How China Is Building an Army of Hackers

Key Concepts:

• Cyber espionage, Chinese hacking ecosystem, vulnerabilities, Pwn2Own, Tianfu Cup, Regulation on the Management of Software Vulnerabilities, I-Soon data leak, Volt Typhoon, Salt Typhoon, living off the land, industrial control system security, critical infrastructure.

China's Cybersecurity Industry and Hacking Ecosystem

• Growth and Intensity: China's cybersecurity industry, including its hacking capabilities, has grown significantly, surprising the world.
• Targets: China has targeted critical infrastructure in the United States, including electrical grids, water treatment facilities, and telecommunications companies.
• Systematic Growth: Over the past 20 years, China has systematically developed its hacker ecosystem to directly integrate it into cyber operations.
• Goal: The goal is to access and maintain access to systems to provide military leadership with the option to disrupt their function.

Pwn2Own Hacking Competition

• Objective: Pwn2Own is a hacking competition where researchers find and exploit vulnerabilities in software and devices for cash prizes.
• Focus: The competition focuses on real-world devices, such as EV chargers, including the Tesla Wall Connector.
• EV Charger Vulnerabilities: EV chargers can communicate with vehicles, creating a potential attack vector. A compromised vehicle can then compromise other EV chargers, leading to widespread compromise.
• Potential Impact: Taking over a vehicle can lead to messing with its systems or even taking over the autopilot of self-driving cars, potentially causing accidents.
• Disclosure and Fixes: Hacking teams must share the vulnerabilities they find with the affected companies (e.g., Tesla) so they can start working on fixes immediately.
• Chinese Teams' Absence: Chinese teams stopped participating in Pwn2Own in 2018 due to government restrictions.

Government Policies and Hacking Competitions in China

• Strategic Development: China has been developing a broader cybersecurity strategy for over a decade, influenced by events like the Snowden leaks and the Arab Spring.
• Investment: The Chinese government has invested heavily in cybersecurity talent, programs, and technology.
• University Curriculum: From 2015 to 2017, policies were implemented to improve cybersecurity degree curriculum in universities.
• Tianfu Cup: A government-sponsored hacking competition where vulnerabilities are fed directly into the Chinese intelligence community.
  • Example: An iPhone vulnerability exploited at Tianfu Cup could be used by the Chinese police to spy on the Uyghur population in Xinjiang.
• Regulation on the Management of Software Vulnerabilities (2021): Requires businesses "doing business in China" to report software vulnerabilities to the government within 48 hours of discovery.
  • Purpose: According to the Chinese Ministry of Foreign Affairs, the aim is to prevent the leakage and unauthorized disclosure of vulnerable information.
• Comparison with the US: While the US government also collects vulnerabilities, there is no legal obligation for researchers and companies to disclose information.
• Similar Goals: Chinese and US hacking teams share similar goals, including controlling the information environment and preparing for cyber warfare.
• Scale of Competitions: China has hosted numerous hacking competitions, including the Wangding Cup, which had 35,000 participants.

I-Soon Data Leak

• Revelation: A data leak from Chinese cybersecurity firm I-Soon revealed that the Chinese government contracts smaller private firms to conduct hacking operations.
• Details: Chat logs showed I-Soon engineers discussing hacking into systems, such as email servers.
• Pervasiveness: I-Soon had contracts with national, provincial, and city law enforcement branches.
• Link to Hacking Contests: The leak showed a connection between hacking contests, vulnerability discovery, and the use of these vulnerabilities by firms hacking on behalf of the Chinese government.
• US Response: I-Soon employees and government officials have been charged by US prosecutors. China has denied involvement and accused the US of cyber espionage.

Cyber Espionage and Disruption Campaigns

• Targets: Cyber espionage campaigns have targeted phone companies, state agencies in India, Malaysia, and Taiwan, as well as the British government and think tanks in London.
• Salt Typhoon: A Chinese state-backed hacking group allegedly tied to a breach of the US Treasury and telecommunication networks (Verizon, AT&T, Lumen).
• Volt Typhoon: Another group that has infiltrated critical infrastructure, using a technique called "living off the land" to remain undetected.

Industrial Control System Security and Critical Infrastructure

• Vulnerabilities: Industrial control systems are often connected through networks, making them accessible from the Internet and vulnerable to attacks.
• Potential Impact: Intruders in key systems can disrupt countries by crippling them in times of conflict or unrest.
• Domino Effect: Compromising electricity can lead to a cascade of failures, affecting oil refineries, hospitals, and other critical services.
• Guam Hack: A Volt Typhoon hack on Guam, which hosts a military base close to Taiwan, may be part of a strategic cyber warfare plan.

US-China Cybersecurity Comparison and Mitigation

• Scale: China's hacking program is larger than that of every major nation combined.
• Mitigation: Preventing Chinese hacking activity is unlikely, but promoting international norms around responsible disclosure and technology safety is crucial.

Synthesis/Conclusion:

The video highlights the significant growth and sophistication of China's cybersecurity industry and its state-sponsored hacking activities. Through government policies, hacking competitions, and the use of private firms, China has created a vast ecosystem for cyber espionage and potential disruption of critical infrastructure. The I-Soon data leak provided a rare glimpse into the inner workings of this ecosystem. While preventing Chinese hacking is challenging, promoting international norms and responsible disclosure is essential for mitigating risks. The US and China are engaged in a complex cyber competition with similar goals but different approaches, and the consequences of this competition are felt globally.