The Dark Visitor

According to the chief editor of the newly launched Chinese Ministry of National Defense website, since its opening on 20 Aug 09, the site has been under assault from a variety of different types of hacker attacks.  The report notes that the attacks have not affected website operation.

Very good article from the NYT comparing social use of networks between the US and China:

Chinese broadband users above the age of 13 number 286 million, nearly double that of the U.S. broadband population, says a new report from market analysts Netpop Research. In five years, Netpop forecasts, that number will double.

Bingo, the Telegraph sums up the Chinese internet in the title of this article “China’s internet: the wild, wild East”

When it’s fun, the Chinese Net seems like a wonderfully anarchic playground; when it turns nasty, it’s a nightmare from Lord of the Flies.

In many ways, the Internet simply reflects the diversity of Chinese society offline: you can find everything from Internet groups dedicated to social and environmental causes to prostitutes who exclusively use the QQ instant messaging platform to solicit clients.

Running through the headlines this morning at PLA Daily and saw an article concerning a CNN poll that has angered Chinese netizens.  The survey asked if Ma Ying-jeou, Taiwan’s current president, should step down over his administration’s handling of typhoon Morakot.  Over 80% of the people responding felt that he should.  This poll, which has now been pulled by CNN, ran in the Taiwanese media but has since carried over into mainland forums sparking outrage.

Comments in a blog at ifeng.com,  which has been viewed 22,473 times and received 106 comments, summarizes the feeling of mainland Chinese netizens:

- Mainland China and Taiwan already have a difficult situation, I hope that Ma Ying-jeou can weather this crisis and continue his great undertaking of peaceful reunification

- Isn’t there a saying about not being “too CNN”!

- This diaster is all brought about by so-called democratic elections.  The DPP uses lawyers to rule the country and the Guomindang uses academics to rule the country, they are both horrible.  Western elections aren’t suitable to Easterners, they cause social unrest!  There isn’t anything beneficial for the people, just a bunch of thieves!!

- The US is afraid of the daily expansion in the harmonious development between the mainland and Taiwan so they increasingly exaggerate these dishonest reports!  CNN is no longer viewed as a celebrated media source to the Chinese people.   To hell with Uncle Sam!

- Don’t be too CNN

- It is because Ma Ying-jeou’s mainland policy scares CNN, they are afraid China knows what it is doing, they are afraid of reunification

- Drive the American imperialists out of China

- I first saw the CNN report on TV and a Washington Post poll that said 82% wanted Ma Ying-jeou to step down.  My first reaction was that this was a US dirty trick to oppose Ma Ying-jeou’s mainland policy.  In the evening, there were a lot of different points of view from different parties that came to the same conclusion, these reports had the same bias as the ones from 14 March and 5 June.

They just go on like that for 106 comments and remember, this is only from one website.  Here is a Google translation if you want to skim through the rest of the comments.

Kang Lingyi

According to reports, in 1999, Kang Lingyi participated in hacking the US Embassy and the White House over the accidental bombing of the Chinese Embassy in Belgrade.   He then went on to fame founding several nationalist websites.

An international controversy has broken out over an article he published on one of his websites called, the China International Strategy Net.  In the article, Kang suggests that India can be removed as a competitor by intentionally encouraging separatists to bring about the collapse of the state.  The statements caused such an uproar that the Indian government was forced to issue a statement saying that the relationship between China and India was peaceful.

As of this writing, Kang’s website has a message up saying that the site is currently under maintenance.  It has been up all day so let the wild speculations begin:

1) Beijing took it down as a concession

2) Indian hackers

3) The boring option of site maintenance          

From what I can tell, just from a quick glance, the new Ministry of National Defense website isn’t much different from the PLA Daily website.  Actually it has less information but this is a new website so it probably has to develop.  One interesting thing, the website banners are different for the English and Chinese versions:

Means absolutely nothing, except that I can tell color change and different imagery.  Hey, at my age that is a positive sign.

Maritime Girl

In November of 2008, Chinese hackers used the popularity of the the viral video “Kappa Girl” to infect an untold number of users.  In May of 2009, Chinese hackers started using pictures of the “Maritime Girl” for exactly the same purpose.

In the Mainland China Internet Security Report for the First Half of 2009, researchers examine a couple of case studies looking at the top-10 methods for spreading trojans and coming in at number four was the “Maritime Girl“.

Yin Hong, known now and probably forever as the “Maritime Girl”, was a student at the Shanghai Maritime University and posed in a series of very revealing photos for her boyfriend.  After they broke up,  the boyfriend spitefully posted the photos all over China’s interwebs.  A download frenzy ensues and Chinese hackers attach trojan malware primarily used to steal online gaming accounts.

Welcome once again to Chinese hacker social engineering 101.

China has decided to delay implementing Green Dam software.  From the WSJ:

The Chinese government may be waving a white flag in response to all the criticism of its Green Dam filtering software.

Beijing won’t force the widespread installation of the Internet filtering program on PCs and other consumer products, China’s industry minister, Li Yizhong, said Thursday…

UPDATED: At bottom

An English language news website in Shanghai reported that a denial of service attack had been launched on the site of the Shanghai license auction system on July 22. About 8000 people were hoping to get licenses for their newly purchased cars but were unable to reach the site due to the attack. The hopefuls were able to bid again the following week.

http://picasaweb.google.com/lh/photo/DIbAVRdiUxS7InsFeH8Ixw

An August 11th hackbase.cn article indicates that the attacker, 22 year-old Zhou was arrested after an intense investigation by the Public Security Bureau. The police reported that the denial of service attack involved thousands of “meat chickens”, Chinese slang for bots or zombie computers. One more time – Chinese hackers: don’t hack inside China…

Meat Chicken is slang for bot or zombie computer

UPDATE: Oh my, just a junior-high student and to top it off, Yinghacker totally smacks down the kid’s hacking skills.  Calls them “something an amateur could learn in two weeks“.  Bonus, ignore what I said before, I think Yinghacker is a female.   Perhaps I’ll post a couple of pictures of her later.

Thanks to everyone who showed up to the Dark Visitor meetup at DEFCON 17.  It was a lot of fun and I had a great time joking around and talking shop with everyone.  The only gambling that I did was deciding on the Korean BBQ place close to the con hotel – the food was pretty good and they reserved a nice area for the group (of 21) so I guess the gamble paid off. I hope everyone had as much fun as I did. There was a lot of praise for Heike’s book as well as the work we’re doing together on the blog – that was all very much appreciated. We need to convince Heike to come out to DEFCON18 next year… Come on, Vegas isn’t so bad.

I spent most of my time at the con attending presentations.  There were at least two presentations that featured a slide devoted to Xiao Tian and the Dark Visitor got mentioned in two presentations.  I think that we should setup a scholarship fund to sponsor Xiao Tian so she can come to Vegas next year and meet with us.

So I decided to put together a give away for people who attended the meetup and settled on a CD packed full of Chinese hacker papers and videos. I put a nice lightscribe label on all of them and included “The Dark Visitor” in Chinese characters. Well apparently I entered the characters rather hastily and instead of 黑客, I put 黑咯, which means Dark Cough (according to Ming Zhou). So at least I learned a new character and maybe that will be the name of the next big disease that comes out of Asia. Who knows? Maybe the flawed Dark Visitor CD will turn out to be the next ultra rare one-eyed beanie baby or something (I’ll start planting them on ebay tomorrow).

Heike and I have talked about having some TDV wearable stuff. Perhaps a Titan Rain Suit? Maybe a “Certified Great Firewall Engineer” T-Shirt? How about a Javaphile Coffee Shop baseball hat? Sunwear tanktop? Let us know what you think. We’ll think of something clever to do with the proceeds like buy Xiao Tian an HD webcam.