China syndromeChinese TV shows cyber-attack software

Published 25 August 2011

A Chinese government TV station, perhaps inadvertently, shows a government cyberattack aimed at Falun Gong computers; the video identifies the software as being written by the Electrical Engineering University of the People’s Liberation Army; the video — which has been removed from the TV station’s Web site — provides direct evidence of Chinese government involvement in cyberattacks

The Chinese government has been accused of being behind a systemic and methodical cyberattack campaigns directed at the critical infrastructure of the United States and other Western countries, and against private companies and organizations in these countries. The Chinese have officially denied the accusations, but Western intelligence services have more than enough evidence proving China’s persistent cyber campaign.

Now, a piece of Chinese state propaganda shows a government cyberattack aimed at Falun Gong computers.

The Epoch Times says this image, taken from a Chinese government TV spot aired in July, shows the software in use.

The newspaper translates the labels in the image as “Select attack target,” a drop-down list of Falun Gong Web sites, and an “attack” button. It says the video, some of which is posted on F-Secure’s blog, provides direct evidence of Chinese government involvement in cyberattacks: the Epoch Times says the video identifies the software as being written by the Electrical Engineering University of the People’s Liberation Army (PLA), while the IP address the video shows as originating the attack, 138.26.72.17, resolves to the University of Alabama at Birmingham. The university told the newspaper that the address has not been used since 2010, and it believes its network has not been compromised.

OnlySoftwareBlog reports that while the video may have been seen as propaganda claiming a capability that did not actually exist, the government-run TV channel CCTV7 has since removed the original video from its Web site and replaced it with a more generic slot, leading F-Secure’s Mikko Hypponen to agree with the newspaper that the footage is genuine, and was included in the original footage by mistake.