The Dark Visitor » Nationalism

Chinese hackers take down Russian Consulate website

Heike — Sat, 21 Feb 2009 00:42:30 +0000

Reports have emerged that the Russian Navy sank a Chinese cargo vessel impounded at the port of Nakhodka for alleged smuggling. After the Chinese ship, named New Star, left port without permission, a Russian Navy cruiser chased the ship and fired 500 rounds into the vessel causing it to sink.

Sixteen sailors from the ship boarded two lifeboats but only one was successfully rescued by the Russian Navy. The other eight men, three Chinese and five Indonesians, aboard the remaining lifeboat were lost at sea.

(If you read the mix of these two reports, the numbers differ. Other reports say it was the Russian Coast Guard and not the Russian Navy that sank the ship.)

Chinese hackers have protested the sinking of the vessel by defacing the website of the Russian Consulate in Shanghai. At this time, the consulate’s website is still down:

网站正在维护中,非常对不起给你带来不便！

The site is currently under maintenance!sorry for any inconveniences!

Сайт находится на обслуживании. Просим прощения за возможные неудобства!

Online nationalism no match for VD

Heike — Fri, 13 Feb 2009 12:46:58 +0000

The sign reads, “It is Everyone’s Responsibility to Boycott Evil Valentine’s Day.” The boys from rednet.cn think that the people should resist this foreign holiday and concentrate on their own national holidays.

In their forum on rednet.cn, the topic of boycotting Valentine’s Day sparks much interest and support…not so much in the real world. Only two or three people show up at the rally.

Dude, guys in the US have been trying for decades to get rid of this “evil” holiday with no luck. If your campaign works, let us know.

Patriotic Chinese hackers attack website of melamine poisoned children

Heike — Fri, 23 Jan 2009 21:50:43 +0000

In September, we brought you the story of Chinese hackers protesting the Sanlu Corp. for their practice of adding melamine to milk products in order to make them appear higher in protein. Melamine is not intended for human consumption and caused children in China to develop kidney stones. Many children died or suffered horribly.

Following the incident, the website jieshibaobao.com (children that developed kidney stones) was established to allow parents of victims to communicate with one another and post pictures of their children and the ordeal they endured. The website posts images of the children’s suffering and has become an advocate group for compensation.

A group of patriotic Chinese hackers have joined together to attack the website and force it down. They claim the website is illegal, posting photoshopped pictures and fabricating the condition of the patients. This casts a bad light on China’s period of prosperity and therefore, jieshibaobao.com has become the target of resentful patriotic youth.

The website was under daily attack and unable to function. Jieshibabao was forced to move their website to an overseas server in hopes of avoiding the attacks. However, the large coalition of patriotic hackers continued the attack and shut it down again.

Chinese netizens were not uniform in their support of this action. Many were solidly against it.

Old news I missed…but posting anyway

Heike — Wed, 17 Sep 2008 10:50:11 +0000

We were pretty darn busy in April, so some things fell through the cracks and I missed this report on nationalist motivated hacking. If you recall, during that time period, there were calls in France to boycott the Beijing Olympics over the crackdown in Tibet. The French magazine Capital posted an online poll on whether or not France should participate in the games…Chinese hackers and nationalists were not pleased:

Capital publisher Jean-Joel Gurviez:

“On the first day, we had about 300 responses, which was normal for this type of poll, and they were 80 percent in favour of a boycott. The next day there were 20,000 responses, with 80 percent opposing a boycott,” he said.

Almost all of the responses arrived via Chinese servers, Gurviez said, leading technicians to initially think the influx was driven by Chinese sites directing patriotic fans to vote.

“But a few days later we had hackers operating off servers in China try to change our content, and there were 2.5 million attempts to access protected files. We had to shut down the site temporarily,” he said.

China’s Cyber Warriors and nationalism

Heike — Thu, 21 Aug 2008 10:04:18 +0000

SBS Dateline reporter, George Negus, conducts an interview with Chinese hacker Yang Zhao. Yang talks about the attacks on CNN, nationalism and intrusion methods. This is the Youtube version of the video and is shorter than the version found on the SBS Dateline website.

More on anticnn.exe

jumper — Tue, 22 Apr 2008 13:31:07 +0000

CNN hating Chinese nationalists can download a tool to send high volumes of requests to www.cnn.com in an attempt to knock it offline. The tool is bundled in a .rar file that contains a readme and the pre-compiled windows binary. A quick virus check showed that some scanners identified it as backdoor but that didn’t seem to be the case. When I ran the tool, a simple flag icon appeared in the lower right of my test VM.

When I click on the flag, the full interface appears with three options: start/stop, minimize and exit.

Here is a sample of the request/response I got after running it for a few seconds:

GET /aux/con/com1/../../[LAG]../.%%%%%%%%./../../../../fakecnn/redflag-stay-here.php.aspx.asp.cfm.jsp HTTP/1.1

Accept: */*

Host: www.cnn.com

Connection: Keep-Alive

HTTP/1.1 400 Bad Request

Date: Tue, 22 Apr 2008 12:12:34 GMT

Server: Apache

Vary: Accept-Encoding

Content-Length: 287

Connection: close

Content-Type: text/html; charset=iso-8859-1

400 Bad Request

Bad Request

Your browser sent a request that this server could not understand.

Apache Server at www.cnn.com Port 80

I read somewhere that it is self-updating but I never saw any requests other than DNS resolution (to my own configured DNS servers, not hard-coded) and requests to www.cnn.com. I’ll run it in “paused” mode for a while to see what happens.

UPDATE (0100GMT 23 April 08): No suspicious traffic came from this binary (apart from what was expected, of course).

UPDATE (1628GMT 24 April 08): Heike and I have dubbed anticnn.exe the “Mao-inator”.

Anti-Fan Chinese Hackers…Feel “The Crazy!”

Heike — Fri, 18 Jan 2008 17:15:58 +0000

Never heard of this, don’t know what to make of it, not sure I even care. Anti-Fans, a phenomenon that began in Korea where large numbers of “Anti-Fans” seek to just trash and even poison celebrities. Number one targets are singers and dancers. So, the good news…it has spread to China!

This is the Taiwanese band F-4 and they got hacked by Chinese anti-fans for referring to Taiwan as a country while fiming a commercial for tourism. (Have to admit, a lot of boy-bands here in the US could use a good hacking…just kidding…sort of.)

Chinese actress Zhao Wei targeted by Chinese anti-fans for…too much hotness? No, she wore the Japanese flag.

Artist Wang Xinling, just a little too cutesy for some fans. They are anti-fans due to her winky-hand-movey antics on stage.

And for the most disturbing of all, they claim to be the Bin Laden for celebrities.

A posting at Sam, Saman, Samantha’s blog sums up my feelings quite well. But, just because they seem to have gone way past the deep end of the pool, doesn’t mean they can’t make a semi-rocking video! Enjoy (fair warning, the thing loads slow, slow, I mean really slow):

Chinese Hackers Crash 2000 Blogs

Heike — Fri, 28 Dec 2007 01:18:43 +0000

(Scroll to the bottom of the link) Reporters Without Borders is claiming that it was probably mainland Chinese hackers who used a DDOS attack on Boxun’s website to shutdown dissident postings. Not really familiar with Boxun but they have also posted the attacking IPs and the number of hits received.

People’s Armed Police Officer Hacking?

Heike — Mon, 26 Nov 2007 01:35:13 +0000

The following is the defacement of the Japanese site nishimatsu.co by a Chinese hacker named Sunwear. He used English on some lines and Chinese on others, but here is the translation with one line omitted :

(English) Hi

(Chinese) You Japanese pigs

(English) Fuck All Japan Gril (18-20)

(Chinese) I represent all the PRC men who fuck all your pretty Japanese girls from ages (18-20).

(This line illegible)

(Chinese) You all took over 300 slaves from China. I Sunwear swear that I will hack 3000 Japanese websites

(English) Destroy Japan!!!!!!

(English) By China Sunwear E-Mail btwlu@163.com (Chinese) Chinese people look, if you have a patriotic heart add my QQ 625185 and later when there is a site to hack I will give you a call.

Tracked down his website at http://hi.baidu.com/patricksunwear and did some checking around. There are only six personal pictures on the site and all appear to be the same male. Two pictures drew my attention:

The uniform he is wearing is that of the People’s Armed Police; a quasi military organization, protection of the party, and has recently started moving into anti-terror stuff. Hard to see detail but the rank insignia seems to be that of a 2nd Lieutenant.

My guess is that it is not his official duty to hack into Japanese websites, just a 2nd Lt doing what they all do… getting into more trouble than they can get out of.

UPDATE 26 Nov: After looking at the two pictures and thinking about it some more, he just may be trying on the uniform of his buddy. I don’t know, that haircut just has me thinking not in regs.

chinese hackers

From Nationalism to Commercialism

Heike — Sat, 17 Nov 2007 15:16:05 +0000

From Nationalism to Commercialism

The headlines in most major papers that cover Chinese hackers paint them as ethereal beings, invisible, coming from nowhere, invading, attacking, and then returning to their void. Media reports are filled with “Chinese hackers” involvement in one type of exploit or another, speculations about government affiliation, and the types of online crimes they have committed. What they fail to provide is background on just who comprises this secretive organization. Certainly, these spirits from a land as unfathomable as China must be impossible to locate, much less study.

The reality turns out to be considerably less mysterious and much more mundane. Chinese hackers are incredibly easy to find and provide more information about themselves than anyone reading the news could imagine. The problem is not a lack of information but an overabundance of it. The Red Hacker Alliance is producing thousands of internal documents just waiting to be translated and studied. No special computer skills are required and you do not need the ability to detect and track an intruder over countless Internet connections or jumps between satellites. It doesn’t require a government clearance with access to classified documents. The information has been sitting in the open since the very founding of the organization and it is this very information we will use to examine their history, structure, exploits, political agenda, and possible government affiliations.

While not an unbroken historic timeline, we will trace the birth of Chinese hackers on the Internet from a purely nationalistic organization, to their current situation that is rapidly expanding into commercialization and criminal activity. Before looking directly at the history of the Chinese Red Hacker Alliance, it is perhaps vital that we have an understanding of China’s past and how it affects its population’s current psyche in order to get greater insight into why these groups are so much more nationalistic than their Western counterparts.

Historically, China has endured numerous outside threats to its sovereignty and what it views as insults to national honor. This has perhaps produced a mindset more sensitive to actual and perceived injustices. Having the ability to protest against these humiliations, as is the case with Chinese hackers, must be a very potent source of empowerment. The majority of the alliance is comprised of males in their 20′s that hold the passions of youth. Being somewhat prohibited from protesting against their own society’s injustices, they are quick to retaliate against both major and minor offenses from outside sources. William Callahan’s work on the rise of Chinese nationalism stemming from the “Century of Humiliation” provides a very detailed look at these motivators pushing the rise of nationalism:

“Chinese nationalism is not just about celebrating the glories of Chinese civilization; it also commemorates China’s weakness. This negative image comes out most directly in the discourse of China’s Century of National Humiliation (Bainian guochi). Chinese books on the topic generally tell the tale of China going from being at the center of the world to being the Sick Man of Asia after the Opium War (1840), only to rise again with the Communist Revolution (1949). To understand how Chinese nationalism works, we need to reverse Paul Kennedy’s famous thesis about ‘the rise and fall of the great powers’ to examine the ‘fall and rise’ of China: Many of the titles of these books include the phrase ‘from humiliation to glory.’ The discourse of national humiliation shows how China’s insecurities are not just material, a matter of catching up to the West militarily and economically, but symbolic. Indeed, one of the goals of Chinese foreign policy has been to ‘cleanse National Humiliation.’”

Indeed this very sentiment was reflected to near perfection on the web site Iron and Blood Union, which is linked to several of the Red Hacker Alliance web sites. They articulated their philosophy as follows:

“The goal of this community: Is to grieve for the prior generation and to never forget the nation’s shame; to use history as an example for facing the future.”

While the case can be made that the government has the ability to fan the flames of patriotic zeal inside the Red Hacker Alliance, it is apparent that it already exists within the group and is not fabricated. It is also doubtful that the Chinese government is overly enthusiastic about causing major unrest in large numbers of students, who comprise a substantial portion of the hacker organization. Student led demonstrations during the May 4th Movement of 1919 and Tiananmen Square in 1989 are deeply ingrained in their memory. The case can also be made that nationalism provides a certain shield against government scrutiny and possible interference. By Chinese government standards, this is a large group of individuals with common ties that are not easily monitored or controlled. If the Chinese hacker alliance did not set very strict internal guidelines or failed to clearly show its support of the government/people, it might quickly find itself censored and broken apart. The political activist nature of the groups making up the alliance has also bolstered their reputation within China and may have perpetuated their nationalistic character.

CAUTION: The historical account that follows has been primarily pieced together from documents obtained off of Red Hacker web sites and expresses their perspective on how events began and unfolded. This note of caution should not and is not intended to cause the reader to discount the Chinese rendering of events. To the contrary, the descriptions they provide are quite compelling and introspective. As with any story, there is always the possibility of exaggeration and misinformation (not to be confused with disinformation ). The major sin that may have been committed would be that of omission and not commission. The Chinese hackers have presented us with the portion of their history that shows the strong patriotic side of the alliance and have chosen to delete that portion that did not. When deemed appropriate, comments and analysis have been added.