Skip to main content

Hong Kong Security Watch Report (Q3 2017)

Release Date: 31 Oct 2017 2716 Views

HKCERT is pleased to bring to you the "Hong Kong Security Watch Report" for the third quarter of 2017.


Nowadays, a lot of “invisible” compromised computers are controlled by attackers with the owner being unaware. The data on these computers may be mined and exposed every day and the computers may be utilized in different kinds of abuse and criminal activities.


The Hong Kong Security Watch Report aims to provide the public a better "visibility" of the situation of the compromised computers in Hong Kong so that they can make better decision in protecting their information security.


The report provides data about the activities of compromised computers in Hong Kong which suffer from, or participate in various forms of cyber attacks, including web defacement, phishing, malware hosting, botnet command and control centres (C&C) and bots. Computers in Hong Kong is defined as those whose network geolocation is Hong Kong, or the top level domain of their host name is “.hk” or “.香港”. 


Highlight of Report

This report is for Quarter 3 of 2017.


In 2017 Q3, there were 8,519 unique security events related to Hong Kong used for analysis in this report. The information is collected with IFAS1 from 19 sources of information2. They are not from the incident reports received by HKCERT.


Figure 1 –Trend of security events


The total number of security events in 2017 Q3 decreased by 6% or 523 events compared to the previous quarter. The significant drop in the number of defacement events was compensated by the increase in both the phishing and malware hosting events, hence the slight decrease in overall.




Server related security events


Server related security events include malware hosting, phishing and defacement. Their trends and distributions are summarized below:


 Figure 2 –Trend and distribution of server related security events


The number of server related security events continued declining, from 4,015 in the last quarter to 3,386 (16%). The number of defacement events sharply decreased by 61%. Even so, the number of the other two types increased and comprised the majority. The phishing events had a stunning growth of 157% and there was a rise of 42% in malware hosting events.


In phishing events, .com and .top were the two main contributors. For the .com domain, it was a Japanese one that accounted for the majority of the count. Further research reveals that it was a malicious dating website and targeted the Japanese users. After they had registered on the website, their personal and contact information may have been leaked and they started receiving scam emails or SMS. For .top, it was a domain owned by a Hong Kong company and was breached to host phishing content to target the portal of a famous gaming company (


On the other hand, the URL/IP ratio of malware hosting events reached a very high value of 12, meaning there were plenty of websites compromised to spread malware. Therefore, it is of paramount importance to keep your website highly secure.



 HKCERT urges system and application administrators to protect the servers.

  • patch server up-to-date to avoid the known vulnerabilities being exploited
  • update web application and plugins to the latest version
  • follow best practice on user account and password management
  • implement validation check for user input and system output
  • provide strong authentication e.g. two factor authentication, administrative control interface
  • do not expose unnecessary services to the internet



Botnet related security events


Botnet related security events can be classified into two categories:

  • Botnet Command and Control Centres (C&C) security events – involving small number of powerful computers, mostly servers, which give commands to bots
  • Bots security events – involving large number of computers, mostly home computers, which receive commands from C&C.


Botnet Command and Control Servers

The trend of botnet C&C security events is summarized below:


 Figure 3 –Trend of Botnet (C&Cs) related security events


Only 1 IRC botnet Command and Control (C&C) server was identified in this quarter.


Botnet Bots

The trend of botnet (bots) security events is summarized below:


 Figure 4 - Trend of Botnet (Bots) security events


In this quarter, the number of Botnet (bots) on Hong Kong network had a very small increase of only 2%. The WannaCry ransomware still ranked the top. Interestingly it was the only one that recorded an increase (25%) while the remaining ones all decreased in the Hong Kong's major botnet families with repect to Q2 (P.16 of the report).



 HKCERT urges users to protect computers so as not to become part of the botnets.

  • patch their computers
  • install a working copy of the security software and scan for malware on their
  • machines
  • set strong passwords to avoid credential based attack
  • do not use Windows, media files and software that have no proper licenses
  • do not use Windows and software that have no security updates
  • do not open files from unreliable sources


HKCERT has been following up the security events received and proactively engaged local ISPs for the botnet clean up since June 2013. Currently, botnet cleanup operations against major botnet family - WannaCry, Avalanche, XCode Ghost, Pushdo, Citadel, Mumblehard, Ramnit, ZeroAccess and GameOver Zeus are still in action.


HKCERT urges general users to join the cleanup acts. Ensure your computers are not being infected and controlled by malicious software.


Protect yourself and keep the cyberspace clean.



 Users can use the HKCERT guideline to detect and clean up botnets



Download Report


< Please click to download Hong Kong Security Watch Report >


1 IFAS  Information Feed Analysis System is a HKCERT developed system that collects global security intelligence relating to Hong Kong for analysis.

2 Refer to Appendix 1 for the Sources of Information