Hackers calling themselves the “Iranian Cyber Army” paralysed China’s biggest search engine this morning, sparking a bizarre online battle as Chinese hackers apparently retaliated by targeting Iranian sites.
Last month the group attacked Twitter, which has been used by Iranian opposition supporters. But Beijing and Tehran are allies and it was not immediately obvious why hackers targeted Baidu, which commands over 60% of the search market in China.
Some Chinese internet users speculated that it might be in retaliation against Chinese Twitter users who have used a #CN4Iran hashtag to express their support for reformists. Although Twitter is blocked in China, it is used by several thousand people there through proxies or virtual private networks (VPN).
“It’s the same warning showed to twitter.com … but I’m not very sure how you would connect this to #CN4Iran. Baidu is a very weird choice,” said Michael Anti, an influential Chinese blogger.
The search engine is widely regarded as having good relations with the Beijing government and has never been associated with sensitive content. That led other internet users to speculate that foreign hackers were attempting to discredit Iran.
China’s state-run People’s Daily website reported that Baidu’s website began redirecting to a site attributed to the Iranian Cyber Army at around 8am (midnight GMT). The People’s Daily site published a screen grab showing a message reading “This site has been hacked by the Iranian Cyber Army”, alongside a picture of the Iranian flag.
Other users said they could not open the Baidu site, but it was back up and running by around 11.30am. In a statement, the company said: “Services on Baidu’s main website http://www.baidu.com were interrupted today due to external manipulation of its DNS (Domain Name Server) in the US. Baidu has been resolving this issue and the majority of services have been restored.”
As news of the attack spread, other hackers targeted Iranian websites.
On the room98.ir website, beneath a large Chinese flag, a message from the “Chinese Honker Team” read: “This morning your Iranian Cyber Army intrusion [sic] our baidu.com … Please tell your so-called Iranian Cyber Army … Don’t intrusion Chinese website about the United States authorities to intervene the internal affairs of Iran’s response … This is a warning!”
A message on the iribu.ir website read: “The People’s Republic of China long live … Oppose splitting Safeguarding unity.”
Other targets reportedly included the website of a national wrestling team.
“They seem to be choosing them randomly – the content is in Farsi, so they don’t necessarily know what they are,” said Anti.
Although the message left on Twitter by the Iranian Cyber Army suggested it was sympathetic to the government, experts told Reuters last month that it was unlikely Tehran was involved.