China’s hackers become its cyber gatekeepers

CHINA, long accused by the US of rampant cyber aggression, may be synonymous with hacking exploits these days, but that does not mean every Chinese hacker is out to pilfer and destroy.

As Chinese companies grapple with a sharp increase in the number of cyberattacks, many hackers are finding it increasingly lucrative to go above board and join the country’s nascent cybersecurity industry.

Zhang Tianqi, a 23-year-old Beijinger, cut his chops in high school trying to infiltrate foreign websites, skirting domestic law by probing for vulnerabilities on overseas gaming networks.

Now, after a stint working at internet blue chip Alibaba Group, he is the chief technology officer of a Shanghai-based cybersecurity firm that owns Vulbox.com, a site offering rewards for vulnerability discoveries, and internet security media site FreeBuf.com.

National priority

“I’d been messing around in the field in my early years, but luckily it just so happens now that there’s this trend of China taking information security very seriously,” Zhang said on June 18.

China’s President Xi Jinping has made cybersecurity a national priority as the country starts to feel the impact of rapid economic growth occurring without a corresponding development in data protection.

In May, China’s National Computer Network Emergency Response Technical Team, a nonprofit agency, said it had recorded 9 068 instances of data leaks in 2014, three times as many as in 2013, reflecting the “grim challenges” of Chinese cybersecurity, according to the official Xinhua news agency.

To try and tackle this, dozens of cybersecurity companies are cropping up across China according to industry observers, populated by young techies with genuine security skills and work experience at firms like Alibaba, Tencent and Baidu.

China is hoping that domestic cybersecurity groups will provide most of its companies with defences against hacking, rather than them relying on foreign firms like Symantec, Kaspersky and EMC Corporation’s RSA.

The gradual professionalism of China’s bedroom hackers traces the country’s rise as an economic and technological force, and its sometimes conflicted position in the escalating global data security arms race.

The US government has attributed sophisticated attacks – including the large-scale data theft this month from the Office of Personnel Management (OPM) – to increasingly advanced state-affiliated teams from China.

But former hackers say the majority of their peers are joining a burgeoning industry to help China firms fend off the numerous attacks they face.

China has denied any connection with the OPM attack and little is known about the identities of those involved in it.

Crackdown

The Cyberspace Administration of China told Reuters in a June 19 fax that it opposed “any form of network attack” and did “not allow any groups or individuals to engage in network-attacking activities” within its borders.

The cybersecurity industry’s growth was partly spurred by a government crackdown on China’s hacking community five years ago – around the same time Beijing passed a series of laws banning hacking and spamming tools and requiring telecom operators to help suppress attacks.

Government sweeps largely silenced once-raucous online forums like kanxue.com, where hackers traded tips and boasted about their conquests.

Many chose to shift from “black hat” activities to “white hat” ones, using their skills to find network vulnerabilities so that they can be fixed.

China’s government has also been working to ramp up the data security of the country as a whole. Agencies, including the Cyberspace Administration of China, have led educational efforts around promoting data security.

Zhang said China was still playing catch up with the US on both the cyber security, and cyber espionage fronts. – Reuters

President Xi Jinping has made cybersecurity a priority as the country starts to feel the impact of rapid growth.