Archived version

Hackathons are common, but Chinese hacking competitions are different.

In 2017, Zhou Hongyi, the founder of Chinese cybersecurity giant Qihoo 360, publicly criticised the practice of sharing vulnerability discoveries internationally, arguing that such strategic assets should stay within China. His sentiments, supported by the Chinese government, gave birth to the national hacking competition called the Tianfu Cup. The contest is focused on discovering vulnerabilities in global tech products like Apple iOS, Google’s Android, and Microsoft systems.

How is Tianfu Cup different?

A 2018 rule mandates participants of the Tianfu Cup to hand over their findings to the government, instead of the tech companies.

Dakota Cary, a China-focused consultant at the US cybersecurity company SentinelOne, said, “In practice, this meant vulnerabilities were passed to the state for use in operations.”

This approach effectively turned hacking competitions into a government pipeline for acquiring zero-day vulnerabilities — software flaws unknown to vendors and extremely valuable for cyber-espionage.

In recent years, China’s hacking competitions have increasingly shifted focus toward breaching domestic products, including Chinese-made electric vehicles, phones, and security software.

  • Umbrias@beehaw.org
    link
    fedilink
    arrow-up
    1
    ·
    3 hours ago

    This is (deploying malware and backdoors outside of wartime, often widely) criticisized very often and rightfully so. By both cybersecurity people and various political leanings, especially leftists.

    Your analogy is good. These things are often intended to kill, and are often countervalue (read: target civilians). It is in fact bad no matter what state does it. It however should also come as no surprise that all states variously want to, though for example the usa has historically gone back and forth on how selective they are for many of the reasons you state. Though other reasons include things like not revealing exact capabilities by releasing malware ahead of time to be spotted and studied.

    • xrun_detected@programming.dev
      link
      fedilink
      English
      arrow-up
      1
      ·
      39 minutes ago

      Thanks for your reply, it made some good points. It however didn’t need the part starting with “It however…” as phrases like this simply devalue everything that was written before them, and are usually followed by a change of topic.

      The topic was the question if deploying trojans in another country’s infrastructure counts as an “ABSOLUTELY defensive” measure.

      It is in fact bad no matter what state does it.

      This could have been a perfect sentence to finish with, don’t you think? ;)

      • Umbrias@beehaw.org
        link
        fedilink
        arrow-up
        1
        ·
        14 minutes ago

        what a strangely passive aggressive and rude response. if you want a comment written in your voice and chosen thoughts, you are free to do so.