CNN site hit by China attack

April 23, 2008 —

After being called
off Friday, the on-again, off-again cyber attack against CNN's Web site
again picked up steam early this week, according to network security analysts.

At its peak, the attack has sucked up 100MB/S in bandwidth, enough to slow
the news Web site for some visitors. "That's a decent-sized attack,"
said Jose Nazario, a senior security engineer with Arbor
Networks. "Globally speaking, it's probably garden-variety."

Organizers had originally called for the attack to be launched on April 19.
But they soon called off their efforts with one organizer, CN-Magistrate, saying
that "too many people are aware of it, and the situation is chaotic."

CN-Magistrate soon disbanded his Web site devoted to these attacks and dropped
out of public view.

Hackers had launched some low-intensity attacks against CNN ahead of the April
19 deadline, but on Sunday, another group calling itself HackCNN picked up the
attack. CNN visitors experienced a noticeable slowdown during the early hours
of Sunday and Monday, researchers said.

This group also managed to deface
a Sports Network Web site (sports.si.cnn.com),
replacing sports scores with slogans such as "Tibet was, is, and always
will be a part of China!"

Although a CNN spokeswoman said that the Web site was not taken down by the
attacks, Web monitoring company Netcraft
said that some of its sensors were unable to get a response from CNN servers
in Phoenix, San Jose, California, London and Pennsylvania for about three hours
on Sunday. On Monday, response times to CNN were as slow as two-tenths of a
second, Netcraft said.

CNN did slow down the rate at which network traffic from the Asia-Pacific region
was able to reach its Web site, the spokeswoman said.

Nazario said that a botnet network of hacked computers has now been involved
in the attacks, but the hackers have mostly relied on voluntary downloads to
spur their efforts.

Angered by Western coverage of unrest in Tibet by CNN, organizers had hoped
to knock the Web site offline using tactics similar to those seen in recent
attacks on Internet servers run by the Church of Scientology and the Baltic
nation of Estonia. Hackers made easy-to-use Web attacking tools available for
download on hackcnn.com and then encouraged as many computers as possible to
join in on the attack.

"People would purposely infect themselves with malware released on behalf
of Chinese hacktivists to automatically utilize their Internet bandwidth for
the purpose of a coordinated attack against a particular site," said Dancho
Danchev, a Bulgarian security researcher, via instant message.

"These guys are young. they're usually 20-25 years old, college students,
they spend their life online," said Scott Henderson, a retired U.S. intelligence
analyst who has been following the CNN attacks on
his blog. "It is really a way of expressing themselves."

Security experts said that the Estonian and CNN attacks more closely resembled
a cyber riot than anything else, with no central figure in command and many
different groups, loosely coordinating their activities and attacking computers
in many ways.

The attacks can be hard to stop at first, and they tend to garner attention
to the attacker's political cause, Nazario said. "We're going to see this
again because it's effective to some degree."

IDG News Service