ONI Country Profi le
391
In December 2009 and October 2010, DDoS attacks were launched through a botnet
on Web sites and blogs that expressed dissent. In the fi rst instance, attackers compromised VPSKeys, a driver distributed by the Vietnamese Professional Society (VPS) to
provide support to Vietnamese Windows users typing in Vietnamese, with a Trojan
horse. The attackers then sent a fake e-mail from the VPS instructing users to download
a VPSKeys software update that was, in fact, the compromised version. Once users
installed the malicious software update, their computers would join the Vulcan botnet
and be given instructions to perform DDoS attacks on dissident Web sites.
46 Vulcanbot’s command-and-control servers were primarily located in Vietnam, and the botnet
was thought to be part of a larger effort to attack the growing anti – bauxite-mining
movement in Vietnam,
47 which had included the application of a fi rewall to three key
Web sites (http://boxitvn.net, http://boxitvn.org, and http://boxitvn.info) the detaining of key organizers, and forged e-mails from organizers.
48 Tens of thousands of users
were probably infected. According to a member of Google ’ s security team, “ These
infected machines have been used both to spy on their owners as well as participate
in distributed denial of service (DDoS) attacks against blogs containing messages of
political dissent. ”
49
In October 2010, SecureWorks discovered Trojan horse malware that was used to
launch DDoS attacks against Vietnamese blogs and discussion forums that were critical
of the government and the bauxite mining operations. The botnet ’ s deployment
coincided with “ Vietnam Blogger Day, ” a coordinated online action to celebrate the
release of Dieu Cay, a blogger and political prisoner. Dubbed Vecebot, the botnet
infected between 10,000 and 20,000 host computers, most of them located in
Vietnam.
50 SecureWorks has suggested that it is possible that the Vecebot attacks were
a continuation of the Vulcanbot attacks. While many speculate that such attacks are
state-sanctioned, there has been no solid evidence to connect such attacks to the
Vietnamese government. There is, however, evidence that the perpetrators of the
attacks may be a pro – Vietnamese Communist Party hacking group.
51 For SecureWorks,
the Trojan is a new family of malware that appears to have political, as opposed to
commercial, objectives.
52
ONI Testing Results
In 2010, OpenNet Initiative testing was conducted on two major Vietnamese ISPs, FPT
Telecom Corporation and Viettel Corporation. Founded in 1993 by Vietnam ’ s Ministry
of National Defense, Viettel is a military-owned Internet service provider that began
offering Internet-access services to the public in 2002. As of November 2010, Viettel
had captured 11 percent of the broadband market, making it the second largest ISP
in the country after the Vietnam Posts and Telecommunications.
53 FPT Telecom is one
of Vietnam ’ s leading IT companies and telecom service providers. It is a joint-stock
391
In December 2009 and October 2010, DDoS attacks were launched through a botnet
on Web sites and blogs that expressed dissent. In the fi rst instance, attackers compromised VPSKeys, a driver distributed by the Vietnamese Professional Society (VPS) to
provide support to Vietnamese Windows users typing in Vietnamese, with a Trojan
horse. The attackers then sent a fake e-mail from the VPS instructing users to download
a VPSKeys software update that was, in fact, the compromised version. Once users
installed the malicious software update, their computers would join the Vulcan botnet
and be given instructions to perform DDoS attacks on dissident Web sites.
46 Vulcanbot’s command-and-control servers were primarily located in Vietnam, and the botnet
was thought to be part of a larger effort to attack the growing anti – bauxite-mining
movement in Vietnam,
47 which had included the application of a fi rewall to three key
Web sites (http://boxitvn.net, http://boxitvn.org, and http://boxitvn.info) the detaining of key organizers, and forged e-mails from organizers.
48 Tens of thousands of users
were probably infected. According to a member of Google ’ s security team, “ These
infected machines have been used both to spy on their owners as well as participate
in distributed denial of service (DDoS) attacks against blogs containing messages of
political dissent. ”
49
In October 2010, SecureWorks discovered Trojan horse malware that was used to
launch DDoS attacks against Vietnamese blogs and discussion forums that were critical
of the government and the bauxite mining operations. The botnet ’ s deployment
coincided with “ Vietnam Blogger Day, ” a coordinated online action to celebrate the
release of Dieu Cay, a blogger and political prisoner. Dubbed Vecebot, the botnet
infected between 10,000 and 20,000 host computers, most of them located in
Vietnam.
50 SecureWorks has suggested that it is possible that the Vecebot attacks were
a continuation of the Vulcanbot attacks. While many speculate that such attacks are
state-sanctioned, there has been no solid evidence to connect such attacks to the
Vietnamese government. There is, however, evidence that the perpetrators of the
attacks may be a pro – Vietnamese Communist Party hacking group.
51 For SecureWorks,
the Trojan is a new family of malware that appears to have political, as opposed to
commercial, objectives.
52
ONI Testing Results
In 2010, OpenNet Initiative testing was conducted on two major Vietnamese ISPs, FPT
Telecom Corporation and Viettel Corporation. Founded in 1993 by Vietnam ’ s Ministry
of National Defense, Viettel is a military-owned Internet service provider that began
offering Internet-access services to the public in 2002. As of November 2010, Viettel
had captured 11 percent of the broadband market, making it the second largest ISP
in the country after the Vietnam Posts and Telecommunications.
53 FPT Telecom is one
of Vietnam ’ s leading IT companies and telecom service providers. It is a joint-stock