The Network Crack Program Hacker Group (NCPH Group) is a Chinese hacker group based out of Zigong in Sichuan Province.[1] While the group first gained notoriety after hacking 40% of the hacker association websites in China,[2] their attacks grew in sophistication and notoriety through 2006 and received international media attention in early 2007. iDefense linked the GinWui rootkit, developed by their leader Tan Dailin (Wicked Rose) with attacks on the US Department of Defense in May and June 2006. iDefense linked the group with many of the 35 zero-day hacker proof-of-concept codes used in attacks with over a period of 90 days during the summer of 2006. They are also known for the remote-network-control programs they offer for download. Wicked Rose announced in a blog post that the group is paid for their work, but the group's sponsor is unknown.[1]
| Formation | 1994 |
|---|---|
| Type | hacker group |
| Location | |
Membership | 4 core members, approx. 10 members (1996) |
| Leader | Tan Dailin (Wicked Rose) |
Key people | KuNgBim, Charles, Rodag |
Members
editThe group had four core members in 2006, Wicked Rose, KuNgBim, Charles, and Rodag, with approximately 10 members in total.[1] The group's current membership is unknown.
Wicked Rose
editWicked Rose, also known as Meigui (玫瑰), is the pseudonym of the Chinese hacker Tan Dailin.[3] He is first noted as a hacker during the "patriotic" attacks of 2001.[4] In 2005, Wicked Rose was contracted by the Sichuan Military Command Communication Department which instructed him to participate in the Chengdu Military Command Network Attack/Defense Competition. After winning the local competition, he received a month of intense training in simulating attacks, designing hacking tools, and drafting network-infiltration strategies. He and his team represented the Sichuan Military Command in a competition with other provinces which they went on to win.[2] Wicked Rose is also credited with the development of the GinWui rootkit used in attacks on the US Department of Defense in 2006.[1]
As the group's leader, he is responsible for managing relationships with sponsors and paying NCPH members for their work.[1] In April 2009 he was arrested after committing distributed denial of service attacks on Hackbase, HackerXFiles, and 3800hk, possibly for the purpose of committing blackmail. the organizations attacked collected information on the attack and turned it in to the public security department. The authorities conducted an investigation and shut down his website.[5] Hackbase reported Wicked Rose was arrested and faces up to 71/2 years in prison.[6]
Controversy
editThe group expelled the hacker WZT on 20 May 2006. Although the cause is unknown, the group ejected him soon after the zero-day attacks were publicly disclosed. WZT was a coding expert within the group.[1]
Associates
editFormer NCPH member associates with the Chinese hacker Li0n, the founder of the Honker Union of China (HUC). Wicked Rose credits the Chinese hacker WHG, also known as "fig" as one of the developers of the GinWui rootkit. WHG is an expert in malicious code. Security firms researching Wicked Rose's activities have connected him with the Chinese hacker group Evil Security Team.[1]
Activities
editThe group is known for its remote-network-control programs they offer for free on their website[2] and the exploitation of zero-day vulnerabilities of Microsoft Office suite products.[1] After their founding in 2004, the group earned a reputation among hacking groups by hacking 40% of the hacker association websites in China.[2]
GinWui Rootkit
editWicked Rose is the creator of the GinWui rootkit. His code and support posts are on Chinese hacker message boards, and was also available from the NCPH blog.[1]
Security researchers discovered the rootkit on 18 May 2006 attackers utilized it in attacks on the US and Japan. Attackers introduced it to the US in an attack against a Department of Defense entity. They used two different versions of the rootkit in attacks during May and June 2006.[1]
According to F-secure, GinWui is "a fully featured backdoor with rootkit characteristics." It is distributed through Word documents. The backdoor GinWui creates allows the controlling hacker control over certain processes of the compromised computer including the ability to,
- Create, read, write, delete, and search for files and directories,
- Access and modify the Registry,
- Manipulate services,
- Start and kill processes,
- Get information about the infected computer,
- and lock, restart, or shutdown Windows, among other activities.[7]
According to Information Systems Security, the rootkit also obtains kernel-level access to "...trap several functions and modify information passed to the user."[8]
Microsoft Office Exploits
editIDefense links NCPH with many of the 35 zero-day and proof-of-concept codes used in attacks against Microsoft Office products over a period of 90 days during the summer of 2006 due to the use of malware developed by Wicked Rose and not available in the public domain at the time. The group graduated from their early attacks exploiting only Microsoft Word, and by the end of 2006, they were also using Power Point and Excel in attacks. NCPH utilizes these exploits in spear phishing attacks.[1]
Spear Phishing
editOn his blog, Wicked Rose discussed his preference for spear phishing attacks. First, during the collection phase information is gathered using open source information or from employee databases or mailboxes of a company's system. He may also conduct analysis on user ID's which allows them to track and understand their activities. Finally he conducts the attack using the information collected and someone is likely to open the infected document.[3]
Spear phishing attacks attributed to NCPH increased in sophistication over time. While their phishing attacks in the beginning of 2006 targeted large numbers of employees, one attack attributed to the group later that year targeted one individual in a US oil company using socially engineered emails and infected Power Point documents.[1]
Sponsorship
editAfter winning the military network attack/defense competition, the group obtained a sponsor who paid them 2000 RMB per month. IDefense believes their sponsor is likely the People's Liberation Army (PLA) but has no definitive evidence to support this claim. After the 2006 attacks took place, their sponsor increased their pay to 5000 RMB.[1] The group's current sponsor is unknown.
Media coverage
editTime reporter Simon Elegant interviewed eight members of the group in December 2007 as part of an article on Chinese government cyber operations against the US government. During the interview the members referred to each other using code names.[2] Security firm iDefense has published reports on the group and their exploits[1] and devoted a webinar to the group, their capabilities, and relationships with other Chinese hackers.[4] Scott Henderson, Chinese linguistics and Chinese hacker expert, has also devoted several blog posts to the group and their ongoing activities.[3][5]
Blogging
editAll four core members of the group have blogged about their activities at one point or another. The group's blog NCPH.net also offered network-infiltration programs for download.[2] Scott Henderson describes Wicked Rose's early blog posts as "the most revealing and damning thing I have ever seen a Chinese hacker write."[3] After the interview with Time reporter Wicked Rose took down the group's blog and his blog.[2] In July 2008 the group's blog returned, but with modified content. Withered Rose also began blogging again, saying he was busy during the time the blog was down, but that his new job allows him more time to blog.[9] Chinese officials removed both blogs after his arrest in April 2009.[5] Rodag also blogs, but the most recent post is from August 2008. His last post is on IE vulnerabilities that attackers can used to exploit a user's desktop.[10]
See also
editReferences
edit- ^ a b c d e f g h i j k l m n "Archived copy". Archived from the original on 2011-08-16. Retrieved 2011-01-25.
{{cite web}}: CS1 maint: archived copy as title (link) - ^ a b c d e f g Enemies at The Firewall - TIME
- ^ a b c d "The Dark Visitor » A Rose by Any Other Name…Sometimes, Not So Sweet!". Archived from the original on 2010-07-13. Retrieved 2010-02-19.
- ^ a b Webcast: China's Wicked Rose and the NCPH Hacking Group | Security4all - Dedicated to digital security, enterprise 2.0 and presentation skills
- ^ a b c "The Dark Visitor » Withered Rose…law done come and got him". Archived from the original on 2010-06-23. Retrieved 2010-02-19.
- ^ “玫瑰黑客”网络犯罪团伙网站已被查封-资讯-黑基网 Archived 2010-01-06 at the Wayback Machine
- ^ Threat Description:Ginwui.A
- ^ Dunham, Ken (Dec 2006). "Year of the Rootkit". Information Systems Security. 15 (6). New York: Taylor & Francis Ltd.: 2–6. doi:10.1080/10658980601051797. ISSN 1065-898X. S2CID 20293217. ProQuest 229563212.
- ^ "The Dark Visitor » Chinese hacker Withered Rose returns". Archived from the original on 2010-09-09. Retrieved 2010-02-19.
- ^ http://translate.googleusercontent.com/translate_c?hl=en&sl=zh-CN&u=http://rodag.blogbus.com/&prev=/search%3Fq%3D%2522Rodag%2522%2BNCPH%26hl%3Den%26client%3Dfirefox-a%26rls%3Dorg.mozilla:en-US:official%26sa%3DN%26start%3D10&rurl=translate.google.com&usg=ALkJrhjw6MkFKtUDy7hEQmRqzlEPcW5t8w [dead link]
Further reading
edit- Ken Dunham; Jim Melnick (November 2012). ""Wicked Rose" and the NCPH Hacking Group" (PDF). KrebsOnSecurity.