thedarkvisitor.com/wp-content/uploads/2010/02/pengyinannew1-300x270.jpg" alt="" title="pengyinannew1" width="300" height="270" class="size-medium wp-image-2134" /></a>Loyal readers of TDV may remember Heike&#8217;s <a href="http://www.thedarkvisitor.com/2008/06/chinese-hacker-huntingwhere-is-coolswallowericoolpeng-yinan/">post about Peng Yinan</a>, aka Coolswallow of Javaphile.  According to this <a href="http://www.nytimes.com/2010/02/19/technology/19china.html">NY Times article</a>, the school that Yinan has occasionally taught at was discovered to have been involved in the Google compromise revealed last month.  At this point, it is only the IP addresses that seem to link the school to the compromise but it is an interesting coincdence that one of the most prolific Chinese hackers has a close connection to the school.</p>
<p>There are many possibilities for SJTU&#8217;s IP addresses being involved in the incident.  Any assessments made about SJTU&#8217;s involvement at this point would be just a guess.</p>
<a class="a2a_dd addtoany_share_save" href="http://www.addtoany.com/share_save?linkurl=http%3A%2F%2Fwww.thedarkvisitor.com%2F2010%2F02%2Fshanghai-jiaotong-named-as-a-source-in-google-compromise%2F&amp;linkname=Shanghai%20Jiaotong%20named%20as%20a%20source%20in%20Google%20compromise"><img src="http://www.thedarkvisitor.com/wp-content/plugins/add-to-any/share_save_120_16.png" width="120" height="16" alt="Share/Bookmark"/></a>]]></content:encoded>
			<wfw:commentRss>http://www.thedarkvisitor.com/2010/02/shanghai-jiaotong-named-as-a-source-in-google-compromise/feed/</wfw:commentRss>
		<slash:comments>20</slash:comments>
		</item>
		<item>
		<title>PRC Gov Responses to Hacking Allegations &#8211; Timeline</title>
		<link>http://www.thedarkvisitor.com/2010/01/prc-gov-responses-to-hacking-allegations-timeline/</link>
		<comments>http://www.thedarkvisitor.com/2010/01/prc-gov-responses-to-hacking-allegations-timeline/#comments</comments>
		<pubDate>Thu, 21 Jan 2010 03:58:49 +0000</pubDate>
		<dc:creator>jumper</dc:creator>
				<category><![CDATA[China internet]]></category>
		<category><![CDATA[Other attacks]]></category>
		<category><![CDATA[UK Attacks]]></category>
		<category><![CDATA[US attacks]]></category>
		<category><![CDATA[Government]]></category>

		<guid isPermaLink="false">http://www.thedarkvisitor.com/?p=2117</guid>
		<description><![CDATA[All dates represent the date the article was published, not necesarily the date that the quote was made.
July 26, 2004
In response to accusations that the Chinese government was involved in computer intrusions against ROK government agencies
&#8220;Some media reports that the Chinese government might be behind the hacking incident are groundless&#8221; &#8211; Chinese Embassy in Seoul [...]]]></description>
			<content:encoded><![CDATA[<p>All dates represent the date the article was published, not necesarily the date that the quote was made.</p>
<p><strong>July 26, 2004</strong><br />
In response to accusations that the Chinese government was involved in computer intrusions against ROK government agencies<br />
<em>&#8220;Some media reports that the Chinese government might be behind the hacking incident are groundless&#8221;</em> &#8211; Chinese Embassy in Seoul (no personal attribution)</p>
<p><strong>December 15, 2005</strong><br />
Response to SANS comments about China being involved in world wide hacking<br />
<em>&#8220;Work units and individuals are not permitted to use the Internet to be engaged in illegal activities or commit crimes,&#8230; China has laws that make tampering with or cracking a computer&#8217;s code illegal.&#8221;</em> &#8211; Qin Gang<br />
<strong></p>
<p>August 27, 2007</strong><br />
In response to a Der Spiegel article that reported intrusions into the German governemnt<br />
<em>&#8220;The Chinese government attaches great importance to the hacker attack on the German government networks,&#8221;</em> adding China would take <em>&#8220;determined&#8221;</em> and <em>&#8220;forceful&#8221;</em> measures to combat hacker activities.  &#8211; Wen Jiabao</p>
<p><strong>August 28, 2007</strong><br />
In response to the reports of Chinese attributed intrusions into the government of Germany<br />
<em>&#8220;The Chinese government has always opposed and prohibited any criminal activity that breaks down computer networks, including hacker attacks,&#8230; China has clear rules and regulations on this.&#8221;</em> &#8211; Jiang Yu</p>
<p><strong>September 4, 2007</strong><br />
In a public response to the FT article that suggested PRC government involvement in a Pentagon intrusion<br />
<em>&#8220;The Chinese government has always opposed any Internet-wrecking crime, including hacking, and cracked down on it according to the law&#8221;</em> &#8211; An Lu (editor)</p>
<p><strong>September 10, 2007</strong><br />
Response to reports about intrusions into the French government for which the French plainly stated that they have no evidence to indicate PRC gov involvement.<br />
<em>&#8220;Saying that the Chinese military has made cyber-attacks on the networks of foreign governments is groundless and irresponsible and are a result of ulterior motives&#8221;</em> &#8211; Jiang Yu</p>
<p><strong>April 9, 2008</strong><br />
In response to Business Week&#8217;s e-Spionage article<br />
<em>&#8220;The Chinese Government always opposes and forbids any cyber crimes including &#8220;hacking&#8221; that undermine the security of computer networks. Chinese laws and regulations are explicit in this regard.&#8221;</em> &#8211; Wang Baodong</p>
<p><strong>April 1, 2009</strong><br />
In response to Ghostnet report<br />
<em>&#8220;There is a ghost called the Cold War and a virus called the Theory of China&#8217;s Threat overseas,&#8230; Some people, possessed by this ghost and infected with this virus, &#8216;fall ill&#8217; from time to time. Their attempts at using rumors to disgrace China will never succeed&#8230;  It is the ghost and the virus that should be ferreted out&#8221; </em>- Qin Gang</p>
<p><strong>May 15, 2009</strong><br />
Response to accusations of Chinese espionage in PACOM.<br />
<em>&#8220;We urge the United States to abandon Cold War mentality, stop its groundless accusations against China and do more to help build mutual trust between the United States and China and the friendship between the two peoples,&#8221; &#8211; Ma Zhaoxu<br />
&#8220;The intrusion doesn&#8217;t exist at all&#8221;</em> &#8211; Jiang Yu</p>
<p><strong>Jun 12, 2008</strong><br />
In response to reports of Chinese hacking into computers in the offices of Rep. Frank Wolf and Rep. Chris Smith.<br />
<em>&#8220;Is there any evidence? &#8230; Do we have such advanced technology? Even I don&#8217;t believe it,&#8230; I&#8217;d like to urge some people in the U.S. not to be paranoid,&#8230; They should do more to contribute to mutual understanding, trust and friendship between the U.S. and China.&#8221;</em> &#8211; Qin Gang</p>
<p><strong>January 19, 2010</strong><br />
In response to Indian allegations of Chinese hacking (following the Google intrusion)<br />
&#8220;I can say that these accusations are groundless&#8230; The Chinese government is firmly against hacking activities and will deal with relevant cases in accordance with the law&#8221; &#8211; Ma Zhaoxu</p>
<p><strong>January 22, 2010</strong><br />
In response to US Sec of State Hillary Clinton&#8217;s remarks about Internet Freedom and the Google intrusion<br />
<em>&#8220;We urge the United States to respect the facts and cease using so-called Internet freedom to make groundless accusations against China&#8221;</em> &#8211; Ma Zhaoxu<br />
<em>&#8220;China resolutely opposes Clinton&#8217;s remarks and it is not true that the country restricts online freedom&#8230;&#8221;</em> &#8211; Ma Zhaoxu</p>
<p><strong><a href="http://www.nytimes.com/2010/01/26/world/asia/26google.html?partner=rssnyt&#038;emc=rss">January 25, 2010</a></strong><br />
In response to US Sec of State Clinton&#8217;s request for a transparent investigation into the Google intrusion<br />
<em>“We are resolutely against those who make a issue of things without referring to actual facts by needlessly accusing China, ignoring Chinese laws and interfering in Chinese internal politics&#8221;</em> &#8211; unnamed spokesperson for the State Council Information Office</p>
<p><em>“As the global landscape is undergoing profound irreversible shifts, the calculated free-Internet scheme is just one step of a U.S. tactic to preserve its hegemonic domination”</em> &#8211; Yan Xuetong </p>
<p><strong><a href="http://news.yahoo.com/s/afp/20100125/wl_asia_afp/chinausitinternetgoogle6thleadwrap">January 25, 2010</a></strong><br />
Response to Google intrusion<br />
<em>The &#8220;accusation that the Chinese government participated in (any) cyberattack, either in an explicit or inexplicit way, is groundless and aims to denigrate China&#8230; We are firmly opposed to that&#8221; &#8211; unnamed spokesman for the Ministry of Industry and Information Technology to Xinhua </p>
<a class="a2a_dd addtoany_share_save" href="http://www.addtoany.com/share_save?linkurl=http%3A%2F%2Fwww.thedarkvisitor.com%2F2010%2F01%2Fprc-gov-responses-to-hacking-allegations-timeline%2F&amp;linkname=PRC%20Gov%20Responses%20to%20Hacking%20Allegations%20%26%238211%3B%20Timeline"><img src="http://www.thedarkvisitor.com/wp-content/plugins/add-to-any/share_save_120_16.png" width="120" height="16" alt="Share/Bookmark"/></a>]]></content:encoded>
			<wfw:commentRss>http://www.thedarkvisitor.com/2010/01/prc-gov-responses-to-hacking-allegations-timeline/feed/</wfw:commentRss>
		<slash:comments>26</slash:comments>
		</item>
		<item>
		<title>Freedom of Speech?  Not according to Baidu.</title>
		<link>http://www.thedarkvisitor.com/2010/01/freedom-of-speech-not-according-to-baidu/</link>
		<comments>http://www.thedarkvisitor.com/2010/01/freedom-of-speech-not-according-to-baidu/#comments</comments>
		<pubDate>Sat, 16 Jan 2010 14:00:57 +0000</pubDate>
		<dc:creator>jumper</dc:creator>
				<category><![CDATA[Censorship]]></category>
		<category><![CDATA[China internet]]></category>
		<category><![CDATA[Baidu]]></category>

		<guid isPermaLink="false">http://www.thedarkvisitor.com/?p=2112</guid>
		<description><![CDATA[One of the Chinese blogs I read had a post about this Baidu dictionary reference.

Loosely translated:  Freedom of Speech &#8211; basically not in China.  It gives a link to a board where it may have picked up this definition.  The author, greysign, laments that there are rampant lawless anti-party elements slandering China. [...]]]></description>
			<content:encoded><![CDATA[<p>One of the <a href="http://hi.baidu.com/greysign/blog/item/90c5ca16a065c813972b4394.html">Chinese blogs I read</a> had a post about this Baidu dictionary reference.</p>
<p><a href="http://www.thedarkvisitor.com/wp-content/uploads/2010/01/Picture-1.png"><img class="alignleft size-medium wp-image-2113" title="Freedom of Speech - Basically not in China" src="http://www.thedarkvisitor.com/wp-content/uploads/2010/01/Picture-1-300x185.png" alt="" width="300" height="185" /></a></p>
<p>Loosely translated:  Freedom of Speech &#8211; basically not in China.  It gives a link to a <a href="http://www.ncxys.com/viewthread.php?tid=374391">board</a> where it may have picked up this definition.  The author, greysign, laments that there are rampant lawless anti-party elements slandering China.  Is it really slander to say that there isn&#8217;t freedom of speech in China?</p>
<a class="a2a_dd addtoany_share_save" href="http://www.addtoany.com/share_save?linkurl=http%3A%2F%2Fwww.thedarkvisitor.com%2F2010%2F01%2Ffreedom-of-speech-not-according-to-baidu%2F&amp;linkname=Freedom%20of%20Speech%3F%20%20Not%20according%20to%20Baidu."><img src="http://www.thedarkvisitor.com/wp-content/plugins/add-to-any/share_save_120_16.png" width="120" height="16" alt="Share/Bookmark"/></a>]]></content:encoded>
			<wfw:commentRss>http://www.thedarkvisitor.com/2010/01/freedom-of-speech-not-according-to-baidu/feed/</wfw:commentRss>
		<slash:comments>6</slash:comments>
		</item>
		<item>
		<title>Lawyers for company ripped off by green dam targeted in spear phishing attacks</title>
		<link>http://www.thedarkvisitor.com/2010/01/lawyers-for-company-ripped-off-by-green-dam-targeted-in-spear-phishing-attacks/</link>
		<comments>http://www.thedarkvisitor.com/2010/01/lawyers-for-company-ripped-off-by-green-dam-targeted-in-spear-phishing-attacks/#comments</comments>
		<pubDate>Thu, 14 Jan 2010 03:36:52 +0000</pubDate>
		<dc:creator>jumper</dc:creator>
				<category><![CDATA[Censorship]]></category>
		<category><![CDATA[China internet]]></category>
		<category><![CDATA[cybersitter]]></category>
		<category><![CDATA[danwei]]></category>
		<category><![CDATA[Green Dam]]></category>

		<guid isPermaLink="false">http://www.thedarkvisitor.com/?p=2109</guid>
		<description><![CDATA[This is starting to get boring&#8230;
Lawyers for Cybersitter, the company that claims its intellectual property was ripped off by PRC companies that developed the green dam youth escort in home censorware are now claiming that they have been targeted in spear phishing style attacks.  Maybe the PRC companies didn&#8217;t get all of the code the [...]]]></description>
			<content:encoded><![CDATA[<p>This is starting to get boring&#8230;</p>
<p>Lawyers for Cybersitter, the company that claims its intellectual property was ripped off by PRC companies that developed the <a href="http://en.wikipedia.org/wiki/Green_Dam_Youth_Escort">green dam youth escort</a> in home censorware are now claiming that they have been targeted in spear phishing style attacks.  Maybe the PRC companies didn&#8217;t get all of the code the first time.</p>
<p>Article <a href="http://www.reuters.com/article/idUSTRE60D0C120100114">here</a> &#8211; linked from <a href="http://www.danwei.org/side/">Danwei</a> (one of my favorite China sites).</p>
<p><a href="http://www.thedarkvisitor.com/wp-content/uploads/2010/01/green-damn-girl-01.jpg"><img class="alignleft size-medium wp-image-2110" title="green-damn-girl-01" src="http://www.thedarkvisitor.com/wp-content/uploads/2010/01/green-damn-girl-01-253x300.jpg" alt="" width="253" height="300" /></a></p>
<a class="a2a_dd addtoany_share_save" href="http://www.addtoany.com/share_save?linkurl=http%3A%2F%2Fwww.thedarkvisitor.com%2F2010%2F01%2Flawyers-for-company-ripped-off-by-green-dam-targeted-in-spear-phishing-attacks%2F&amp;linkname=Lawyers%20for%20company%20ripped%20off%20by%20green%20dam%20targeted%20in%20spear%20phishing%20attacks"><img src="http://www.thedarkvisitor.com/wp-content/plugins/add-to-any/share_save_120_16.png" width="120" height="16" alt="Share/Bookmark"/></a>]]></content:encoded>
			<wfw:commentRss>http://www.thedarkvisitor.com/2010/01/lawyers-for-company-ripped-off-by-green-dam-targeted-in-spear-phishing-attacks/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Chinese hackers don&#8217;t like Iranian Diabetics</title>
		<link>http://www.thedarkvisitor.com/2010/01/chinese-hackers-dont-like-iranian-diabetics/</link>
		<comments>http://www.thedarkvisitor.com/2010/01/chinese-hackers-dont-like-iranian-diabetics/#comments</comments>
		<pubDate>Wed, 13 Jan 2010 04:52:00 +0000</pubDate>
		<dc:creator>jumper</dc:creator>
				<category><![CDATA[China internet]]></category>
		<category><![CDATA[Other attacks]]></category>
		<category><![CDATA[diabetes]]></category>
		<category><![CDATA[Iran]]></category>

		<guid isPermaLink="false">http://www.thedarkvisitor.com/?p=2105</guid>
		<description><![CDATA[In an apparent outrage at the defacing of Baidu, the great national symbol of the PRC interwebz, Chinese hackers have defaced an Iranian site that distributes information about diabetes.  Take that Iranian nationalist hackers!

]]></description>
			<content:encoded><![CDATA[<p>In an apparent outrage at the defacing of Baidu, the great national symbol of the PRC interwebz, Chinese hackers have defaced an Iranian site that distributes information about diabetes.  Take that Iranian nationalist hackers!</p>
<p><a href="http://www.thedarkvisitor.com/wp-content/uploads/2010/01/20100113100146440.jpg"><img class="alignleft size-medium wp-image-2106" title="20100113100146440" src="http://www.thedarkvisitor.com/wp-content/uploads/2010/01/20100113100146440-300x240.jpg" alt="" width="300" height="240" /></a></p>
<a class="a2a_dd addtoany_share_save" href="http://www.addtoany.com/share_save?linkurl=http%3A%2F%2Fwww.thedarkvisitor.com%2F2010%2F01%2Fchinese-hackers-dont-like-iranian-diabetics%2F&amp;linkname=Chinese%20hackers%20don%26%238217%3Bt%20like%20Iranian%20Diabetics"><img src="http://www.thedarkvisitor.com/wp-content/plugins/add-to-any/share_save_120_16.png" width="120" height="16" alt="Share/Bookmark"/></a>]]></content:encoded>
			<wfw:commentRss>http://www.thedarkvisitor.com/2010/01/chinese-hackers-dont-like-iranian-diabetics/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
		<item>
		<title>Brav[e&#124;o] Google.cn</title>
		<link>http://www.thedarkvisitor.com/2010/01/braveo-google-cn/</link>
		<comments>http://www.thedarkvisitor.com/2010/01/braveo-google-cn/#comments</comments>
		<pubDate>Wed, 13 Jan 2010 03:35:09 +0000</pubDate>
		<dc:creator>jumper</dc:creator>
				<category><![CDATA[Censorship]]></category>
		<category><![CDATA[China internet]]></category>
		<category><![CDATA[GFW]]></category>
		<category><![CDATA[google]]></category>

		<guid isPermaLink="false">http://www.thedarkvisitor.com/?p=2101</guid>
		<description><![CDATA[In what may be the most significant news posted to this blog in a long time, the Official Google Blog reports that Google will be working with the PRC government to deliver an unfiltered google.cn to users in the PRC.  If an agreement with the PRC government cannot be reached, google.cn may suspend operations.  From [...]]]></description>
			<content:encoded><![CDATA[<p>In what may be the most significant news posted to this blog in a long time, the Official Google Blog <a href="http://googleblog.blogspot.com/2010/01/new-approach-to-china.html">reports</a> that Google will be working with the PRC government to deliver an unfiltered google.cn to users in the PRC.  If an agreement with the PRC government cannot be reached, google.cn may suspend operations.  From the blog post:</p>
<blockquote><p>We have decided we are no longer willing to continue censoring our results on Google.cn, and so over the next few weeks we will be discussing with the Chinese government the basis on which we could operate an unfiltered search engine within the law, if at all. We recognize that this may well mean having to shut down Google.cn, and potentially our offices in China.</p></blockquote>
<p>This move is in response to an internal Google investigation that revealed widespread targeting and surveillance of human rights activists with interests in the PRC.  The blog indicates that there are two distinctly different problems that were uncovered.  One involved the compromise of internal Google intellectual property and the other involved the accessing of gmail accounts by unauthorized third parties.</p>
<blockquote><p>&#8230;we have discovered that the accounts of dozens of U.S.-, China- and Europe-based Gmail users who are advocates of human rights in China appear to have been routinely accessed by third parties.</p></blockquote>
<p>Google believes that the sophisticated attacks that resulted in the internal compromise of Google information have also hit more than 20 other organizations.</p>
<p>So what does this mean?  It is difficult to say at this point.  Perhaps it will draw attention to the censorship issue as well as the widespread hacking frequently attributed to the PRC government.  I think it will be unlikely that google.cn will be allowed to operate in the PRC without filtering its search results.  This may mean that google.cn will cease to exist or that it is operated outside of the PRC where it will probably get GFW&#8217;d.  Either way, Baidu wins.</p>
<p>It would be very cool if others (yahoo!, microsoft) <a href="http://news.cnet.com/8301-13860_3-10433609-56.html">follow suit</a>.</p>
<a class="a2a_dd addtoany_share_save" href="http://www.addtoany.com/share_save?linkurl=http%3A%2F%2Fwww.thedarkvisitor.com%2F2010%2F01%2Fbraveo-google-cn%2F&amp;linkname=Brav%5Be%7Co%5D%20Google.cn"><img src="http://www.thedarkvisitor.com/wp-content/plugins/add-to-any/share_save_120_16.png" width="120" height="16" alt="Share/Bookmark"/></a>]]></content:encoded>
			<wfw:commentRss>http://www.thedarkvisitor.com/2010/01/braveo-google-cn/feed/</wfw:commentRss>
		<slash:comments>6</slash:comments>
		</item>
		<item>
		<title>PRC hackers attack Iranian websites</title>
		<link>http://www.thedarkvisitor.com/2010/01/prc-hackers-attack-iranian-websites/</link>
		<comments>http://www.thedarkvisitor.com/2010/01/prc-hackers-attack-iranian-websites/#comments</comments>
		<pubDate>Tue, 12 Jan 2010 18:48:09 +0000</pubDate>
		<dc:creator>jumper</dc:creator>
				<category><![CDATA[China internet]]></category>
		<category><![CDATA[Other attacks]]></category>
		<category><![CDATA[China vs. Iran]]></category>

		<guid isPermaLink="false">http://www.thedarkvisitor.com/?p=2099</guid>
		<description><![CDATA[Several Chinese security bloggers and the Rising AV company are reporting that Chinese hackers are going after Iranian websites.  Apparently in response to the Baidu DNS compromise.
http://translate.google.com/translate?sl=auto&#38;tl=en&#38;u=http%3A%2F%2Fwww.hackbase.com%2Fnews%2F2010-01-12%2F32938.html
http://translate.google.com/translate?sl=auto&#38;tl=en&#38;u=http%3A%2F%2Fwww.hackbase.com%2Fnews%2F2010-01-12%2F32926.html
http://translate.google.com/translate?sl=auto&#38;tl=en&#38;u=http%3A%2F%2Fwww.hackbase.com%2Fnews%2F2010-01-12%2F32933.html
http://translate.google.com/translate?sl=auto&#38;tl=en&#38;u=http%3A%2F%2Fwww.hackbase.com%2Fnews%2F2010-01-13%2F32955.html
]]></description>
			<content:encoded><![CDATA[<p>Several Chinese security bloggers and the Rising AV company are reporting that Chinese hackers are going after Iranian websites.  Apparently in response to the Baidu DNS compromise.</p>
<p><a href="http://translate.google.com/translate?sl=auto&amp;tl=en&amp;u=http%3A%2F%2Fwww.hackbase.com%2Fnews%2F2010-01-12%2F32938.html">http://translate.google.com/translate?sl=auto&amp;tl=en&amp;u=http%3A%2F%2Fwww.hackbase.com%2Fnews%2F2010-01-12%2F32938.html</a></p>
<p><a href="http://translate.google.com/translate?sl=auto&amp;tl=en&amp;u=http%3A%2F%2Fwww.hackbase.com%2Fnews%2F2010-01-12%2F32926.html">http://translate.google.com/translate?sl=auto&amp;tl=en&amp;u=http%3A%2F%2Fwww.hackbase.com%2Fnews%2F2010-01-12%2F32926.html</a></p>
<p><a href="http://translate.google.com/translate?sl=auto&amp;tl=en&amp;u=http%3A%2F%2Fwww.hackbase.com%2Fnews%2F2010-01-12%2F32933.html">http://translate.google.com/translate?sl=auto&amp;tl=en&amp;u=http%3A%2F%2Fwww.hackbase.com%2Fnews%2F2010-01-12%2F32933.html</a></p>
<p><a href="http://translate.google.com/translate?sl=auto&amp;tl=en&amp;u=http%3A%2F%2Fwww.hackbase.com%2Fnews%2F2010-01-13%2F32955.html">http://translate.google.com/translate?sl=auto&amp;tl=en&amp;u=http%3A%2F%2Fwww.hackbase.com%2Fnews%2F2010-01-13%2F32955.html</a></p>
<a class="a2a_dd addtoany_share_save" href="http://www.addtoany.com/share_save?linkurl=http%3A%2F%2Fwww.thedarkvisitor.com%2F2010%2F01%2Fprc-hackers-attack-iranian-websites%2F&amp;linkname=PRC%20hackers%20attack%20Iranian%20websites"><img src="http://www.thedarkvisitor.com/wp-content/plugins/add-to-any/share_save_120_16.png" width="120" height="16" alt="Share/Bookmark"/></a>]]></content:encoded>
			<wfw:commentRss>http://www.thedarkvisitor.com/2010/01/prc-hackers-attack-iranian-websites/feed/</wfw:commentRss>
		<slash:comments>4</slash:comments>
		</item>
		<item>
		<title>Baidu pwn3d by Iranian DNS hijackers</title>
		<link>http://www.thedarkvisitor.com/2010/01/baidu-pwn3d-by-iranian-dns-hijackers/</link>
		<comments>http://www.thedarkvisitor.com/2010/01/baidu-pwn3d-by-iranian-dns-hijackers/#comments</comments>
		<pubDate>Tue, 12 Jan 2010 15:03:06 +0000</pubDate>
		<dc:creator>jumper</dc:creator>
				<category><![CDATA[China internet]]></category>
		<category><![CDATA[Baidu]]></category>
		<category><![CDATA[dns]]></category>
		<category><![CDATA[Iran]]></category>

		<guid isPermaLink="false">http://www.thedarkvisitor.com/?p=2094</guid>
		<description><![CDATA[The Iranian Cyber Army has compromised the DNS records for baidu.com by logging into their DNS management portal at register.com.  You might remember the Iranian Cyber Army from their recent twitter DNS compromise.  There are many blogs and news outlets reporting on this.
I know some readers might wonder if this will spark some sort of [...]]]></description>
			<content:encoded><![CDATA[<p>The Iranian Cyber Army has compromised the DNS records for baidu.com by logging into their DNS management portal at register.com.  You might remember the Iranian Cyber Army from their recent twitter DNS compromise.  There are many blogs and news outlets reporting on this.</p>
<p>I know some readers might wonder if this will spark some sort of cyber war between Iran and the PRC. </p>
<p>From BBC:</p>
<p><a href="http://www.thedarkvisitor.com/wp-content/uploads/2010/01/iranian_cyber_army.jpg"><img class="alignleft size-full wp-image-2095" title="iranian_cyber_army" src="http://www.thedarkvisitor.com/wp-content/uploads/2010/01/iranian_cyber_army.jpg" alt="" width="226" height="170" /></a></p>
<p><a href="http://news.bbc.co.uk/2/hi/technology/8453718.stm">http://news.bbc.co.uk/2/hi/technology/8453718.stm</a></p>
<p><a href="http://www.techcrunch.com/2009/12/17/twitter-reportedly-hacked-by-iranian-cyber-army/">http://www.techcrunch.com/2009/12/17/twitter-reportedly-hacked-by-iranian-cyber-army/</a></p>
<a class="a2a_dd addtoany_share_save" href="http://www.addtoany.com/share_save?linkurl=http%3A%2F%2Fwww.thedarkvisitor.com%2F2010%2F01%2Fbaidu-pwn3d-by-iranian-dns-hijackers%2F&amp;linkname=Baidu%20pwn3d%20by%20Iranian%20DNS%20hijackers"><img src="http://www.thedarkvisitor.com/wp-content/plugins/add-to-any/share_save_120_16.png" width="120" height="16" alt="Share/Bookmark"/></a>]]></content:encoded>
			<wfw:commentRss>http://www.thedarkvisitor.com/2010/01/baidu-pwn3d-by-iranian-dns-hijackers/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
		<item>
		<title>Individuals can no longer register domains with .cn TLD</title>
		<link>http://www.thedarkvisitor.com/2009/12/individuals-can-no-longer-register-domains-with-cn-tld/</link>
		<comments>http://www.thedarkvisitor.com/2009/12/individuals-can-no-longer-register-domains-with-cn-tld/#comments</comments>
		<pubDate>Mon, 14 Dec 2009 03:36:26 +0000</pubDate>
		<dc:creator>jumper</dc:creator>
				<category><![CDATA[China internet]]></category>

		<guid isPermaLink="false">http://www.thedarkvisitor.com/?p=2074</guid>
		<description><![CDATA[Only verified businesses can register .cn domains now.]]></description>
			<content:encoded><![CDATA[<p><img class="alignleft size-full wp-image-2077" title=".cn malware redirect" src="http://www.thedarkvisitor.com/wp-content/uploads/2009/12/Picture-3.png" alt=".cn malware redirect" width="300" height="20" /></p>
<p>The .cn Top Level Domain has been frequently associated with malware, pornography and spamvertising.  In an apparent effort to clean up the TLD, China NIC has started requiring a business license in order to register a .cn domain.</p>
<blockquote><p>The China Internet Network Information Center (CNNIC) published a notice Sunday saying that applicants must submit written applications to the registration agents. The written materials must include an application form with an official seal, an enterprise business license and the registrant&#8217;s ID card.</p></blockquote>
<p>In addition, the NIC will actually attempt to notify and verify individually owned .cn sites.  If a site owner doesn&#8217;t respond in after five days, the domain will be revoked.</p>
<blockquote><p>CNNIC plans to verify the information of the owners of personal site in the nation. Those found unqualified to have a site will be required to update the information in five working days, otherwise they will be shut down.</p></blockquote>
<p>This is an interesting development.  Clearly, something needed to be done about the .cn TLD garbage sites clogging up the tubes.  I&#8217;m not sure what this means for individual site operators though.  I&#8217;m sure it is still possible for individuals within the PRC to get a non-cn TLD and host their websites outside of the mainland.</p>
<p><strong>Source: </strong>&#8220;All .cn websites require business license&#8221; &#8211; <a href="http://business.globaltimes.cn/china-economy/2009-12/491515.html">http://business.globaltimes.cn/china-economy/2009-12/491515.html</a> &#8211; Linked from <a href="http://www.danwei.org/side/2009/12/13-week/#013087">Danwei</a>.</p>
<a class="a2a_dd addtoany_share_save" href="http://www.addtoany.com/share_save?linkurl=http%3A%2F%2Fwww.thedarkvisitor.com%2F2009%2F12%2Findividuals-can-no-longer-register-domains-with-cn-tld%2F&amp;linkname=Individuals%20can%20no%20longer%20register%20domains%20with%20.cn%20TLD"><img src="http://www.thedarkvisitor.com/wp-content/plugins/add-to-any/share_save_120_16.png" width="120" height="16" alt="Share/Bookmark"/></a>]]></content:encoded>
			<wfw:commentRss>http://www.thedarkvisitor.com/2009/12/individuals-can-no-longer-register-domains-with-cn-tld/feed/</wfw:commentRss>
		<slash:comments>5</slash:comments>
		</item>
		<item>
		<title>Piloyd worm pwning exe, asp and html files in PRC</title>
		<link>http://www.thedarkvisitor.com/2009/11/piloyd-worm-pwning-exe-asp-and-html-files-in-prc/</link>
		<comments>http://www.thedarkvisitor.com/2009/11/piloyd-worm-pwning-exe-asp-and-html-files-in-prc/#comments</comments>
		<pubDate>Tue, 24 Nov 2009 18:49:59 +0000</pubDate>
		<dc:creator>jumper</dc:creator>
				<category><![CDATA[China internet]]></category>
		<category><![CDATA[Other attacks]]></category>

		<guid isPermaLink="false">http://www.thedarkvisitor.com/?p=2069</guid>
		<description><![CDATA[HT to Sunbelt for this article about the piloyd worm jacking up web pages in the PRC.  Not enough details yet to determine the vector.  According to Sunbelt&#8217;s article, it is 8/41 on virustotal.com.  I&#8217;ll update this post if I&#8217;m able to collect a sample for analysis.
Here are some details from  threatexpert.com.
]]></description>
			<content:encoded><![CDATA[<p>HT to <a href="http://sunbeltblog.blogspot.com/2009/11/piloyd-worm-running-amok-in-china.html?utm_source=feedburner&amp;utm_medium=feed&amp;utm_campaign=Feed%3A+SunbeltBlog+%28Sunbelt+BLOG%29&amp;utm_content=Google+Feedfetcher">Sunbelt</a> for this <a href="http://www.theinquirer.net/inquirer/news/1563029/china-warns-virus">article</a> about the piloyd worm jacking up web pages in the PRC.  Not enough details yet to determine the vector.  According to Sunbelt&#8217;s article, it is 8/41 on virustotal.com.  I&#8217;ll update this post if I&#8217;m able to collect a sample for analysis.</p>
<p>Here are some details from  <a href="http://www.threatexpert.com/report.aspx?md5=0878b4eec59c783cf494196ac392cc3d">threatexpert.com</a>.</p>
<a class="a2a_dd addtoany_share_save" href="http://www.addtoany.com/share_save?linkurl=http%3A%2F%2Fwww.thedarkvisitor.com%2F2009%2F11%2Fpiloyd-worm-pwning-exe-asp-and-html-files-in-prc%2F&amp;linkname=Piloyd%20worm%20pwning%20exe%2C%20asp%20and%20html%20files%20in%20PRC"><img src="http://www.thedarkvisitor.com/wp-content/plugins/add-to-any/share_save_120_16.png" width="120" height="16" alt="Share/Bookmark"/></a>]]></content:encoded>
			<wfw:commentRss>http://www.thedarkvisitor.com/2009/11/piloyd-worm-pwning-exe-asp-and-html-files-in-prc/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
	</channel>
</rss>
