The Dark Visitor

They were unhappy with the Melbourne Film Festival showing a documentary of Uighur activist Rebiya Kadeer:

Chinese hackers sabotaged the website of Australia’s biggest film festival over plans to screen a documentary about a Uighur activist China accuses of stirring unrest, a report said Sunday.

Hackers attacked the Melbourne International Film Festival website on Saturday, replacing information with the Chinese flag and leaving slogans criticising exiled Uighur leader Rebiya Kadeer, The Age newspaper reported.

Someone needs to explain the thumbs up/down or star system to these guys.

In April of 2008, we reported Revenge of the Flame‘s plan to carry out a DDoS attack on the CNN website.  A series of events during that time period enraged the Chinese online community: European nations harshly criticized China’s response to the Tibetan uprising; pro-Tibetan independence protesters in Paris tried to snatch the Olympic torch from the hands of a wheelchair-bound Chinese female athlete; and Jack Cafferty, a CNN commentator, referred to Chinese products as “junk” and called the Chinese government “goons and thugs.”   In response to these insults, Anti-CNN called for overseas Chinese in Europe to wave the Chinese flag and raise their voice to the sky.

In response to these same events, a hacker, using the online name cn_magistrate, formed a group called Revenge of the Flame and announced his plan to carry out a DDoS attack on the  CNN website.  We followed the events as calls went out for Chinese netizens to join the action.  We were there when cn_magistrate called off the attack and disbaned the organization.  Then he vanished…

cn_magistrate

Cold Case:  Yeah, we keep looking.  Finally located him through a combination of e-mail address, website and online name.   Below are the results of a Whois search we conducted on the associated website during the time of the attack (Notice the website name and e-mail address):

Domain Name: hacksa.cn
ROID: 20070811s10001s50288265-cn
Domain Status: ok
Registrant Organization: 判官
Registrant Name: 判官
Administrative Email: Kenan2677@126.com
Sponsoring Registrar: 北京万网志成科技有限公司
Name Server:ns1.okidc.com Name Server:ns2.okidc.com
Registration Date: 2007-08-11 11:59
Expiration Date: 2008-08-11 11:59

Hacksa.cn website letter

The image seen above was taken from cn_magistrate’s current blog showing the old URL  hacksa.cn,  which was associated with the CNN attack.

This reply from cn_magistrate in the comments section of his blog shows the e-mail address  Kenan2677@126.com, used to register hacksa.cn.

SURPRISE…

He claims to be a Taiwanese citizen…

I’ve written to cn_magistrate and asked if he will talk to us about the incident.  Off topic, did anyone hear the news about Taiwan and the US coming closer to an extradition agreement?  That would be cool.

On 11 July 2009, Turkish hackers defaced China’s National Satellite Meteorological Center website.   Even though the motivations behind the attack were unclear, Chinese netizens viewed it as the opening salvo in an online war over Xinjiang.

On 13 July 2009, a Chinese hacker calling himself the Mafia Baron defaced the Turkish Embassy in China and posted a message on their website demanding they stay out of China’s internal affairs:

Two reasons this could end badly:

1. The Chinese online community is hailing this as the beginning of counter-attacks against Turkey and the news is spreading rapidly.  Issues involving China’s  sovereignty have a tendency to bring out nationalist sentiment.
2. The Chinese government is also lashing out at remarks made by the Turkish prime minister that could possibly be interpreted as encouragement for the hackers to take further action.

Chinese hackers are annoying, it’s a fact.  You ask a simple question trying to establish if they were the person responsible for  hacking the Turkish Embassy website and you get the run around.  Our hacker in question responds with the standard, “I’ve got no idea what you’re talking about.” ANNOYING

Then in our comments section, a Chinese hacker leaves a message saying that it was all just a crazy coincidence and this is the wrong guy.  Next, someone using a different name leaves the comment “Mafia Baron MSN:lfort@lvte.cn” without any further explanation.  ANNOYING

Continue Reading »

According to Tang Xiang, special correspondent for the World Times, a friend of the publication informed him that the Turkish Embassy in China had been hacked on the 13th.  The hacker left his message  in the website’s headline demanding that the Turkish government not interfere in China’s internal affairs.

After receiving the information, the reporter went to the website of the Turkish Embassy (turkey.org.cn) at around 15:00hrs on the same day.  The website was rather slow to load and when he went to the Chinese News Center of the website, in the top-most section were red letters furiously expressing the topic, “A letter to your country.”  The webpage displayed, Monday, 13 July 2009.   The person who left the message called himself the “Mafia Baron” of hackers and expressed this in the letter:

“The Xinjiang issue is China’s internal affair, please do not use this as a pretext to meddle in China’s internal affairs.”  He also stated that Turkish officials who had called for a boycott of Chinese goods, as well as Turkish demonstrators burning Chinese products, should not behave so radically.  However, if Turkey wanted to join the European Union to harm the Chinese people, no matter if it was the US or European Union, the Chinese people were unafraid and had the spirit and capability to overcome anything.  He hoped that the Turkish Ambassador could understand the feelings of the Chinese people.

UPDATE:  This looks like it might be the “Mafia Baron’s” website, if you move to the far right-hand side of the blog you will see the Chinese characters 黑手党男爵 (Mafia Baron).  The website is dedicated to hacking but I guess that could all be a coincidence.  Just in case, I left him a message asking if he was the one who hacked the Turkish Embassy website:

During the Olympics Games, a secret organization was formed by a Chinese hacker named Wang Zi to protect Olympic websites against foreign hackers and while they won’t say, reprisals were probably taken against offenders.

This article, from the People’s Daily, details Wang Zi’s efforts to bring back the patriotic spirit of the Red Hacker Alliance.

“The Tao that can be described in words is not the true Tao. The Name that can be named is not the true Name,” – the first two sentences of Tao Te Ching are the slogan of hong ke that appear on the new union’s new homepage.

After the Olympics, Wang Zi’s group retired from the web for a short time, and then on the first day of this year, the group made a bold new announcement.

The blurb on their newly-launched website reads, “Hong ke culture is back. We will hold and transmit hong ke spirit focusing on justice, pioneering and love for the motherland.”

Lin Lin, the leader of Evil Octal (another Chinese hacker organization), refutes Wang Zi’s claim to the title of new leader:

“Lion is the spiritual leader of the hong ke union,” Lin Lin, a leader of hacker group Eviloctal Security Team, told the Global Times. “And without him, no hong ke organization can be regarded as a reorganization of the original.

The article goes to great lengths to distance the organization from being government sanctioned:

Wang Zi says his union is a purely non-governmental organization. They could not register the union’s name with the Ministry of Industry and Information Technology until they deleted “Zhongguo” (China) from it.

Best hobby in the world.

It was absolutely my privilege to  spend a few days talking with Mara Hvistendahl on the subject of Chinese hackers.  She is such a fantastic lady and I couldn’t have enjoyed our time more.

While linking to our interview may seem a bit of shameless self-promotion, I mainly wanted it on record that Mara called me, “a trim 46-year-old.”  I pushed for other words like swashbuckling, ruggedly handsome and athletic until Mara started mentioning other adjectives such as weird, strange and goofy.

…TRIM!

Hackers: the China Syndrome by Mara Hvistendahl

Reports have emerged that the Russian Navy sank a Chinese cargo vessel impounded at the port of Nakhodka for alleged smuggling. After the Chinese ship, named New Star, left port without permission, a Russian Navy cruiser chased the ship and fired 500 rounds into the vessel causing it to sink.

Sixteen sailors from the ship boarded two lifeboats but only one was successfully rescued by the Russian Navy.  The other eight men, three Chinese and five Indonesians, aboard the remaining lifeboat were lost at sea.

(If you read the mix of these two reports, the numbers differ.  Other reports say it was the Russian Coast Guard and not the Russian Navy that sank the ship.)

Chinese hackers have protested the sinking of the vessel by defacing the website of the Russian Consulate in Shanghai.  At this time, the consulate’s website is still down:

The sign reads, “It is Everyone’s Responsibility to Boycott Evil Valentine’s Day.”  The boys from rednet.cn think that the people should resist this foreign holiday and concentrate on their own national holidays.

In their forum on rednet.cn, the topic of boycotting Valentine’s Day sparks much interest and support…not so much in the real world.  Only two or three people show up at the rally.

Dude, guys in the US have been trying for decades to get rid of this “evil” holiday with no luck.  If your campaign works, let us know.

In September, we brought you the story of Chinese hackers protesting the Sanlu Corp. for their practice of adding melamine to milk products in order to make them appear higher in protein.  Melamine is not intended for human consumption and caused children in China to develop kidney stones.  Many children died or suffered horribly.

Following the incident, the website jieshibaobao.com (children that developed kidney stones) was established to allow parents of victims to communicate with one another and post pictures of their children and the ordeal they endured.  The website posts images of the children’s suffering and has become an advocate group for compensation.

A group of patriotic Chinese hackers have joined together to attack the  website and force it down.  They claim the website is illegal, posting photoshopped pictures and fabricating the condition of the patients.  This casts a bad light on China’s period of prosperity and therefore, jieshibaobao.com has become the target of resentful patriotic youth.

The website was under daily attack and unable to function.  Jieshibabao was forced to move their website to an overseas server in hopes of avoiding the attacks.  However, the large coalition of patriotic hackers continued the attack and shut it down again.

Chinese netizens were not uniform in their support of this action.  Many were solidly against it.