Vietnamese airports hackings

Cyberattacks on Vietnam Airlines in 2016

Vietnamese airports hackingsDate| July 29, 2016 (2016-07-29)

|

Type| Cyber-attack
Participants| Allegedly Chinese Hackergoup 1937CN
Outcome| 100 flights delay,
confidential data of 411.000 members of Vietnam Airlines' frequent fliers club, Golden Lotus
Targets| Vietnam Airlines
Tan Son Nhat International Airport
Noi Bai International Airport, Da Nang International Airport
Phu Quoc International Airport
Vietnam Football Federation
National Economics University in Vietnam

On 29 July 2016, a group suspected coming from China launched hacker attacks on the website of Vietnam Airlines with client information leaked and on flight information screens at Vietnam's 2 biggest airports, Tan Son Nhat International Airport and Noi Bai International Airport, posting derogatory messages against Vietnam and the Philippines in their territorial row against China in the South China Sea.[1][2][3][4]

## Background

[edit]

On 12 July 2016, the Permanent Court of Arbitration ruled in favor of the Philippines against China over an arbitration case concerning the disputes in the South China Sea;[5][6] in its major ruling, the tribunal ruled that China has "no historical rights" based on the "nine-dash line" map.[5][6] Within hours of the Permanent Court of Arbitration's unanimous rebuke of China's territorial claims in the South China Sea last week, at least 68 national and local government websites in the Philippines were knocked offline in a massive distributed denial of service (DDoS) attack.[7]

This hack comes days after a row involving a Chinese tourist at one of the hacked airports, Tan Son Nhat International Airport. A Chinese visitor complained, that her passport was handed back with obscenities written on the page that contains a map including China's "nine-dash line", that marks China's claim to territories in the South China Sea.[8]

## Incidents

[edit]

According to the Civil Aviation Administration of Vietnam, at 13h46 on 29 July the IT-systems of VietJet, Vietnam Airlines to do the flight check-ins at the Tan Son Nhat International Airport were attacked and had to stop working. At 16h07', A team of self-proclaimed Chinese Hackers attacked flight information screens at Noi Bai International Airport, posting notices that state media said criticized the Philippines and Vietnam and their claims in the South China Sea.,[9][10] The hackers also took control of the speaker system at Noi Bai airport for a few minutes, during which the speakers broadcast a male voice distorting Viet Nam's claims over the East Sea in English.[11] The check-ins system of Vietnam Airlines there was also attacked and had to switch to manual procedure completion, which lead to flight delays.[12] altogether, Noi Bai airport has 30 flight, and Tan Son Nhat more than 60 flight delayed from 15 til more than an hour, affect about 2.000 passengers.[9]

The official website of Vietnam Airlines, vietnamairlines.com, was also hacked by the same group at about 4pm the same day. The website page was replaced by the same picture that appeared on the airports’ screens. The website was back to normal at 18.30pm, however, the airlines’ customer database was stolen and made public on the internet, according to a press release from Vietnam Airlines. The airlines advised its members to change their account passwords as soon as the network system is recovered.[11]

Another 2 webpages were also compromised, are the webpage from Vietnam Football Federation on the same day [13] and from National Economics University (Vietnam) the next day.[14]

On next day, 50% of the computers can check in again, but the flight information screens are still off at Noi Bai airport. The speaker system is also still not working again. At Tan Son Nhat airport the situation is similar to Noi Bai with no flight information screens and no speaker system.[9]

## Perpetrators

[edit]

Further information: Cyberwarfare and China

The hackers claimed to be the 1937CN from China, which is one of the biggest hacker groups in the country and has a history of hacking Viet Nam's and the Philippines’ websites in 2013 and 2015, respectively.[11]

## References

[edit]

1. ^ Flight Info Screens at Vietnam's 2 Major Airports Hacked, nytimes, 29.7.2016
2. ^ Cyber-terrorists attack flight info screens at Vietnam's 2 major airports Archived 2016-08-01 at the Wayback Machine, vnexpress, 29.7.2016
3. ^ Flight information screens in two Vietnam airports hacked, theguardian, 29.7.2016
4. ^ Hackers target flight info screens at Vietnam's airports, dw, 29.7.2016
5. ^ a b "PCA Press Release: The South China Sea Arbitration (The Republic of the Philippines v. The People's Republic of China) | PCA-CPA". pca-cpa.org. Archived from the original on 2016-07-12. Retrieved 2016-07-12.
6. ^ a b Perlez, Jane (2016-07-12). "Tribunal Rejects Beijing's Claims in South China Sea". The New York Times. ISSN 0362-4331. Archived from the original on 2016-07-13. Retrieved 2016-07-12.
7. ^ China's Secret Weapon in the South China Sea: Cyber Attacks, thediplomat, 22.7.2016
8. ^ South China Sea: Vietnam airport screens hacked Archived 2019-03-27 at the Wayback Machine, bbc, 29.7.2016
9. ^ a b c Hơn 100 chuyến bay bị chậm vì tin tặc tấn công sân bay Archived 2016-07-31 at the Wayback Machine, vnexpress, 30.7.2016
10. ^ Hackers hit Vietnam airports with South China Sea messages, reuters, 29.7.2016
11. ^ a b c Chinese hackers attack VN’s airports and Vietnam Airlines’ website Archived 2016-08-01 at the Wayback Machine, vietnamnews, 29.7.2016
12. ^ Alleged Chinese hackers compromise Vietnam's airports, airline website Archived 2016-08-01 at the Wayback Machine, tuoitrenews, 29.7.2016
13. ^ Website của Liên đoàn bóng đá Việt Nam bị tấn công Archived 2016-08-01 at the Wayback Machine Minh Minh, VnExpress 29/7/2016 | 23:15 GMT+7
14. ^ Hacker TQ 'phủ nhận cáo buộc tấn công VN' Archived 2016-08-01 at the Wayback Machine BBC 30 tháng 7 2016

* v
* t
* e

Hacking in the 2010s

| ← 2000s | Timeline | 2020s →

|
|

Major incidents|

| 2010|

* Operation Aurora (publication of 2009 events)
* Australian cyberattacks
* Operation Olympic Games
* Operation ShadowNet
* Operation Payback

|

2011|

* Canadian government
* DigiNotar
* DNSChanger
* HBGary Federal
* Operation AntiSec
* PlayStation network outage
* RSA SecurID compromise

2012|

* LinkedIn hack
* Stratfor email leak
* Operation High Roller

2013|

* South Korea cyberattack
* Snapchat hack
* Cyberterrorism attack of June 25
* 2013 Yahoo! data breach
* Singapore cyberattacks

2014|

* Anthem medical data breach
* Operation Tovar
* 2014 celebrity nude photo leak
* 2014 JPMorgan Chase data breach
* 2014 Sony Pictures hack
* Russian hacker password theft
* 2014 Yahoo! data breach

2015|

* Office of Personnel Management data breach
* HackingTeam
* Ashley Madison data breach
* VTech data breach
* Ukrainian Power Grid Cyberattack
* SWIFT banking hack

2016|

* Bangladesh Bank robbery
* Hollywood Presbyterian Medical Center ransomware incident
* Commission on Elections data breach
* Democratic National Committee cyber attacks
* Vietnam Airport Hacks
* DCCC cyber attacks
* Indian Bank data breaches
* Surkov leaks
* Dyn cyberattack
* Russian interference in the 2016 U.S. elections
* 2016 Bitfinex hack

2017|

* SHAttered
* 2017 Macron e-mail leaks
* WannaCry ransomware attack
* Westminster data breach
* Petya and NotPetya
* 2017 Ukraine ransomware attacks
* Equifax data breach
* Deloitte breach
* Disqus breach

2018|

* Trustico
* Atlanta cyberattack
* SingHealth data breach

2019|

* Sri Lanka cyberattack
* Baltimore ransomware attack
* Bulgarian revenue agency hack
* WhatsApp snooping scandal
* Jeff Bezos phone hacking incident

Hacktivism|

* Anonymous
* associated events
* CyberBerkut
* GNAA
* Goatse Security
* Lizard Squad
* LulzRaft
* LulzSec
* New World Hackers
* NullCrew
* OurMine
* PayPal 14
* RedHack
* Teamp0ison
* TDO
* UGNazi
* Ukrainian Cyber Alliance

Groups|

* Appin
* Bangladesh Black Hat Hackers
* Bureau 121
* Charming Kitten
* Cozy Bear
* Dark Basin
* DarkMatter
* Elfin Team
* Equation Group
* Fancy Bear
* GOSSIPGIRL (confederation)
* Guccifer 2.0
* Hacking Team
* Helix Kitten
* Iranian Cyber Army
* Islamic State Hacking Division
* Lazarus Group
* BlueNorOff
* AndAriel
* Lords of Dharmaraja
* NSO Group
* Numbered Panda
* PLA Unit 61398
* PLA Unit 61486
* PLATINUM
* Pranknet
* Red Apollo
* Rocket Kitten
* Stealth Falcon
* Syrian Electronic Army
* Tailored Access Operations
* The Shadow Brokers
* xDedic
* Yemen Cyber Army

Individuals|

* Ryan Ackroyd
* Mustafa Al-Bassam
* Kim Anh Vo
* George Hotz
* Guccifer
* Elliott Gunton
* Jeremy Hammond
* Sam Hocevar
* Junaid Hussain
* MLT
* Sabu
* Track2
* Topiary
* The Jester

Major vulnerabilities
publicly disclosed|

* Evercookie (2010)
* iSeeYou (2013)
* Heartbleed (2014)
* Shellshock (2014)
* POODLE (2014)
* Rootpipe (2014)
* Row hammer (2014)
* SS7 vulnerabilities (2014)
* WinShock (2014)
* JASBUG (2015)
* Stagefright (2015)
* DROWN (2016)
* Badlock (2016)
* Dirty COW (2016)
* Cloudbleed (2017)
* Broadcom Wi-Fi (2017)
* EternalBlue (2017)
* DoublePulsar (2017)
* Silent Bob is Silent (2017)
* KRACK (2017)
* ROCA vulnerability (2017)
* BlueBorne (2017)
* Meltdown (2018)
* Spectre (2018)
* EFAIL (2018)
* Exactis (2018)
* Speculative Store Bypass (2018)
* Lazy FP state restore (2018)
* TLBleed (2018)
* SigSpoof (2018)
* Foreshadow (2018)
* Dragonblood (2019)
* Microarchitectural Data Sampling (2019)
* BlueKeep (2019)
* Kr00k (2019)

Malware|

| 2010|

* Bad Rabbit
* Black Energy 2
* SpyEye
* Stuxnet

|

2011|

* Coreflood
* Alureon
* Duqu
* Kelihos
* Metulji botnet
* Stars

2012|

* Carna
* Dexter
* FBI
* Flame
* Mahdi
* Red October
* Shamoon

2013|

* CryptoLocker
* DarkSeoul

2014|

* Brambul
* Black Energy 3
* Carbanak
* Careto
* DarkHotel
* Duqu 2.0
* FinFisher
* Gameover ZeuS
* Regin

2015|

* Dridex
* Hidden Tear
* Rombertik
* TeslaCrypt
* Project Sauron

2016|

* Hitler
* Jigsaw
* KeRanger
* Necurs
* MEMZ
* Mirai
* Pegasus
* Petya and NotPetya
* X-Agent

2017|

* BrickerBot
* Kirk
* LogicLocker
* Rensenware
* Triton
* WannaCry
* XafeCopy

2018|

* VPNFilter

2019|

* Grum
* Joanap
* NetTraveler
* R2D2
* Tinba
* Titanium
* ZeroAccess botnet

*[v]: View this template
*[t]: Discuss this template
*[e]: Edit this template