VietNamNet Bridge – Security experts from VNCERT (the Vietnam Computer Emergency Response Team) and BKAV, an Internet security solution provider, have confirmed that 220 websites have been hacked by Chinese, but dismissed reports that a Vietnam-China cyberwar is underway.

Ngo Tuan Anh, Vice President of BKAV, told the local press that the Vietnamese websites were hacked during the period of May 8-11. That is more than double the total found by SecurityDaily.net, which on Sunday had reported the number of victimized sites as 102.

Anh said the number of attacked websites has been increasing day by day, but very gradually. Of the 220 hacked websites, 200 were attacked by a group of several Chinese hackers.

“This is not enough to say that a cyberwar has broken out. Sporadic hackers attack each other spontaneously,” Anh affirmed.

When asked why BKAV can say for certain that the Vietnamese websites were hacked by Chinese, he said the hackers usually left their names, either “hackers from China”, “I am Chinese”, or something to let it be known that the culprits are indeed from China. However, Anh admitted that there is no assurance that the hackers were not imposters intent on falsely assigning blame to China.

After analyzing the domain names of hundreds of websites, Vietnamese independent security experts have come to the conclusion that most of the attacked domains are located on servers near to each other, with IP addresses of 210.245.85.78 , 210.245.85.91 and 112.78.3.177.

This finding offers more evidence to suggest that the latest incidents were just isolated attacks, not parts of a large-scale campaign aimed at hundreds of Vietnamese websites, as some foreign news outlets are reporting.

In fact, experts say, attacks on servers in Vietnam occur every day, and are regularly reported by SecurityDaily or Zone-H.

In the past, Vietnamese hackers once attacked Turkish websites in a campaign to retaliate Turkish hackers attacking the Vietnamese websites with the suffix “.gov.vn”, including the Ministry of Health’s website.

At that time, a number of Turkish websites were hijacked by Vietnamese. However, this triggered a new wave of attack from Turkish hackers aiming to disable websites with low security in Vietnam. Ultimately, the skirmish petered out.

According to Anh, in the days before China deployed the oil rig in Vietnamese territorial waters, about 18-20 Vietnamese websites were being attacked every day. “The figure has been a little higher in more recent days, about 30 websites per day,” Anh said.

Ha Hai Thanh from VNCERT further claimed that the culprits who hacked Vietnamese websites were just two Chinese hackers. The nature of the attacks was website defacement, not DDoS (distributed denial of service).Thanh said that the hackers ran automatic scanning on websites with the suffix “.vn” to detect security holes, and then attacked through the vulnerabilities they found.

Thanh warned that any website can become the target of hackers, and that the only thing businesses and organizations can do to protect themselves is to check their security systems regularly.

Huy Phong