Pro-democracy Hong Kong sites DDoS'd with Chinese cyber-toolkit
Security for virtualized datacentres
Hacking attacks against organisations promoting democracy in Hong Kong were run using the same infrastructure previously linked to Chinese cyber-espionage attacks, according to new research from security firm FireEye.
Sites promoting the Occupy Central Pro Democracy movement, including Next Medias Apple Daily publication and the HKGolden forum, have been hit by DDoS attacks.
The assaults against Next Medias Apple Daily "brought down its email system for hours" as well as affecting its website.
The use of DDoS attacks as a political tool during times of conflict is not new; patriotic hacktivist groups frequently use them as a means to stifle rival political groups. The apparent objective of these DDoS attacks is to silence free speech and suppress the pro-democracy movement in Hong Kong. The Chinese government is therefore an obvious suspect.
In the case of Hong Kong, FireEye discovered "an overlap in the tools and infrastructure used by China-based advanced persistent threat (APT) actors and the DDoS attack activity" against the Hong Kong protest movement.
FireEye reports that DDoS attacks against the Pro-Democracy Movement using the KernelBot network. Samples of malware powering these attacks are signed with digital certificates linked to previously observed APT activity, including Operation Poisoned Hurricane, according to FireEye.
The QTI International and CallTogether code signing certificates, previously seen in malware attributed to APT activity, have cropped up in malicious code used in other attacks targeting the pro-democracy movement in Hong Kong. For example, malicious JavaScript inserted into the Hong Kong Association for Democracy and People's Livelihood website featured the QTI certificate.
More recently, as noted by security researcher Claudio Guarnieri, the website of the Democratic Party of Hong Kong hosted a redirect to the same malicious JavaScript.
All this tool and infrastructure sharing points to links between pro-Beijing hacktivists and state-sponsored groups focused on IP theft and cyber-espionage. It's evidence of collusion but far from definitive, according to FireEye.
More:
Pro-democracy Hong Kong sites DDoS'd with Chinese cyber-toolkit