164
Nart Villeneuve and Masashi Crete-Nishihata
oGc is a non-profi t organization and it intends for all people who interest in Information Technology. We all are students and all of members are interesting in learning IT. The main of oGc
Network is to give outs free psyBNC account, email and others free services to people in learning
more about unix and linux features. We [would] be glad if you would fi nd any useful information
on oGc and trust that we will not have disappointed you with the fruits of our efforts. Finally,
the oGc was born and we [would] like to thank to all people who [participated] and helped us
get oGc off the ground. We dedicated to use Myanmar IRC gateway. We started it at November
2004.
48
The students also operate an IRC server at irc.olivegreen.org that has the same IP
address as irc.myanmarchat.org . The oGc IRC network is accessible by several domain
names. According to registration information, some of these domains were registered
by students at the MAI. The server is frequented by students studying in Burma, Russia,
China, and Singapore. There is also a server, irc.mmustudent.org , for students of the
Myanmar Maritime University, which has a computer science department.
49 The earliest domain name registrations indicated that oGc originated in Russia. However, the
most recent activity on the server was traced to Burma.
In our observations of the oGc IRC network we found the group ’ s members and
frequent chatters were friendly and generally interested in information technology.
There was the occasional discussion about an exploit or Web defacement, but that was
not the focal point of the conversation. The oGc IRC network appears to be a legitimate IRC network as opposed to a specifi cally “ hacker ” -related network.
As our investigation progressed we provided the circumvention software provider
with the aliases of several suspects from the oGc IRC network and asked to confi rm
if they had them in their system. We found that three of these nicknames were among
some 20 account names on the circumvention software service utilized from the same
installation as one of the attackers. Based on these correlations, we had substantial
evidence that members of the oGc may have been involved in the attack.
On the oGc IRC network we found an operator identifi ed as the administrator of
oGc who, through our analysis, was revealed to be using multiple aliases associated
with the alias found in the confi guration of the pBot Trojan used in the attacks against
Mizzima, as well as related accounts on the circumvention software service. We initiated IRC chats
50 with the oGc administrator and other oGc members and asked why
they thought Mizzima News was defaced. Their general response was that the opposition highlights only the negative aspects of Burma and generally produces “ nonsense. ”
The oGc administrator suggested that there were “ rules of every country ” and implied
that Mizzima News had broken those rules, noting “ u should know, what kind of
articles are written there. ” In general, the oGc administrator and other members of
the group did not appear to be “ progovernment ” and acknowledged that issues of
government corruption were legitimate. However, they were very proud of their
Nart Villeneuve and Masashi Crete-Nishihata
oGc is a non-profi t organization and it intends for all people who interest in Information Technology. We all are students and all of members are interesting in learning IT. The main of oGc
Network is to give outs free psyBNC account, email and others free services to people in learning
more about unix and linux features. We [would] be glad if you would fi nd any useful information
on oGc and trust that we will not have disappointed you with the fruits of our efforts. Finally,
the oGc was born and we [would] like to thank to all people who [participated] and helped us
get oGc off the ground. We dedicated to use Myanmar IRC gateway. We started it at November
2004.
48
The students also operate an IRC server at irc.olivegreen.org that has the same IP
address as irc.myanmarchat.org . The oGc IRC network is accessible by several domain
names. According to registration information, some of these domains were registered
by students at the MAI. The server is frequented by students studying in Burma, Russia,
China, and Singapore. There is also a server, irc.mmustudent.org , for students of the
Myanmar Maritime University, which has a computer science department.
49 The earliest domain name registrations indicated that oGc originated in Russia. However, the
most recent activity on the server was traced to Burma.
In our observations of the oGc IRC network we found the group ’ s members and
frequent chatters were friendly and generally interested in information technology.
There was the occasional discussion about an exploit or Web defacement, but that was
not the focal point of the conversation. The oGc IRC network appears to be a legitimate IRC network as opposed to a specifi cally “ hacker ” -related network.
As our investigation progressed we provided the circumvention software provider
with the aliases of several suspects from the oGc IRC network and asked to confi rm
if they had them in their system. We found that three of these nicknames were among
some 20 account names on the circumvention software service utilized from the same
installation as one of the attackers. Based on these correlations, we had substantial
evidence that members of the oGc may have been involved in the attack.
On the oGc IRC network we found an operator identifi ed as the administrator of
oGc who, through our analysis, was revealed to be using multiple aliases associated
with the alias found in the confi guration of the pBot Trojan used in the attacks against
Mizzima, as well as related accounts on the circumvention software service. We initiated IRC chats
50 with the oGc administrator and other oGc members and asked why
they thought Mizzima News was defaced. Their general response was that the opposition highlights only the negative aspects of Burma and generally produces “ nonsense. ”
The oGc administrator suggested that there were “ rules of every country ” and implied
that Mizzima News had broken those rules, noting “ u should know, what kind of
articles are written there. ” In general, the oGc administrator and other members of
the group did not appear to be “ progovernment ” and acknowledged that issues of
government corruption were legitimate. However, they were very proud of their