Introduction to Cyber-Warfare - Proiect SEMPER FIDELIS

LEVERAGING RESOURCES BEYOND THE MILITARY: THE CYBER WARRIORS OF CHINA123targeting, and deception. Regarding C2, hacktivist operations can quickly grow into a selfsustainingoperation, making such a movement easily uncontrollable by the PLA. INEW’sfocus on precision targeting and operational discipline (which we shall note in some of thecase studies later in the chapter) is also difficult to foster in a hacktivist movement. Finally,as hacktivism is inherently public, operational security becomes extremely difficult, makingdeception and plausible deniability hard to implement.With the PRC cracking down on hacking not condoned by the government and withhacktivism not fitting into the PLA strategy, what becomes of the Chinese hackers who wereactive in the early 2000s? It turns out that the PRC and PLA were able to leverage this pool oftalent, but in a more controlled manner. This was accomplished by many key members of thehacker community making the transition from “black hat” (unsupervised, extragovernmental,or illegal hacking) to “white hat” (“ethical” hacking normal in the form of “security consulting”).There were two ways in which this occurred, one of which saw many hacker groups reinventingthemselves as computer security firms—often seeking a relationship with the government. Thechart below lists some hacker groups from the late 1990s/early 2000s that later became securityfirms that established a relationship with the Chinese government (Table 7.1). 20The second way in which the PRC encouraged members of the Chinese hacker communityto turn “white hat” was through direct recruiting of skilled hackers. For example, according toNorthrop Grumman’s report in 2007 and 2008, a user known as “City_93” posted job announcementsfor the Ministry of Public Security’s First Research Institute on two of the mostwell-established hacker forums. d Not only has the PRC attempted to recruit hacking talentbut the PLA has succeeded in doing so as well. In 2005, they allegedly held a series of regionalhacker competitions—most likely to identify and recruit hacker talent. 21In another example of the black hat-to-white hat transition, Peng Yinan, alleged cofounderof the Chinese hacking group Javaphile, is believed to be currently conducting research onbehalf of the Chinese government. Based on the analysis by American security specialist ScottHenderson, Peng Yinan (under the screen name “CoolSwallow”) is thought to have led theJavaphile hacking group to conduct a large-scale attack against the White House in responseto the accidental bombing of the Chinese embassy in Serbia by the United States in 1999. 22Yinan surfaced in 2008 when he published, under his own name, two academic articles oncyber espionage techniques. In the publications, he along with other former Javaphile members,was listed as researchers under the Shanghai Jiaotong University’s Information SecurityTABLE 7.1Chinese Hacker Groups and Corresponding Security FirmsHacker groupGreen Army AllianceXConPatriot Hackers-Black Eagle BaseSecurity firmNSFocusXFocusBlack Eagle Honker Base aa The Black Eagle Honker Base is not a security firm, but rather an informal group that reformed 6 months after the Patriot Hackers—Black EagleBase was shut down. The group then released a statement espousing that the group was now partaking in efforts to train individuals from the stateand work to improve the PRC’s network security industry.d The hacker forums to where the job announcement were found were EvilOctal.com and XFocus.net.