Chinese Cyberattacks: Myth or Menace?
This essay appeared as the second half of a point/counterpoint with Marcus Ranum. Marcus’s half is here.
The popular media narrative is that there is a coordinated attempt by the Chinese government to hack into U.S. computers—military, government, corporate—and steal secrets. The truth is a lot more complicated.
There certainly is a lot of hacking coming out of China. Any company that does security monitoring sees it all the time. Of course, they can’t prove that it comes out of China. But the majority of servers used in the attacks are located in China, using DNS bouncers that can only be registered by people literate in Chinese. The hacker websites where different hackers and hacker groups brag about their exploits and sell hacker tools and how-to videos are written in Chinese. Technically, it’s possible all the attackers are from, say, Canada and trying to disguise themselves, but it seems pretty unlikely.
These hacker groups seem not to be working for the Chinese government. They don’t seem to be coordinated by the Chinese military. They’re basically young, male, patriotic Chinese citizens, demonstrating they’re as good as everyone else. Besides the American networks the media likes to talk about, their targets also include pro-Tibet, pro-Taiwan, Falun Gong and pro-Uyghur sites.
The hackers are in this for two reasons: fame and glory, and an attempt to make a living. The fame and glory comes from their nationalistic goals. Some of these hackers are heroes in China. They’re upholding the country’s honor against both anti-Chinese forces like the pro-Tibet movement and larger forces like the United States. And the money comes from several sources. The groups sell owned computers, malware services and data they steal on the black market. They sell hacker tools and videos to others wanting to pay. They even sell t-shirts, hats and other merchandise on their websites.
This is not to say the Chinese military ignores the hacker groups within their country. The People’s Liberation Army has long had a doctrine of “informationization.” It considers cyberwarfare a leapfrog technology, one that will allow it to achieve military parity with the West without having to engage in an expensive missile-for-missile arms race like the one that bankrupted the Soviet Union. Certainly the Chinese government knows the leaders of the hacker movement and chooses to look the other way. It probably buys good stuff, and probably recruits for its organizations from this self-selecting pool of experienced hacking experts. It certainly learns from the hackers.
And some of the hackers are good. Scott Henderson has been tracking Chinese hacker groups for years and writes about them in his blog, www.thedarkvisitor.com, and his book of the same name. He’s watched the hackers become more sophisticated in tools and techniques. They’re stealthy. They do good network reconnaissance. My guess is what the Pentagon thinks is the problem is only a small percentage of the actual problem.
And they discover their own vulnerabilities. Earlier this year, F-Secure found an attack against a pro-Tibet network that used an unpatched zero-day vulnerability to install a backdoor. That same attack was used two weeks earlier against a large multinational defense contractor. They also hoard vulnerabilities. During the 1999 conflict over the two-states theory, in a heated exchange with a group of Taiwanese hackers, one Chinese group threatened to unleash multiple stockpiled worms at once. There was no reason to disbelieve this threat.
If anything, the fact that these groups aren’t being run by the Chinese government makes the problem worse. Without central political coordination, they’re likely to take more risks, do stupider things and generally ignore the political fallout of their actions. In this regard, they’re more like a non-state actor. So while I’m perfectly happy that the U.S. government is using the threat of Chinese hacking as an impetus to get its cybersecurity in order, and I hope it succeeds, I also hope the U.S. government recognizes that these groups are not acting under the direction of the Chinese military and doesn’t treat their actions as officially approved by the Chinese government.
Categories: Cyberwar and Cyberterrorism