The Dark Visitor » Tibet

Targeted Attacks – “Is Troy Burning?”

jumper — Wed, 10 Sep 2008 13:26:55 +0000

Maarten Van Horenbeeck informed us that his recent SANS Fire 2008 presentation on targeted attacks has been released for the public. You can find it at Maarten’s website here.

You may also want to check out another presentation of his titled “Crouching PowerPoint, Hidden Trojan”.

BREAKING: Anti-CNN’s call for European protests spreading onlineBREAKING: CNN possible target of Chinese hacker attack on 19 April What?: Beijing police supplied eggs to protesters during anti-Japanese demonstrations

Heike — Wed, 16 Apr 2008 23:35:24 +0000

Anti-CNN has issued a call for the Chinese flag to wave over Europe on 19 April 2008. The call was issued to show opposition to Europe’s stance on the Tibet issue. Anti-CNN has called for all overseas Chinese in Germany, France, England and Holland to appear in a simultaneous protest. Overseas Chinese were asked to have their voices penetrate the European sky. It appears the protests may have been scheduled for April 26th, as the announcement asked for people who had already made plans, to switch them to 19 April. The protests on the 19th are scheduled as follows:

1500-1800hrs, 19 April 2008, at the Bundestag, Platz der Republik, Berlin
1300-1500hrs, 19 April 2008, two routes (from Talie – Hotel de Ville – Bastille) or (Republique – Bastille – Hotel de Ville –Bastille, Paris
1100-1500hrs, 19 April 2008, Downing Street outside of Whitehall, England
(No time given) 19 April 2008, Amsterdam, Holland

The protests appear to be well organized, with the coordination of donations, banners, flags, T-shirts…etc. While it is of course impossible to tell how widespread the demonstrations will be, an online keyword search, using Chinese, did produce several hundred hits.

To coincide with the European protests, several Chinese hacker groups are calling for a DDOS attack on the CNN website to begin at 8:00pm on 19 April 2008. While only three websites have openly posted about this attack, my guess is that many more calls are going on behind closed doors.

The first screen shot below calls for an attack similar to the Sino-US hacker war.

Could not get the web page for Tianya to open but it clearly calls for a DDOS attack on the CNN website to begin at 8:00 pm (Beijing time) on 19 April 2008.

Over at Hackbase, Dreamsmaker is also putting out the word for an attack on the CNN website.

The final tidbit of this story comes from a thread discussing the possibility of having demonstrations inside the country to support China’s position on Tibet. It was mentioned that during the anti-Japanese protests of 2005, all the people who passed out leaflets supporting the protests were punished. While some thought it was impossible to hold the demonstrations inside…a commenter calling himself…little stupid told this story:

I was in Beijing during that time, leaflets were everywhere. Although the next day they were all torn down, the schools still had them all over the place. Even the Beijing police supplied free eggs to throw at the Japanese Consulate.

UPDATE: From CNN

“Thank you for contacting CNN. This email is to notify you that your news tip has been received and will be reviewed in a timely manner. You will be contacted if the news tip is valid and we need further information and verification.

We appreciate your news tip and thank you for choosing CNN as your breaking news source.

Sincerely,

CNN Viewer Communications Management
‘CNN, The Most Trusted Name In News’

Wonder if they will check before it all goes black?

Anti-CNN Website hacked

Heike — Wed, 09 Apr 2008 04:27:57 +0000

On 8 April, the anti-cnn.com website was hacked for unknown reasons. Anti-cnn is a Chinese university student-led website established on 21 March 08, with the stated goal of countering false Western media reports on Tibet:

This website is established to expose the lies and distortions in the western media. The site is maintained by volunteers, who are not associated with any government officials.
We are not against the western media, but against the lies and fabricated stories in the media.
We are not against the western people, but against the prejudice from the western society.

According to Hackbase.com, on 9 April, the founder of the organization was using the power of Sohu.com to seek assistance from technical experts following the hacker attack. The website has received 500,000+ hits and has over 40 moderators handling in excess of 6,000 posts and 5,000 replies daily.

You know, not five minutes ago I was saying I didn’t want to get involved in the politics of this thing…just five minutes ago.

Chinese hackers and Tibet

Heike — Sun, 23 Mar 2008 21:02:48 +0000

Chinese hackers have been targeting groups such as the free Tibet
movement and Fa1un GOng for years now. Since I have been away for the last couple of days, our good friend Greg was kind enough to send links to some very good information covering the attacks.

From Thomas Claburn at Information Week:

The attacks on mailing lists and online forums contain information related to recent events in Tibet and may appear to come from a trusted person or organization.

A shadow war against organizations supporting Tibetan protesters has erupted in cyberspace, mirroring efforts by Chinese authorities to quell unrest in the Tibet.
More here…

A great article from our friend Maarten Van Horenbeeck:

There is lots of media coverage on the protests in Tibet. Something that lies under the surface, and rarely gets a blip in the press, are the various targeted cyber attacks that have been taking place against these various communities recently.

These attacks are not limited to various Tibetan NGOs and support groups. They have been reported dating back to 2002, and even somewhat before that, and have affected several other communities, including Falun Gong and the Uyghurs.

More here…

Brian Krebs at the Washington Post (an excellent investigative reporter):

Human rights and pro-democracy groups sympathetic to anti-China demonstrators in Tibet are being targeted by sophisticated cyber attacks designed to disrupt their work and steal information on their members and activities.

Alison Reynolds, director of the Tibet Support Network, said organizations affiliated with her group are receiving on average 20 e-mail virus attacks daily. Increasingly, she said, the contents of the messages suggest that someone on one or more of the member groups’ mailing lists has an e-mail account or computer that has already been compromised.

More here…

I’ll be looking into this myself over the next couple of days to see if there is anything worth adding.