CNN site hit by China attack

After being called off Friday, the on-again, off-again cyberattack against CNN's Web site again picked up steam early this week, according to network security analysts.

At its peak, the attack has sucked up 100MBps in bandwidth, enough to slow the news Web site for some visitors. "That's a decent-sized attack," said Jose Nazario, a senior security engineer with Arbor Networks. "Globally speaking, it's probably garden-variety."

Organizers had originally called for the attack to be launched on April 19. But they soon called off their efforts with one organizer, CN-Magistrate, saying that "too many people are aware of it, and the situation is chaotic."

CN-Magistrate soon disbanded his Web site devoted to these attacks and dropped out of public view.

Hackers had launched some low-intensity attacks against CNN ahead of the April 19 deadline, but on Sunday, another group calling itself HackCNN picked up the attack. CNN visitors experienced a noticeable slowdown during the early hours of Sunday and Monday, researchers said.

This group also managed to deface a Sports Network Web site (sports.si.cnn.com), replacing sports scores with slogans such as "Tibet was, is, and always will be a part of China!"

Although a CNN spokeswoman said that the Web site was not taken down by the attacks, Web monitoring company Netcraft said that some of its sensors were unable to get a response from CNN servers in Phoenix, San Jose, Calif., London, and Pennsylvania for about three hours on Sunday. On Monday, response times to CNN were as slow as two-tenths of a second, Netcraft said.

CNN did slow down the rate at which network traffic from the Asia-Pacific region was able to reach its Web site, the spokeswoman said.

Nazario said that a botnet network of hacked computers has now been involved in the attacks, but the hackers have mostly relied on voluntary downloads to spur their efforts.

Angered by Western coverage of unrest in Tibet by CNN, organizers had hoped to knock the Web site offline using tactics similar to those seen in recent attacks on Internet servers run by the Church of Scientology and the Baltic nation of Estonia. Hackers made easy-to-use Web attacking tools available for download on hackcnn.com and then encouraged as many computers as possible to join in on the attack.

"People would purposely infect themselves with malware released on behalf of Chinese hacktivists to automatically utilize their Internet bandwidth for the purpose of a coordinated attack against a particular site," said Dancho Danchev, a Bulgarian security researcher, via instant message.

"These guys are young. they're usually 20-25 years old, college students, they spend their life online," said Scott Henderson, a retired U.S. intelligence analyst who has been following the CNN attacks on his blog. "It is really a way of expressing themselves."

Security experts said that the Estonian and CNN attacks more closely resembled a cyber-riot than anything else, with no central figure in command and many different groups, loosely coordinating their activities and attacking computers in many ways.

The attacks can be hard to stop at first, and they tend to garner attention to the attacker's political cause, Nazario said. "We're going to see this again because it's effective to some degree."