HACKER HELPED DISRUPT 300 WEB ATTACKS, PROSECUTORS SAY

Original Story:  NYTimes.com

A prominent hacker set to be sentenced in federal court this week for breaking into numerous computer systems worldwide has provided a trove of information to the authorities, allowing them to disrupt at least 300 cyberattacks on targets that included the United States military, Congress, the federal courts, NASA and private companies, according to a newly filed government court document.

The hacker, Hector Xavier Monsegur, also helped the authorities dismantle a particularly aggressive cell of the hacking collective Anonymous, leading to the arrest of eight of its members in Europe and the United States, including Jeremy Hammond, who the Federal Bureau of Investigation said was its top “cybercriminal target,” the document said. Mr. Hammond is serving a 10-year prison term.

The court document was prepared by prosecutors who are asking a judge, Loretta A. Preska, for leniency for Mr. Monsegur because of his “extraordinary cooperation.” He is set to be sentenced on Tuesday in Federal District Court in Manhattan on hacking conspiracy and other charges that could result in a long prison term.

It has been known since 2012 that Mr. Monsegur, who was arrested in 2011, was acting as a government mole in the shadowy world of computer hacking, but the memorandum submitted to Judge Preska late on Friday reveals for the first time the extent of his assistance and what the government perceives of its value. It also offers the government’s first explanation of Mr. Monsegur’s involvement in a series of coordinated attacks on foreign websites in early 2012, though his precise role is in dispute.

The whereabouts of Mr. Monsegur have been shrouded in mystery. Since his cooperation with the authorities became known, he has been vilified online by supporters of Anonymous, of which he was a member. The memo, meanwhile, said the government became so concerned about his safety that it relocated him and some members of his family.

“Monsegur repeatedly was approached on the street and threatened or menaced about his cooperation once it became publicly known,” said the memo, which was filed by the office of Preet Bharara, the United States attorney in Manhattan.

Born in 1983, Mr. Monsegur moved to the Jacob Riis housing project on the Lower East Side of Manhattan at a young age, where he lived with his grandmother after his father and aunt were arrested for selling heroin. He became involved with hacking groups in the late 1990s, drawn, he has indicated, to the groups’ anti-government philosophies.

Mr. Monsegur’s role emerged in March 2012 when the authorities announced charges against Mr. Hammond and others. A few months later, Mr. Monsegur’s bail was revoked after he made “unauthorized online postings,” the document said without elaboration. He was jailed for about seven months, then released on bail in December 2012, and has made no further postings, it said.



The memo said that when Mr. Monsegur (who used the Internet alias Sabu) was first approached by F.B.I. agents in June 2011 and questioned about his online activities, he admitted to criminal conduct and immediately agreed to cooperate with law enforcement.

That night, he reviewed his computer files with the agents, and throughout the summer, he daily “provided, in real time, information” that allowed the government to disrupt attacks and identify “vulnerabilities in significant computer systems,” the memo said.

“Working sometimes literally around the clock,” it added, “at the direction of law enforcement, Monsegur engaged his co-conspirators in online chats that were critical to confirming their identities and whereabouts.”

His primary assistance was his cooperation against Anonymous and its splinter groups Internet Feds and LulzSec.

“He provided detailed historical information about the activities of Anonymous, contributing greatly to law enforcement’s understanding of how Anonymous operates,” the memo said.

Neither Mr. Bharara’s office nor a lawyer for Mr. Monsegur would comment about the memo.

Mr. Monsegur provided an extraordinary window on the activities of LulzSec, which he and five other members of Anonymous had created. The memo describes LulzSec as a “tightly knit group of hackers” who worked as a team with “complementary, specialized skills that enabled them to gain unauthorized access to computer systems, damage and exploit those systems, and publicize their hacking activities.”

The memo said that LulzSec had developed an “action plan to destroy evidence and disband if the group determined that any of its members had been arrested, or were out of touch,” and it credits Mr. Monsegur for agreeing so quickly to cooperate after being confronted by the bureau. Had he delayed his decision and remained offline for an extended period, the document said, “it is likely that much of the evidence regarding LulzSec’s activities would have been destroyed.”

After his arrest, Mr. Monsegur provided information that helped repair a hack of PBS’s website in which he had been a “direct participant,” and helped patch a vulnerability in the Senate’s website. He also provided information about “vulnerabilities in critical infrastructure, including at a water utility for an American city, and a foreign energy company,” the document said.

The coordinated attacks on foreign government websites in 2012 exploited a vulnerability in a popular web hosting software. The targets included Iran, Pakistan, Turkey and Brazil, according to court documents in Mr. Hammond’s case. The memo said that “at law enforcement direction,” Mr. Monsegur tried to obtain details about the software vulnerability but was unsuccessful.

“At the same time, Monsegur was able to learn of many hacks, including hacks of foreign government computer servers, committed by these targets and other hackers, enabling the government to notify the victims, wherever feasible,” the memo said.

The memo does not specify which of the foreign governments the United States alerted about the vulnerabilities.

But according to a recent prison interview with Mr. Hammond as well as logs of Internet chats between him and Mr. Monsegur, which were submitted to the court in Mr. Hammond’s case, Mr. Monsegur seemed to have played a more active role in directing some of the attacks. In the chat logs, Mr. Monsegur directed Mr. Hammond to hack numerous foreign websites, and closely monitored whether Mr. Hammond had success in gaining access to the sites.

Sarah Kunstler, a lawyer for Mr. Hammond, said on Saturday: “The government’s characterization of Sabu’s role is false. Far from protecting foreign governments, Sabu identified targets and actively facilitated the hacks of their computer systems.”

At his sentencing in November, Mr. Hammond was prohibited by Judge Preska from naming the foreign governments that Mr. Monsegur had asked him to hack. But, according to an uncensored version of a court statement by Mr. Hammond that appeared online that day, the target list included more than 2,000 Internet domains in numerous countries.

Mr. Hammond’s sentencing statement also said that Mr. Monsegur encouraged other hackers to give him data from Syrian government websites, including those of banks and ministries associated with the leadership of President Bashar al-Assad.

How to Hijack Search Results in Google

story first appeared on Search Engine Land

Dan Petrovic has explained how he hijacked a few pages in Google to show his copied version over the original version of the page.

For example, he was able to confuse Google into thinking a page on MarketBizz should really show on dejanseo.com.au instead of on marketbizz.nl.

How did he do it? He simply copied the full page, source code and everything and put it on a new URL on his site. He linked to the page and gave it a +1 and the result worked days later. He is a picture of Google’s search results for the page using an info command and also searching for the title of the page:

He did the same thing on three other domains with varied levels of success.

We emailed Google last week for a comment but have yet to hear back.

In some cases, using a rel=canonical seemed to prevent it from hijacking the result fully but not in all cases. There also seems to be a case where using the authorship might be prevent this as well.

Dan Petrovic was even able to hijack the first result for Rand Fishkin’s name (with Rand’s permission):

The way this seems to work is that Google’s duplicate content system feels that the new URL is the more important page and thus replaces the original page with the more important page. It is how the competitive link trick seemed to have worked as well.

Postscript: Google has taken action against these attempts with a notification sent to the webmaster for “copied content.” Those pages were removed from the index.

LinkedIn Stocks Seem Immune to Danger

Story first appeared on CNBC.

After a day of rumors and investigations, LinkedIn has formally acknowledged that some of its users passwords have been compromised.

This is the worst privacy and security news to slam the business networking service yet.

The company apologized and encouraged “best practices” to update passwords.

This is no small deal: by some reports it impacted over six million passwords, about 4 percent of LinkedIn’s users. But still, LinkedIn’s stock has been remarkably robust. At one point today it sank about 1.2 percent, but it closed the day up 9 cents, and it’s up nearly 50 percent year-to-date. Today not a single analyst issued a note in response to the news or changed a rating or stock target.

So why is the stock immune to a hack attack?

LinkedIn’s built a strong reputation on these matters. The great efforts LinkedIn has made to stay out of the spotlight on security and privacy concerns seems to have paid off. The company hasn’t drawn the outrage and concerns that Facebook has when it comes to privacy issues. This is partly due to LinkedIn’s focus on business, rather than the personal photos and details people share on Facebook. By its very nature of enabling people to share their professional profiles, there is simply less risk.

A number of Wall Street analysts say that they do not expect this news to at all impact LinkedIn usage. Why? These hack attacks and the need to change passwords are perceived as a cost of doing business in today’s digital world. As long as no one gets hurt, as one analyst put it, it’s not a big deal.

Perhaps most interesting, today’s hacking news follows media storm over LinkedIn’s mobile app violating personal privacy by improperly downloading and sharing personal details from users calendars, including conference call dial-ins and private notes. Users complained about the mobile app, and LinkedIn responded by changing its policy—it no longer downloads or shares the notes section of appointment reminders. When this news came out, the stock barely moved—ending the day less than a percentage point.

The company plans to update its privacy policy to give users more control sometime in the next few days.  We’ll hear when LinkedIn does its next quarterly report if there’s been any impact on LinkedIn traffic. But Wall Street certainly thinks that users will take today’s news in stride; they’ll change their password and perhaps click on through to connect with the service.

For information on website optimization or for the latest SEO News, visit the SEO Done Right blog.

For more national and worldwide Business News, visit the Peak News Room blog.

For more local and state of Michigan Business News, visit the Michigan Business News blog.

For more Health News, visit the Healthcare and Medical News blog.

For more Electronics News, visit the Electronics America blog.

For more Real Estate News, visit the Commercial and Residential Real Estate blog.

For more Law News, visit the Nation of Law blog.

For more Advertising News, visit the Advertising, Marketing and Media blog.

For more Environmental News, visit the Environmental Responsibility News blog.

Infected PCs May Lose Internet In July

Story first appeared in USA Today.

For computer users, a few mouse clicks could mean the difference between staying online and losing Internet connections this summer.

This image provided by The DNS Changer Working Group (DCWG) shows the checkup webpage. It will only take a few clicks of the mouse. But for hundreds of thousands of computer users, those clicks could mean the difference between staying online and losing their connections this July.

Unknown to most of them, their problem began when international hackers ran an online advertising scam to take control of infected computers around the world. In a highly unusual response, the FBI set up a safety net months ago using government computers to prevent Internet disruptions for those infected users. But that system is to be shut down.

The FBI is encouraging users to visit a website run by its security partner, http://www.dcwg.org, that will inform them whether they're infected and explain how to fix the problem. After July 9, infected users won't be able to connect to the Internet.

Most victims don't even know their computers have been infected, although the malicious software probably has slowed their web surfing and disabled their antivirus software, making their machines more vulnerable to other problems.

Last November, the FBI and other authorities were preparing to take down a hacker ring that had been running an Internet ad scam on a massive network of infected computers.

The FBI started to realize that there might have a little bit of a problem on our hands because if they just pulled the plug on their criminal infrastructure and threw everybody in jail, the victims of this were going to be without Internet service. The average user would open up Internet Explorer and get 'page not found' and think the Internet is broken.

On the night of the arrests, the agency brought in the chairman and founder of Internet Systems Consortium, to install two Internet servers to take the place of the truckload of impounded rogue servers that infected computers were using. Federal officials planned to keep their servers online until March, giving everyone opportunity to clean their computers. But it wasn't enough time. A federal judge in New York extended the deadline until July.

Now, the full court press is on to get people to address this problem. And it's up to computer users to check their PCs.

Hackers infected a network of probably more than 570,000 computers worldwide. They took advantage of vulnerabilities in the Microsoft Windows operating system to install malicious software on the victim computers. This turned off antivirus updates and changed the way the computers reconcile website addresses behind the scenes on the Internet's domain name system.

The DNS system is a network of servers that translates a web address — such as www.ap.org — into the numerical addresses that computers use. Victim computers were reprogrammed to use rogue DNS servers owned by the attackers. This allowed the attackers to redirect computers to fraudulent versions of any website.

The hackers earned profits from advertisements that appeared on websites that victims were tricked into visiting. The scam netted the hackers at least $14 million, according to the FBI. It also made thousands of computers reliant on the rogue servers for their Internet browsing.

When the FBI and others arrested six Estonians last November, the agency replaced the rogue servers with clean ones. Installing and running the two substitute servers for eight months is costing the federal government about $87,000.

The number of victims is hard to pinpoint, but the FBI believes that on the day of the arrests, at least 568,000 unique Internet addresses were using the rogue servers. Five months later, FBI estimates that the number is down to at least 360,000. The U.S. has the most, about 85,000, federal authorities said. Other countries with more than 20,000 each include Italy, India, England and Germany. Smaller numbers are online in Spain, France, Canada, China and Mexico.

Most of the victims are probably individual home users, rather than corporations that have technology staffs who routinely check the computers.  Many corporations utilize Managed IT Services that provide quality control and Security Solutions to avoid situations such as these.

FBI officials said they organized an unusual system to avoid any appearance of government intrusion into the Internet or private computers. And while this is the first time the FBI used it, it won't be the last.

Until there is a change in legal system, both inside and outside the United States, to get up to speed with the cyber problem, the FBI will have to go down these paths, trail-blazing if you will, on these types of investigations.

Now, every time the agency gets near the end of a cyber case, they get to the point where they say, how are we going to do this, how are we going to clean the system" without creating a bigger mess than before.


For organic SEO and web optimization related news, visit the SEO Done Right blog.
For national and worldwide related business news, visit the Peak News Room blog.
For local and Michigan business related news, visit the Michigan Business News blog.
For healthcare and medical related news, visit the Healthcare and Medical blog.
For law related news, visit the Nation of Law blog.
For real estate and home related news, visit the  Commercial and Residential Real Estate blog.
For technology and electronics related news, visit the Electronics America blog.

Investors Don’t Know Companies Were Hacked

First appeared in Reuters

At least a half-dozen major U.S. companies whose computers have been infiltrated by cyber criminals or international spies have not admitted to the incidents despite new guidance from securities regulators urging such disclosures.

Top U.S. cybersecurity officials believe corporate hacking is widespread, and the Securities and Exchange Commission issued a lengthy "guidance" document on October 13 outlining how and when publicly traded companies should report hacking incidents and cybersecurity risk.

But with one full quarter having elapsed since the SEC request, some major companies that are known to have had significant digital security breaches have said nothing about the incidents in their regulatory filings.

Defense contractor Lockheed Martin Corp, for example, said last May that it had fended off a "significant and tenacious" cyber attack on its networks. But Lockheed's most recent 10-Q quarterly filing, like its filing for the period that included the attack, does not even list hacking as a generic risk, let alone state that it has been targeted.

A Reuters review of more than 2,000 filings since the SEC guidance found some companies, including Internet infrastructure company VeriSign Inc and credit card and debit card transaction processor VeriFone Systems Inc, revealed significant new information about hacking incidents.

Yet the vast majority of companies addressing the issue only used new boilerplate language to describe a general risk. Some hacking victims did not even do that.

"It's completely confusing to me why companies aren't reporting cyber risks" if only to avoid SEC enforcement or private lawsuits, said Jacob Olcott, former counsel for the Senate Commerce committee. The chair of that committee, John D. Rockefeller, urged the SEC to act last year.

Stewart Baker, a corporate attorney and former assistant secretary of the Department of Homeland Security, said the SEC guidance was detailed enough that companies that know they have been hacked will "have to work pretty hard not to disclose something about the scope and risk of the intrusion."

Otherwise, "this is an opportunity for enforcement that practically hands the case to the SEC on a platter," Baker said.

Lockheed spokesman Chris Williams said hacking was covered under the company's most recent annual securities filing, which has as one of many risk factors "security threats, including threats to our information technology infrastructure, attempts to gain access to our proprietary or classified information, threats to physical security of our facilities and employees, and terrorist acts."

Williams said the May attack had "no material effect on our business."

Mantech International Corp, CACI International Inc and other defense and technology firms that have been reported by security researchers as hacking victims were likewise silent in their most recent filings. Neither Mantech nor CACI responded to interview requests.

"It's common knowledge" that most large defense contractors have been penetrated, said Olcott.

Sikorsky Aircraft, mindful of a strict New Hampshire law warning individuals at risk of identity theft, wrote to that state's attorney general in August that hackers had gotten into its system and could have accessed Social Security numbers of 55 employees who lived in the state.

Sikorsky said the employee data likely was not the hackers' target, which suggests that they might have been after designs or other trade secrets. But Sikorsky parent United Technologies Corp did not mention the May intrusion in subsequent SEC filings.

"Like other companies, our businesses are subject to (information technology) security attacks at times. We monitor systems and cooperate closely with the government when appropriate," said United Technologies spokesman John Moran.

DEARTH OF CONFESSIONS

Melissa Hathaway, a former intelligence official who led U.S. President Barack Obama's initial cybersecurity policy review and helped push the SEC to enact a disclosure policy, said she was "surprised" at the dearth of new confessions.

"The SEC division of corporate finance has an obligation to ask these companies why they didn't disclose," she said. "We need to have transparency on the state of the situation, and we need to have a national conversation regarding the near-term impact of economic espionage and the long-term health of the nation."

The SEC declined to comment. The agency's guidance officially clarifies previous policy instead of establishing a new rule, a process that takes longer and requires a vote of the commissioners. A person close to the agency said it expects fuller disclosures in annual 10-K filings that will begin appearing in volume this month.

Cybersecurity has been an increasing concern in Washington, and Obama asked during his State of the Union speech for action on legislative proposals. Security experts believe hackers are frequently targeting valuable digital information including strategic plans, blueprints and secret formulas.

But security experts in and out of government have complained for years that most companies don't disclose even very successful hacking attacks, because they never find out about them or simply don't want to spook investors, customers or business partners.

The U.S. National Counterintelligence Executive, in a landmark November report that openly accused China of sponsoring military and economic cyber espionage, said that it is hard for companies to estimate the impact of losses that might not be apparent for years.

One Pentagon contractor that did go into some detail recently about the threat was Northrop Grumman Corp, which warned: "Cybersecurity attacks in particular are evolving and include, but are not limited to, malicious software, attempts to gain unauthorized access to data, and other electronic security breaches that could lead to disruptions in mission critical systems, unauthorized release of confidential or otherwise protected information and corruption of data. These events could damage our reputation and lead to financial losses from remedial actions, loss of business or potential liability."

A few technology companies gave even more specific warnings, including Juniper Networks Inc, which makes gear for routing Internet traffic, and chip-maker Intel Corp. Intel had been one of the few to disclose a successful breach in the past, along with Google Inc, which has complained of attacks originating in China.

In a November filing, Intel repeated that hackers had gotten inside and warned that "the theft or unauthorized use or publication of our trade secrets and other confidential business information as a result of such an incident could adversely affect our competitive position and reduce marketplace acceptance of our products."

Some companies asserted that they had not been hacked, or at least averred that they had not been subject to a "material" or "catastrophic" intrusion.

Others confessed to breaches for the first time, including VeriSign and VeriFone Systems, which said it had experienced "security breaches or fraudulent activities related to unauthorized access to sensitive customer information."

The company did not respond to requests for elaboration. Point-of-sale terminals including VeriFone's models are popular targets for criminal hackers, who can tamper with them in order to record passwords and card numbers.

VeriFone has been reported as a supplier of machines to Michaels Stores Inc, a retail chain of hobbyist stores that had to replace more than 7,000 terminals last year after discovering tampering in 20 states.

Two other companies said they disclosed breaches because of the SEC guidance. Tumi Holdings, the luggage maker that is pursuing an initial public offering, said in a stock prospectus that security systems in some of its retail stores had been compromised in the past.

In an interview, Tumi Chief Financial Officer Michael Mardy said there had been no theft of a database or other massive breach. Instead, he said there had been occasions where store employees had conspired with outsiders on a small scale, for example by giving refunds to people who had not made purchases.

"We felt it was necessary to list as a risk factor because it actually is a risk factor," Mardy said.

University of Phoenix parent Apollo Group Inc, which in the past had noted attempted breaches, for the first time said some attempts had succeeded.

"We are facing an increasing number of threats to our computer systems of unauthorized access, computer hackers, computer viruses, malicious code, organized cyber attacks and other system disruptions and security breaches, and from time to time we experience such disruptions and breaches," it wrote in a 10-Q.

Apollo spokesman Rick Castellano declined to say how extensive the breaches had been. "Cybersecurity is an area of growing area of concern for all companies", Castellano said. "We devote significant resources to manage any potential threat."

Chinese Minister Insists Google Obey the Law

Li Yizhong, Chinese Minister of Industry and Information Technology, gestures during a press conference in Beijing Friday, March 12, 2010. Li, China's top Internet regulator, insisted Friday that Google must obey its laws or "pay the consequences," giving no sign of a possible compromise in their dispute over censorship and hacking.

BEIJING (AP) - China's top Internet regulator insisted Friday that Google must obey its laws or "pay the consequences," giving no sign of a possible compromise in their dispute over censorship and hacking.

"If you want to do something that disobeys Chinese law and regulations, you are unfriendly, you are irresponsible and you will have to pay the consequences," Li Yizhong, the minister of Industry and Information Technology, said on the sidelines of China's annual legislature.

Li gave no details of Beijing's talks with Google Inc. over the search engine's January announcement that it planned to stop complying with Chinese Internet censorship rules and might close its China-based site.

"Whether they leave or not is up to them," Li said. "But if they leave, China's Internet market is still going to develop."

China has the world's most populous Internet market, with 384 million people online. Google has about 35 percent of the Chinese search market, compared with about 60 percent for local rival Baidu Inc. Chinese users of Google and even some of China's state-controlled media have warned that the loss of a major competitor could slow the industry's development.

Beijing encourages Internet use for education and business but tries to block access to material deemed subversive or pornographic, including Web sites abroad run by human rights and pro-democracy activists.

Li insisted the government needs to censor Internet content to protect the rights of the country and its people.

"If there is information that harms stability or the people, of course we will have to block it," he said.

Responding to Google's complaints of China-based hacking against its e-mail service and several dozen major companies, Li said the government opposes hacking.

Google CEO Eric Schmidt said Wednesday that the company is in active negotiations with Beijing and expects some resolution in the dispute soon and a return to normal Google SEO operations in China.

Speaking at a conference in the United Arab Emirates, Schmidt declined to provide specifics or predict how long the discussions would last. He said Google has decided not to publicize details of the talks.

Google hopes to resolve its standoff in China within weeks, a person with knowledge of the negotiations said Friday. This person, who spoke on condition anonymity because the talks are still unfolding, couldn't provide a more specific timetable.

Even if the China-based Google.cn search site is shut down, Google wants to keep a Beijing development center, advertising sales offices and a fledgling mobile phone business, according to a person familiar with the company's thinking.

Google will not say how many employees it has in China, but industry analysts estimate the work force at 700. The search engine placement company, based in Mountain View, California, employs about 20,000 people worldwide.

Beijing has rejected suggestions by Western security experts that China's military or government agencies might have been involved in the hacking.

"You cannot find evidence about who organizes such attacks. The Chinese government has repeatedly opposed and deterred hacking attacks," Li said.

People's Republic of Hacking

The Wall Street Journal

'Panda' Exploit Offers Rare Inside Look at China's Cybercrime Networks

WUHAN, China—Some of today's biggest cybersecurity worries trace their roots to this central Chinese city, where a hacker with a junior high school education slapped cartoon pandas onto millions of computers to hide a destructive spy program.

The Panda Burns Incense computer worm, created by 27-year-old Li Jun, wreaked havoc for months in China in 2006 and 2007, eventually landing Mr. Li in jail. Jumping one computer to another by tricking users into opening what appeared to be a friendly email message, the Panda funneled passwords, financial information and online cash balances from game Web sites to Mr. Li's cohorts—leaving a panda as its calling card.

When Google Inc. last month alleged that it and more than 20 other companies were breached in a cyberattack it traced to China, the attack, dubbed Aurora, appeared orders of magnitude more complex than the Panda attack. Unlike the Panda attack, which left a calling card and spread quickly and randomly, the perpetrators of Aurora targeted specific employees within the companies they attacked and went to great lengths to cover their tracks.

There is no evidence thus far that the Google hack has any connection to the Panda's pandemonium. What is clear is that Mr. Li learned his craft and launched his attack within a hacker network in China that remains an active and growing threat to global computer users.

The identity, motivation and methods of Chinese hackers are rarely traceable. But based on interviews with security experts, forensic reports from independent tech firms, and the hackers themselves, the Panda case offers a rare window into how the underground world of Chinese hacking operates.

Mr. Li's Panda attack became known as "the first case of organized cybercrime in China, using a computer virus," according to U.S. technology security firm Symantec Corp. Once a computer was infected, the desktop icon of every executable file, such as Microsoft Corp.'s Word, would change into a picture of a panda. Clicking the panda would prompt the computer to immediately download software from the Internet that in turn allowed Mr. Li's computers to siphon off financial information stored deep inside it.

Cyber experts say hacker forums are very likely fertile recruiting grounds for the Chinese government, which is increasingly anxious about its own cybersecurity. In fact, one person formerly involved in spreading the Panda virus says he was later hired to work with Chinese police to break into accounts of Internet users. That couldn't be independently verified.

China rejects as nonsense that it is a hacker haven. "The government has never supported or been involved in cyber attacks, and it will never do so," Peng Bo, an official with the State Council Information Office's Internet Bureau, told state media in mid-February. "In fact, China is the country worst hit by worldwide hackers."

Investigators probing the Google matter still don't know where it began but have been examining whether computers at China's Shanghai Jiaotong University and Lanxiang Vocational School in Shandong Province were involved in the attacks, according to a person briefed on the matter. The New York Times reported Thursday that the attacks have been traced to computers at the two schools.

Mr. Li was released from prison in December after serving three years of a four-year term for destruction of property related to hacking. He declined a formal interview, but in a series of brief phone calls, online chats and email messages, he said he is looking for a "fresh start," perhaps as a cybersecurity specialist, a so-called "white hat." After his release from jail, Mr. Li spent a few days at his parent's red tiled three-floor house outside Wuhan. Instead, he has crisscrossed the country with his Acer laptop to visit others involved in the Panda attack. Mr. Li says he's interested in working with former co-conspirators on legitimate businesses.

Mr. Li's hacking career began in May 1999, a month before his 17th birthday, when U.S. warplanes bombed China's embassy in Belgrade. Angered by the strike, Mr. Li, who was hanging out at cybercafes in Wuhan, stopped playing computer games to become a hacker.

Mr. Li took lessons from a childhood acquaintance named Lei Lei. He learned how to control thousands of computers as zombie-slaves, or "chickens" in Chinese slang, to attack Websites, Mr. Lei said in an interview. While students in Beijing pelted the U.S. Embassy with rocks, the two skinny teenagers, from the second floor of a dimly lit Wuhan cybercafe called the "Network Club," waged their own "U.S. hacker war," disrupting 20 or 30 U.S. Websites, according to Mr. Lei. "We were too young at the time, doing wild things," Mr. Li said by email.

Over the next few years, the two hacked as teammates, stealing money from Internet users, Mr. Lei recalls. They downloaded simple attack programs found on the Internet to break into gaming accounts to steal and then sell virtual-money credits used by players. To advance in their games, players buy special weapons and other items, which are tradeable for cash.

Mr. Lei, 27, spent a year in the same jail as Mr. Li in Hubei province on similar charges for the Panda attack and was released in 2008. Today he works for his father's manufacturing firm in Wuhan and plans to open an Internet security business. A fan of American hip-hop music, he still flouts authority, steering his luxury Toyota the wrong way down Wuhan streets during an interview to avoid traffic.

The two hackers say they sharpened their skills as part of an online hacker alliance that took its name from a Qing Dynasty insurgency group, the Small Swords Society. Mr. Li adopted the online moniker WHboy, for Wuhan.

In general, Chinese hackers don't fit the Hollywood stereotype of geeky loner-geniuses in American basements or steely smooth Russian mobsters who design and execute hits, reaping all the benefits, cybersecurity experts say. On the contrary, China's hacker community is a widely dispersed, fragmented chain of digital craftsmen. In Chinese, hackers are known as "heike," or black guests.

"As for Chinese hackers, their overall technological skill isn't as good as American or Russian hackers," Mr. Li said in an email, answering questions from the Wall Street Journal. "However, China has the biggest population of hackers in the world." Noting his own communication with foreign hackers, he added, "I often downloaded hacker software from their sites to compare them with programs I wrote or other Chinese hackers wrote."

In China's hacking community, each person does a specific job and, rather than working for a big score, gets paid piecemeal by selling his work, cybersecurity experts say. The programmer of malicious programs usually assembles his program, as Mr. Li did, with lines of computer code he bought elsewhere. The operation works like an assembly line: The programmer then makes customers of others who pay to undertake the broader attack, spreading the malicious software, triggering it and sharing the payoff.

"The chain business is uniquely Chinese," says a Chinese security expert for a major U.S. technology company in Shanghai. Hacker conspiracies in China are structured like multi-level sales networks and even pyramid schemes, he said, not tight-knit criminal gangs that write "technically clean" code designed from the ground up.

Like most Chinese hackers, Mr. Li says he was nurtured inside the informal but active network of online chat rooms where technology break-ins are plotted. According to hackers and Internet security people, such forums are little more than criminal training schools and hardware stores, a cyber underworld where the locks on technological secrets that power online games, bank Websites and Apple Inc.'s iPhone undergo brutal stress tests from the world's largest Internet population.

To sidestep laws against selling malicious software, programmers euphemistically advertise their hacks as "training" and "tutoring," hackers say. Would-be distributors tout themselves as "mail senders," while "script kiddies," keen to build an underworld reputation, will buy hacker tools and pull the trigger.

Anyone along the chain can tweak a virus, for instance, so it attacks another target or trolls for different data. The bounty, benignly called "envelopes," is for sale too: source codes to mimic existing Websites sell priced at 50 yuan, about $7, and data from their users go for 500 yuan. Forum owners and participants mask their identities. The chief barrier to participation is the Chinese language.

Hacker "crowd sourcing"—when large numbers of people contribute to writing code and executing it—reduces the risks individuals face and leaves the network intact if someone does get caught or a forum is shut, Internet security experts say.

By October 2006, looking to filch from several types of online accounts at once, Mr. Li turned to these forums, hoping to steal enough money to buy a Land Rover, he recalled in an email sent to the Wall Street Journal.

Using a Dell computer in a rented apartment in central Wuhan, Mr. Li designed his panda worm, now formally known as W32.Fujacks, to deliver a package of software to Internet users that would steal virtual-money credits and other items from 10 different sources like online game sites. The software exploited poorly protected firewalls to infect virtually any computer connected to the Internet.

Mr. Li fished these hacker forums for usable lines of code, settling on script for a worm called Nimaya. For feedback, in the hacker equivalent of a professional peer review, he dropped samples of his own work into bulletin boards like delphibbs.com, according to Mr. Lei. Hacking "can't have made such fast progress and be here today without innovation, sharing and exchanging of technologies," Mr. Li said by email.

Weeks later, Mr. Li branded his tens of thousands of lines of code with an icon stolen from a chatting website called QQ: a black-and-white panda gripping three incense sticks. He offered the tool that siphoned money out of sites for sale, initially tapping 10 distributors who he charged about $120 each.

With "astonishing frequency," according to Symantec, the panda replicated itself by the millions. For some recipients, it was a reminder of a bug dubbed "ILOVEYOU" that had spread from the Philippines six years earlier. But the panda added a malicious feature: hackers could deploy its "backdoor" to grab virtual money from popular online games, including those run by Tencent Inc. A spokeswoman for Tencent said many companies were affected and declined to comment on the Panda case.

Mr. Lei recalls the two spent every waking moment trying to resell their virtual trove. They fenced it at 10% discounts to face value to online buyers, "like on Ebay," Mr. Lei said. How much the scam brought in isn't known, but Mr. Lei says they could earn $1,200 some days. They partied and Mr. Li bought a $2,000 computer but otherwise Mr. Lei says they didn't spend their winnings much.

Soon Chinese Internet users, including government agencies, were decrying the "poisonous panda." Modified or copycat versions of the panda started doing other kinds of damage: turning screens blue, slowing computer speeds, crashing systems and erasing programs.

By early 2007, the two realized the Panda was "out of control" and set plans to flee to western China. By then, police had tracked the Panda to the $72-per-month apartment in Wuhan rented by Messrs. Li and Lei. Only Mr. Li was home when they swooped in on Feb. 3.

Mr. Li appeared in court handcuffed with a newly shaved head and was convicted of destroying property and stealing $18,000.

Mr. Lei was caught later. Police arrested others in Zhejiang, Yunnan and Shandong provinces for their involvement in the Panda attack, some of whom were jailed as well. Many others were never identified, including people who spurred the Panda's spread and profited from it.

As Mr. Li began his four-year sentence, state media pictured him behind bars in a yellow jumper using a prison computer to exterminate his panda virus. (It didn't work. Last November, McAfee Inc., the Internet security firm, warned fresh strains of the panda bug were spreading.)

In December, Mr. Li was released early for good behavior. His first call was to Mr. Lei.

To his fast-expanding 17,000 following on a Twitter-like service, Mr. Li issued a cryptic message about what he planned for the future: "Bread will come. Milk will come. Everything can be restarted all over again."

Hack Attacks and Technical Snafus at Facebook and Twitter

NEW YORK (AP) - Facebook users have been complaining about problems at the social media site.

Users in the U.S. and other countries reported problems beginning Saturday morning. Some could not log in, and the site was unusually slow and glitchy for others. Users in London, Bangkok and Mexico City reported problems. Many used Twitter to complain.

Facebook spokesman Matt Hicks said it was a "small percentage of users" who had problems accessing Facebook, their friends' profiles or specific site features because of an isolated server problem.

At 6 p.m. Saturday, Facebook said it had restored access to the users who were having access problems.

Facebook, which has more than 100 million users, has occasionally experienced such hiccups. Twitter has had bigger problems. Last August, hackers shut down the short messaging service for several hours. Facebook also experienced problems, though it was never shut down completely.

Three More Criminal Charges For Governor Palin's Hacker
As Originally Posted at PC Mag

David Kernell is not having a good week.

The college student who is accused of hacking into the private Yahoo e-mail account of Alaska governor and former vice presidential candidate Sarah Palin is now facing three additional charges.

Kernell, a 20-year-old student at the University of Tennessee and the son of state Rep. Mike Kernell, has already been charged with gaining unlawful access to stored communications and obtaining information from a protected computer via interstate communication – charges that could carry up to five years in prison and a $250,000 fine.

A grand jury has now added wire fraud, identity theft, and obstruction of justice to the list, according to a March 6 filing. In addition, the count alleging unlawful access to a computer "has been significantly changed," though the filing did not go into detail.

Kernell's legal team intends to file a motion to dismiss the additional charges. As a result, the trial date has been pushed from May 19 until late September or early October.

Kernell turned himself into authorities on Oct. 8. He is accused of hacking into Palin's "gov.palin@yahoo.com" e-mail account on Sept. 16 by successfully navigating Yahoo's password recovery system.