...
By Hugh Cameron
Reporter
0
Share
Newsweek is a Trust Project member
See more of our trusted coverage when you search.Prefer Newsweek on Googleto see more of our trusted coverage when you search.
China's spy agencies are using talent competitions to recruit young hackers for cyberattacks on the US.
The revelation comes in a new report that has shed fresh light on the secretive state's "hack for hire" programme, which the authors said was "unlike anything we have ever seen."
Read more: Protect Your Workplace With One of These Business VPNs
Read More on News
Cyber experts have called on the government and big business to do more in the wake of the report from ETH Zurich's Center for Security Studies, which revealed how China is weaponizing the brains of its young technophiles.
Beijing has banned homegrown talent from competing in international hacking, in which contestants compete to exploit vulnerabilities in widely used software for cash prizes, and created its own events, the report said.
Chinese hackers are now forced to compete in government-sanctioned domestic events, giving spy agencies a pipeline of knowledge and manpower that can be exploited for use against the U.S. and its allies.
Read more: NordVPN Review
Former top hackers in international competitions, such as Pangu Team, have subsequently been assimilated into Beijing's cybersecurity arsenal. They are now part of the software company Qi An Xin, which the report described as "deeply connected to China's government agencies."
...
Linda Zecher, the CEO of the US-based cyber security company IronNet, said: "This report demonstrates why governments and corporations need to ensure that their cyber security systems are up to date and can withstand the most sophisticated hacks.
"Hackers will adapt and evolve to break into even the most secure systems and that is why IronNet's collective defence system offers the best protection against hostile state and non-state actors," she told National Security News.
Read more: NordVPN vs. ExpressVPN
Jamie MacColl, a Research Fellow in Cyber Threats and Cyber Security at Royal United Services Institute, told Newsweek that the format overcomes a "libertarian streak in the hacker community," which would be less likely to collaborate with officials in the Chinese Communist Party (CCP) or military if not for this contest-based system and cash prizes.
Chinese security researchers began dominating international hacking competitions after 2014. At the Pwn2Own competition, Chinese teams' winnings increased from 13 per cent in 2014 to 79 per cent by 2017.
Realising the strategic value, the Chinese government then banned researchers from international tournaments and created new events.
In 2019, Google researchers identified five "exploit chains" - cyber attacks which utilize multiple vulnerabilities to strike a target - one of which was demonstrated during the 2018 Tianfu Cup. This exploit was later used in "a surveillance and hacking campaign targeting Uyghur Muslims," the CSS report said.
Other revelations include the extensive collaboration between top Chinese universities with the Chinese government across a "spectrum of cyber activities," and a complex "hack-for-hire ecosystem".
...
Cyber espionage has been an increasingly important aspect of Chinese foreign policy.
In February, Federal Bureau of Investigation Director Christopher Wray warned of the Chinese government targeting "critical" American infrastructure, and expressed the need for vigilance.
"There has been far too little public focus on the fact that PRC hackers are targeting our critical infrastructure—our water treatment plants, our electrical grid, our oil and natural gas pipelines, our transportation systems," Wray told a House of Representatives' Select Committee.
The way Beijing has been able to blend its computer-savvy citizenry with the state-run espionage operations adds a new dimension to the U.S. anxiety over Chinese hacks.
Do you have a story we should be covering? Do you have any questions about this article? Contact LiveNews@newsweek.com
View 0 Comments
Submit Correction
View Editorial & AI Guidelines