[ISN] FBI Confirms Chinese Attacks on U.S. Web Sites

From: InfoSec News (isnat_private)
Date: Tue Apr 17 2001 - 23:06:38 PDT

  • Next message: InfoSec News: "[ISN] Carko Information"

    http://dailynews.yahoo.com/h/nf/20010417/tc/9028_1.html
    
    By Robyn Weisman,
    NewsFactor.com
    Tuesday April 17, 2001
    
    The Federal Bureau of Investigation on Monday confirmed past hack
    attacks on several U.S. Web sites, and said that perhaps several more
    have been perpetrated by Chinese hacktivists protesting U.S. actions
    in the recently-ended spy plane crisis.
    
    Although the FBI declined to offer specific details about the hacked
    sites, news sources have learned that hackers have defaced two U.S.
    Navy sites, neither of them classified, and two e-businesses that
    don't appear to have any connection to the crisis.
    
    The hack attacks reportedly include condemnations of American
    imperialism and eulogies for Wang Wei, the Chinese fighter pilot
    believed to have been killed when his jet collided with a U.S. spy
    plane.
    
    "All that we are aware of is an intrusion emanating from abroad," said
    FBI spokesperson Debbie Weierman. "We are coordinating with
    appropriate government agencies."
    
    Random Attacks
    
    "We discovered that the home page on one of our sites had been
    replaced with a posting of a Chinese flag, with some rhetoric in
    Chinese and English," Dan Olasin, president of Intelligent Direct, a
    company that sells maps online, told news sources.
    
    "It would have been more productive in the scheme of things if the
    hackers had been interested in exchanging ideas on the Internet
    somehow, rather than resorting to attacks like these."
    
    Frank Prince, an analyst with Forrester Research, told NewsFactor
    Network that such a benign site "may just be a target of opportunity"
    that had no apparent relevance to the conflict at hand.
    
    "The terrorist has a bomb in the truck set to go off at 1 p.m.," said
    Prince, citing an analogy. "He's driving to the target but traffic is
    heavy and he's late. So at 12:59 he drives into the nearest building
    and blows it up. Should the building owner have to put up barricades
    against truck bombs?"
    
    "Should the government put cameras on every corner to track
    terrorists?" Prince added. "What aspect of the problem do you want to
    focus on?"
    
    'Hackers Union' Takes Credit
    
    The "Hackers Union of China" took credit on Monday for defacing at
    least one American Web site, of a California-based business, and has
    posted a list of at least 10 more sites hacked in memory of the dead
    pilot.
    
    On the American Web site, text left by the hacking group read: "As we
    are Chinese, we love our motherland and its people deeply. We are so
    indignant about the intrusion from the imperialism. The only thing we
    could say is that, when we are needed, we are ready to devote anything
    to our motherland, even including our lives."
    
    'Vulnerable' Sites Targeted
    
    SecurityFocus.com incident analyst Ryan Russell expressed scorn
    regarding the hacker group.
    
    "They are supposedly protesting the U.S. plane, and yet they are
    picking on some sites that have nothing at all to do with anything
    vaguely military," Russell told NewsFactor.
    
    "They defaced a few pages just because they were vulnerable and
    appeared to be in the U.S."
    
    "Recently, we checked the records in our ARIS system for attacks
    originating in China, for the two weeks following the downed plane,"
    said Russell. "There was no significant increase."
    
    "What we have here is a handful of guys causing trouble, and claiming
    to represent China," Russell concluded. "I don't believe they
    represent anyone but themselves."
    
    
    [Breakout of defaced U.S. .mil sites]
    http://www.attrition.org/mirror/attrition/mil.html
    
    ISN is hosted by SecurityFocus.com
    ---
    To unsubscribe email LISTSERVat_private with a message body of
    "SIGNOFF ISN".
    



    This archive was generated by hypermail 2b30 : Tue Apr 17 2001 - 23:16:24 PDT