[prev in list] [next in list] [prev in thread] [next in thread]
List: isn
Subject: [ISN] [defaced-commentary] Cyberwar with China: Self-fulfilling
From: InfoSec News <isn () C4I ! ORG>
Date: 2001-04-30 1:53:55
[Download RAW message or body]
---------- Forwarded message ----------
Date: Sun, 29 Apr 2001 16:48:37 -0600 (MDT)
From: security curmudgeon <jericho@attrition.org>
To: defaced-commentary@attrition.org
Subject: [defaced-commentary] Cyberwar with China: Self-fulfilling Prophecy
Cyberwar with China: Self-fulfilling Prophecy, by Attrition.org
HTML copy: http://attrition.org/security/commentary/cn-us-war.html
Disclaimer: 1999, 2000, 2001 Copyright Brian Martin
Permission is granted to quote, reprint or redistribute provided the text
is not altered, and the author and attrition.org is credited. The opinions
expressed in this text are not necessarily the opinion of all Attrition
staff members.
=-=-=-=-=-=-=-=
Cyberwar with China: Self-fulfilling Prophecy
Voltaire once wrote, "If God didn't exist, Man would have to invent Him."
It would seem that the popular press has taken this axiom and turned it on
its ear. At the time of this writing, we are inundated with Chicken
Little style warnings of an impending "cyberattack" by Chinese crackers.
These cautionary tales may or may not be real, but they are real in their
consequence.
A recent Wired News article
http://www.wired.com/news/politics/0,1283,43134,00.html warns the
cyber-going public of an impending "week-long all-out crack attack on
American websites and networks" by Chinese hackers during the first week
of May. The logic? May 1st is "May Day" celebrated in China, May 4th is
"Youth Day" in China (all those Chinese script kiddies will be feeling
wholly patriotic) and May 7th is the anniversary of the US "accidental"
bombing of the Chinese Embassy in Belgrade.
Holy fortune cookie, Batman! Could this be the end of the Internet in
America??
No, not really. Just the collective dick-waving of a bunch of
script-kidiots fueled by so-called journalists generating media hype - the
former trying to feed their egos and the latter to feed their hit counts.
According to the Wired News article, the Chinese crackers are pissed off
at the defacement of over three hundred Chinese Web sites by American
and/or other allegedly pro-American groups, as well as the loss of a
Chinese pilot in the recent spy plane incident.
Breakout of Chinese defaced web sites:
http://attrition.org/mirror/attrition/cn.html
The Wired article refers to sites that the Chinese hacker claims were
defaced in the name of China - but we could only find two defaced mirrors
that may qualify. Note that we could not verify if these were done by
Chinese hacker groups or by others looking to inflame the situation (thus
generating media attention):
http://www.attrition.org/mirror/attrition/2001/04/10/www.iplexmarin.com/
http://www.attrition.org/mirror/attrition/2001/04/28/www.feasibility.com/
Chinese hacker Jia En Zhu offers his explanation for the lack of
defacement evidence in another Wired article
http://www.wired.com/news/politics/0,1283,42982,00.html
According to Zhu, the United States government is not reporting attacks to
"save their own face."
Here's a clue for the Chinese hackers: last we checked, the U.S.
government does not maintain a defacement mirror. Attrition sure as hell
doesn't censor the defacements and we've mirrored plenty of US government
and military defacements in our time. However, we have a hard enough time
verifying the defacements we *are* informed about without going out and
actively looking for them. Of course, not every site that is defaced gets
mirrored. Sometimes we miss some while we are busy having a life - and we
won't just take someone's word for it that a site was defaced - we must
see them defaced for ourselves before we will mirror them or have
confirmation from a party we trust.
Well, now that we have been notified about the impending Mayday defacement
spree, we'll be sure to stock up on the Kleenex and hand lotion. *yawn*
To us at Attrition, it's just another week of mirror duty. However, we
were rather amused at how easily Wired ran with this story and how little
backing and substance it really contained. Do online news outlets have
fact-checking? According to the Wired story, everyone has some
"hacktivist" agenda.
It's interesting to note that Chinese web sites were being defaced before
the spy plane incident and with no political agenda. The hacker known as
"Pr0phet" was on a rant about all the NT systems that were being defaced
and was targeting Unix systems instead. Since most Chinese sites seem to
run some version of Unix, they were a natural target. It was only after
the media attention over the spy plane incident that Pr0phet included a
political message.
Federal agencies are now issuing warnings about the impending attacks and
generating headlines on CNN:
http://www.cnn.com/2001/TECH/internet/04/26/hacker.warning/index.html
No doubt the media attention to a bunch of script-kidiots will result in
an increase in web defacements over the next week or so. What's really
puzzling is the assumption that web defacements are solely motivated by a
political event such as the spy plane incident. Why is a warning
necessary? Just looking at the statistics of the increase in web
defacements should tell anyone with half a brain that they should take
measures to protect their site regardless of an advance warning. However,
we sincerely hope that the warnings will result in web administrators
taking an active interest in securing their sites so that we have less
work to do. Hey - we can dream.
Analysis of Defacements and Timeline
Our commentary on the defacements was inspired by our observations of the
following trends. As always, we encourage readers to view the complete
mirror (as well as the mirrors of other sites, such as www.alldas.de and
www.safemode.org), and draw your own conclusions. However, it is our
opinion that web sites should *always* be prepared for attacks and that
there are much more serious threats to IT infrastructures that simple web
defacements.
Mar 30 - First poizonbox Chinese (.cn) defacement in 2001:
http://attrition.org/mirror/attrition/2001/03/30/www.travelsichuan.gov.cn/
Apr 1 - U.S. spy plane lands after collision with Chinese jet:
http://www.cnn.com/2001/US/04/01/us.china.plane.02/index.html
Apr 1 - US banking site anchorbank.com is defaced by Hackers Union of China/Li0n
Crew with an anti-Japanese message. No mention of the spy plane or U.S.
http://www.attrition.org/mirror/attrition/2001/04/01/www.anchorbank.com/
Apr 10 - The American site iplexmarin is allegedly defaced by Chinese
hackers. While we don't doubt that Chinese hackers are capable of doing
this, the English used seems a little too polished:
http://www.attrition.org/mirror/attrition/2001/04/10/www.iplexmarin.com/
Apr 11 - First Wired article "A Chinese Call to Hack U.S."
http://www.wired.com/news/politics/0,1283,42982,00.html
Apr 1 through Apr 13 - Poisonb0x has 10 defacement entries (some mass
hacks) of random sites, including a senior citizen's art group. (that's
"hactivism" for you):
http://www.attrition.org/mirror/attrition/2001/04/13/www.seniorsignatures.com/
Apr 14 - First poizonb0x defacement of a Chinese site after spy plane
incident. Used the standard poizonb0x template - no reference to the
incident or indication that this was anything but a random defacement:
http://attrition.org/mirror/attrition/2001/04/14/www.aviation407.com.cn/
Apr 14 through Apr 19 - Poisonbox targets many Chinese sites, but still
uses standard template.
Apr 18 - Second Wired article "Crackers expand Private War", which refers to
Chinese targeted defacements by Poisonbox and Pr0phet
http://www.wired.com/news/politics/0,1283,43134,00.html
Apr 19 - poizonb0x starts defacing Chinese sites with anti-cn graphic
http://attrition.org/mirror/attrition/2001/04/19/www.metro.com.cn/mirror.html
Pr0phet
It should be noted that Pr0phet was targeting Chinese sites before the spy
plane incident and that he did not seem to be looking for media attention.
He got it anyway.
Mar 07 - First defacement of a Chinese site:
http://attrition.org/mirror/attrition/2001/03/07/hbepc.com.cn/
(various random defacements of Chinese sites)
Mar 14 - Pr0phet defaces a Chinese site with a statement that he is
targeting Chinese sites, apparently because they are not NT (which he
seems to consider unchallenging):
http://attrition.org/mirror/attrition/2001/03/14/www.jnws.gov.cn/
Apr 01 - Same day as spy plane collision, no cn/political reference:
http://attrition.org/mirror/attrition/2001/04/01/www.bjzw.com.cn/
Apr 02 - Day after collision, no political statement. Instead, another
commentary on NT defacements:
http://attrition.org/mirror/attrition/2001/04/02/www.dragonpulse.com.cn/
Apr 11 - First Wired Article
Apr 11 - Pr0phet makes first political reference:
http://attrition.org/mirror/attrition/2001/04/11/www.yancheng.cngb.com/
Apr 12 - Second political reference by Pr0phet:
http://attrition.org/mirror/attrition/2001/04/12/dial.pku.edu.cn/
Apr 18 - Second Wired story that refers to Pr0phet's defacements
Apr 19 - Pr0phet lashes out at media over reporting on him defacing
Chinese sites. States that he *has* no political motivation.
http://attrition.org/mirror/attrition/2001/04/19/www.shtdu.edu.cn/
Apr 19 - Pr0phet defaces another site with a statement in response to the
media attention that he is not a political hactivist:
http://attrition.org/mirror/attrition/2001/04/19/www.121.com.cn/
Apr 25 - Pr0phet returns to random cn defacing
http://attrition.org/mirror/attrition/2001/04/25/www.zd.brim.ac.cn/
Apr 28 - Pr0phet comments on the so-called "Cyberwar":
http://attrition.org/mirror/attrition/2001/04/28/www.yq.zj.cninfo.net/
Apr 28 - Interview with Pr0phet
http://www.securitynewsportal.com/article.php?sid=174&mode=thread&order=0
Apr 28 - Securitynewsportal posts a thread stating that "the FBI has
turned up the heat to 'hand the heads of PoisonBOx and Prophet over to the
Chinese' to try to quell the pending May 1st cyberwar." They offer no
substantiating proof for this claim:
http://www.securitynewsportal.com/article.php?sid=169&mode=thread&order=0
Apr 29 - Pr0phet makes a statement in response to the story that the FBI
wants to hand him and Poisonbox over to the Chinese to keep peace:
http://www.attrition.org/mirror/attrition/2001/04/29/starinfo.online.tj.cn/
So looking at the timelines of both pr0phet and poisonb0x, it is fairly
clear that neither had a real political agenda. There was a 10 day window
between the spy plane incident and first Wired article in which neither
group made any political reference. It was only AFTER the Wired article(s)
that the message began to take a political slant at all. This is a clear
case of Wired taking a story with no substance and creating news out of
nothing. A self fufilling prophecy.
More defacers jump on the media bandwagon:
Apr 10 - Hackweiser hits Chinese site with anti-Chinese rhetoric
http://www.attrition.org/mirror/attrition/2001/04/10/www.fjirsm.ac.cn/
Apr 25 - Hi-Tech Hate "we will hate china forever"
http://attrition.org/mirror/attrition/2001/04/25/www.nuclear.cetin.net.cn/
Apr 26 - acidklown (who hasn't defaced since Oct 2000)
http://www.attrition.org/mirror/attrition/2001/04/26/www.sheyang.gov.cn/
http://www.attrition.org/mirror/attrition/2001/04/26/www.grain.gov.cn/
http://www.attrition.org/mirror/attrition/2001/04/26/www.juxian.gov.cn/
http://www.attrition.org/mirror/attrition/2001/04/26/www.fn.gov.cn/
Apr 26 - Always on the ball, the NIPC releases an advisory warning of
impending web site defacements:
http://www.nipc.gov/warnings/advisories/2001/01-009.htm
Apr 26 - Hackweiser hits Chinese site and spews out more anti-Chinese crap
http://www.attrition.org/mirror/attrition/2001/04/27/www.stats.gov.cn/
Apr 27 - WoH states that they are just hitting Chinese sites because
Pr0phet wants them to and it's something to do:
http://www.attrition.org/mirror/attrition/2001/04/27/www.xxinfo.ha.cn/
Apr 27 - HUC and L10n Crew are Chinese hacker groups that authored the
Li0n Worm (which emails sensitive data to a site in China). See analysis
of the Li0n worm for more background detail and motivations:
http://whitehats.com/library/worms/lion/index.html
Apr 27 - HUC defacement of a Brazilian site, not US. No political
statement.
http://www.attrition.org/mirror/attrition/2001/04/27/www.logika.com.br/
Apr 28 - SilverOnFire deface U.S. Court of Appeals site with a statement
that they are siding with China:
http://www.attrition.org/mirror/attrition/2001/04/28/www.8thcoa.courts.state.tx.us/
Apr 29 - Hacker Union of China changes their political target to U.S.
Guess there's more press in that:
http://www.attrition.org/mirror/attrition/2001/04/28/www.mcicenter.com/
Apr 29 - Hackweiser also makes a statement:
http://www.attrition.org/mirror/attrition/2001/04/29/www.hnet.net.cn/
Apr 29 - WoH defaces a Chinese site. No political message:
http://www.attrition.org/mirror/attrition/2001/04/29/www.hanzhong.sn.cn/
As with any high-profile incident involving hacking or "cyber warfare",
security companies and some law enforcement bodies (NIPC) will no doubt
scramble to pimp their latest and greatest 'original' solutions for
protecting your site. Falling into the old routine of reactionary
security, they will hypocritically proclaim their products or services
would solve these probems if they had been utilized before the damage was
done, blah blah blah.
In the next week, things will get worse before they get better. Defacers
will keep hitting sites for one reason or another. In some rare cases,
they might actually have an agenda above and beyond the thrill of petty
vandalism. We're not holding our breath for anything so profound though.
Next week's defacements will be the next chapter in this over-hyped
'Ginger-esque' book.
-
The information and commentary is Copyright 2001, by the individual author.
Permission is granted to quote, reprint or redistribute provided the text is not
altered, and the author and attrition.org is credited. The opinions expressed
in this mail are not necessarily the opinion of all Attrition staff members.
Commentary Archive: http://www.attrition.org/security/commentary/
The Attrition Mirror: http://www.attrition.org/mirror/attrition/
Country/TLD Statistics: http://www.attrition.org/mirror/attrition/country.html
Attrition Defacement Statistics: http://www.attrition.org/mirror/attrition/stats.html
Operating System Graphs: http://www.attrition.org/mirror/attrition/os-graphs.html
Other Web Defacement Mailing Lists: http://www.attrition.org/security/lists.html
Contacting Attrition Staff: staff@attrition.org
To subscribe to Defaced Commentary, send mail to majordomo@attrition.org
with "subscribe defaced-commentary" in the BODY of the mail (without
quotes). To unsubscribe, include "unsubscribe defaced-commentary" in
the BODY of the mail.
ISN is hosted by SecurityFocus.com
---
To unsubscribe email LISTSERV@SecurityFocus.com with a message body of
"SIGNOFF ISN".
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic