Global cyberwar breaks out between US and China

Source: AFP|Published: Thursday May 3, 2001 The Age.com

NEW YORK - US and Chinese computer security experts braced for an anticipated escalation in the virtual battle that has now drawn in hackers from several other nations.

"Tomorrow will be the big day," said Chinese hacker Jia En Zhu in a telephone interview today.

"We are already inside the US government's computers, and we can hurt them if we choose to. What we are doing is not a war though, this is just the way hackers have fun."

So far, the cyberwar has resulted in hundreds of web site defacements but Chinese hackers have stated that they plan to escalate their attack on US networks on May 4 in honour of Qingnian Jie, or Youth Day, a Chinese national holiday.

Some security experts also are concerned that the cyberwar seems to have spread beyond China and the US, with hackers in other countries aligning themselves with one side or the other.

Pro-US hackers are now being supported by hackers from Saudi Arabia, Pakistan, India, Brazil, Argentina, and Malaysia, said Marquis Grove of Security News Portal.

Pro-China hackers are receiving support from hackers in Korea, Indonesia and Japan, Grove said.

Mike Assante, of Vigilinx, a risk assessment firm, said that government officials and security firms would be closely monitoring network activity to block e-mailed viruses and attempts at network penetration or denial-of-service attacks.

Assante said that web logs indicate involvement by hackers in other countries, but also noted that it is typical for hackers to hide their locations by launching attacks through other computer networks.

An alert yesterday by the FBI-led National Infrastructure Protection Centre (NIPC) advised that hackers had been particularly active over the past two days and warned governments and businesses of the "very significant increase in attempts to exploit known weaknesses" in Unix networks.

According to the alert, the network scans and attempted exploitations "currently number in the millions, and the activity is ongoing."

Grove said that the current attempts to probe networks typically are the signs of an effort to launch large-scale distributed denial-of-service attacks, which crash computer networks by flooding them with useless traffic.

A teenager using very simple DDoS tools managed to cripple the web sites of Yahoo, eBay, and Amazon.com during a series of attacks in February 2000.

Chinese hackers have made sophisticated DDoS tools freely available on their web site, www.cnhonker.com.

Chinese hackers claim that they have hit the US House of Representatives with a successful denial-of-service attack, and also said that they have hacked into the networks of the US Department of the Interior's National Business Centre, the US Geological Survey and Pacific Bell Internet Services.

UUNet, a major internet service provider, the United Press International news agency and the White House Historical Association have all acknowledged that Chinese hackers have defaced their web sites.

The Xinhua News Agency reported that US hackers have defaced the web sites of the provincial governments of Yichun, Xiajun and Beijing, the Deng Xiaoping police force, the Tsinghua and Xinjiang Universities, and Samsung's and Daewoo Telecoms' Korean sites.

According to the statistics posted on the Chinese Hacker Union's web site, Chinese hackers are now hitting US sites at random, striking government, corporate, and small e-commerce sites. US hackers seem to be focused on defacing government sites.

The cyberwar between China and the US was sparked by a mid-air collision between a US surveillance plane and a Chinese fighter jet.

American hackers said they are now waiting to see if pro-China hackers escalate their attacks.

"I want to see how they step up to the plate and fulfill their threats," said a hacker known as "pr0phet", who, according to a report at China.com, has defaced more Chinese web sites than any other individual.

"If they do, I'll say this - it will get way ugly for their servers."

-- (Paracelsus@Pb.Au), May 03, 2001

-- (-@-.-), May 03, 2001.

http://www.theage.com.au/news/2001/05/06/FFX7ETB9CMC.html

China-US engaged in a war of the websites

By GARRY BARKER

TECHNOLOGY EDITOR

Sunday 6 May 2001

The new cold war has broken out, not with rattling ballistic sabres but with clattering keyboards and the networks of cyberspace.

All last week, Chinese hackers aimed their electronic siege guns at US strategic targets ... the White House, NASA, the Pentagon and big business.

The White House website was hit by a spate of e-mail "bombs", which briefly choked the servers, and similar attacks were reported by the New York Times, the Los Angeles Times, CNN, the FBI, NASA and the House of Representatives.

On Friday night the official White House website was hit by massive data bombs in what technicians call a DDoS (distributed denial of service) attack, slowing it down for about six hours and totally blocking it for nearly three hours.

A similar attack was mounted on the public CIA site, but though it slowed, it weathered the data storm.

The FBI's National Infrastructure Protection Centre said Chinese hackers had publicly discussed increasing their activity with May 7, the second anniversary of the accidental bombing by the US of the Chinese embassy in Belgrade, suggested as a day of peak activity.

Internet security experts around the US have been busy finding local server computers that had been hacked into and used in some of the attacks and by last night had shut down six of them. The identity and whereabouts of the hackers using those servers is not known.

Jerry Freese, director of intelligence for the US network security firm, Vigilinx, said: "This is unique because of the level of organisation. We would not say it is state-sponsored, but it is certainly state-tolerated."

American cyber-guerrillas replied in kind, hitting dozens of official Chinese websites with various kinds of graffiti.

A US hacker calling himself "pr0phet", who is thought to have defaced more Chinese sites than anyone else so far, said he wanted "to see how the Chinese step up to the plate and fulfill their threats. If they do, I'll say this it will get way ugly for their servers".

So far, no serious damage has been caused to computer systems or databases on either side, though security experts believe that it could if tempers begin to run hotter.

In the end, however, the US probably has the whip hand because, for most practical purposes, it owns and controls the communications networks on which the hackers of either side depend to carry their attacks. Yet it would be unthinkable to close down electronic communication with China, where much of US, Australian and other nations' manufacturing is now done.

Meantime, the web war continues, with Chinese hackers saying they intend to continue to escalate their efforts, at least until May 7.

The FBI's cyber-crime unit, the National Infrastructure Protection Centre, has issued warnings of "very significant and increasing attempts to exploit known weaknesses" in the Unix networks on which much of US business and government depend. It said "attempted exploitations" numbered in the millions.

"Activity is ongoing," said Marquis Grove of the Internet-based Security News Portal. The Chinese hackers appeared to be very coordinated and well organised, he said.

News agencies late last week were quoting a Chinese hacker, Jia En Zhu, interviewed by telephone in Beijing, as saying: "We are already inside the US Government's computers and we can hurt them if we choose to. What we are doing is not a war. This is just the way hackers have fun."

Nobody is sure how much official sanction the hackers have, but it is generally thought that Beijing sees them as supporting its claim that the Chinese people are outraged over the recent spy-plane incident.

-- (news@of.note), May 05, 2001.