The Dark Visitor

UPDATED: At bottom

An English language news website in Shanghai reported that a denial of service attack had been launched on the site of the Shanghai license auction system on July 22. About 8000 people were hoping to get licenses for their newly purchased cars but were unable to reach the site due to the attack. The hopefuls were able to bid again the following week.

http://picasaweb.google.com/lh/photo/DIbAVRdiUxS7InsFeH8Ixw

An August 11th hackbase.cn article indicates that the attacker, 22 year-old Zhou was arrested after an intense investigation by the Public Security Bureau. The police reported that the denial of service attack involved thousands of “meat chickens”, Chinese slang for bots or zombie computers. One more time – Chinese hackers: don’t hack inside China…

Meat Chicken is slang for bot or zombie computer

UPDATE: Oh my, just a junior-high student and to top it off, Yinghacker totally smacks down the kid’s hacking skills.  Calls them “something an amateur could learn in two weeks“.  Bonus, ignore what I said before, I think Yinghacker is a female.   Perhaps I’ll post a couple of pictures of her later.

Chinese authorities arrested two people in connection with the hacking theft of approximately $360,000 US dollars from online South Korean bank accounts.  Since March of 2008, the two hackers had managed to access the accounts of 86 South Korean nationals:

Piao and Jin, both aged 27, were residents in Yanji, capital city of the prefecture. They were detained by local police on June 16 and 27, respectively. They transferred the stolen money through foreign exchange brokers into a bank in Yanbian.

Chinese hackers have once again attempted to disrupt the Melbourne International Film Festival but went left of target and defaced the Melbourne International Arts Festival website.   Hey, those sites have darn near the same name, could happen to anyone:

Meanwhile, Melbourne International Arts Festival general manager Vivia Hickman said it received reports from patrons that its website had been hacked yesterday evening.

The Chinese flag sits in the middle of the hacked webpage and a message reads: “The manifesto of the hacker: maintains the reunification of the motherland. Guards the national sovereignty”.

Online sales for the Melbourne Film Festival’s showing of the “Ten Conditions of Love” have been halted due to an attack on the website ticketing system by Chinese hackers.  According to AFP:

Chinese hackers crashed the website of Australia’s biggest film festival, organisers said on Saturday, escalating tensions over a visit here by the exiled leader of the Uighur minority.

Online bookings for the Melbourne International Film Festival had to be shut down after the site was bombarded with phony purchases which resulted in the entire program being sold out, said festival spokeswoman Asha Holmes.

The Chinese hacker who defaced the Melbourne Film Festival website signed his message of protest with the sid Oldjun.  To obscure his online identity, he named his personal website…Oldjun.com.  Some people just don’t care about their chosen profession and it shows.

Even the people who have stopped by Oldjun’s blog are dismayed by his total disregard for anonymity.   They point out that his personal info is all over Baidu and his blog site.   It gives away his surname, age, where he went to school and ID number.  They joke telling him to run and hide.

Huanqiu.com tracked Oldjun down using a Whois lookup on the website and got him to confess:

After tracing the domain name Oldjun, The Sunday Age spoke to Zhou Yu, 24, an IT professional from Nanjing, who admitted hacking the site after learning about the controversy from the internet.

Mr Zhou denied acting on behalf of the Chinese Government, stating he acted ‘because I am Chinese. I’m very angry — not only me, but I think all of the Chinese people— about this.’

As an added bonus, our old friend Sunwear shows up in the comments section.  My theory still holds that if Sunwear is present, something bad is happening.

They were unhappy with the Melbourne Film Festival showing a documentary of Uighur activist Rebiya Kadeer:

Chinese hackers sabotaged the website of Australia’s biggest film festival over plans to screen a documentary about a Uighur activist China accuses of stirring unrest, a report said Sunday.

Hackers attacked the Melbourne International Film Festival website on Saturday, replacing information with the Chinese flag and leaving slogans criticising exiled Uighur leader Rebiya Kadeer, The Age newspaper reported.

Someone needs to explain the thumbs up/down or star system to these guys.

On 11 July 2009, Turkish hackers defaced China’s National Satellite Meteorological Center website.   Even though the motivations behind the attack were unclear, Chinese netizens viewed it as the opening salvo in an online war over Xinjiang.

On 13 July 2009, a Chinese hacker calling himself the Mafia Baron defaced the Turkish Embassy in China and posted a message on their website demanding they stay out of China’s internal affairs:

Two reasons this could end badly:

1. The Chinese online community is hailing this as the beginning of counter-attacks against Turkey and the news is spreading rapidly.  Issues involving China’s  sovereignty have a tendency to bring out nationalist sentiment.
2. The Chinese government is also lashing out at remarks made by the Turkish prime minister that could possibly be interpreted as encouragement for the hackers to take further action.

It is being reported that on 14 July 2009, more than ten police officers entered the China Hacker Union (77169.com) and took away members in order to question them about their role in breaking the Green Dam filtering software.

The head of China Hacker Union, “Strange Dog,” was taken away by police, while company personnel were interrogated and photographed.  All of the company’s hard drives were removed and brought back for investigation.   It is said that staff personnel at China Hacker Union have confirmed the story.

The article also points out that the arrest might be related to their other hacking activity. As of this posting, the 77169.com website is still down.

Chinese hackers are annoying, it’s a fact.  You ask a simple question trying to establish if they were the person responsible for  hacking the Turkish Embassy website and you get the run around.  Our hacker in question responds with the standard, “I’ve got no idea what you’re talking about.” ANNOYING

Then in our comments section, a Chinese hacker leaves a message saying that it was all just a crazy coincidence and this is the wrong guy.  Next, someone using a different name leaves the comment “Mafia Baron MSN:lfort@lvte.cn” without any further explanation.  ANNOYING

Continue Reading »

According to Tang Xiang, special correspondent for the World Times, a friend of the publication informed him that the Turkish Embassy in China had been hacked on the 13th.  The hacker left his message  in the website’s headline demanding that the Turkish government not interfere in China’s internal affairs.

After receiving the information, the reporter went to the website of the Turkish Embassy (turkey.org.cn) at around 15:00hrs on the same day.  The website was rather slow to load and when he went to the Chinese News Center of the website, in the top-most section were red letters furiously expressing the topic, “A letter to your country.”  The webpage displayed, Monday, 13 July 2009.   The person who left the message called himself the “Mafia Baron” of hackers and expressed this in the letter:

“The Xinjiang issue is China’s internal affair, please do not use this as a pretext to meddle in China’s internal affairs.”  He also stated that Turkish officials who had called for a boycott of Chinese goods, as well as Turkish demonstrators burning Chinese products, should not behave so radically.  However, if Turkey wanted to join the European Union to harm the Chinese people, no matter if it was the US or European Union, the Chinese people were unafraid and had the spirit and capability to overcome anything.  He hoped that the Turkish Ambassador could understand the feelings of the Chinese people.

UPDATE:  This looks like it might be the “Mafia Baron’s” website, if you move to the far right-hand side of the blog you will see the Chinese characters 黑手党男爵 (Mafia Baron).  The website is dedicated to hacking but I guess that could all be a coincidence.  Just in case, I left him a message asking if he was the one who hacked the Turkish Embassy website: