China becoming the world's malware factory

During the economic downturn, Chinese IT pros are resorting to cybercrime, experts say

With China's economy cooling down, some of the country's IT professionals are turning to cybercrime, according to a Beijing-based security expert.

Speaking at the CanSecWest security conference last week, Wei Zhao, CEO of Knownsec, a Beijing security company, said that while many Chinese workers may be feeling hard times, business is still booming in the country's cybercrime industry. "As the stock market dropped like a stone, a lot of IT professionals lost lots of money on the stock market," he said. "So sometimes they sell 0days," he said, referring to previously unknown software bugs.

"China is not only the world's factory, but also the world's malware factory," Zhao said.

China's red-hot economy has been hit by the global recession, and while the economy is still growing, technology companies such as Intel, Motorola and Lenovo have all laid off employees in China in recent months.

Last December, Chinese hackers found a previously undisclosed 0day vulnerability in Internet Explorer. When employees of Zhao's company inadvertently published details of the bug on a public forum, Microsoft was sent scrambling to patch the issue.

Chinese hackers tend to focus on hacking software that runs on the desktop, rather than the server, because the underground market pays big money for client-side bugs, which are then often used to install malicious software on millions of desktops.

While recently investigating a single, but widespread attack, Zhao's researchers counted more then 4 million infected computers over a one-day period.

China has an estimated 250 million computer users, so attackers can do pretty well targeting only Chinese systems. "We have a huge amount of users and a very big local market," he said.

Hackers have had a lot of success launching widespread 0day attacks against programs like RealPlayer and Adobe Flash, but they have also hit local Chinese programs, including Xunlei, QQ and UUSee.

Security is often little more than an afterthought for local software developers, Zhao said.

"In China you have all this third-party software that's very popular, but which is much less secure than Microsoft software," said Wayne Huang, CEO of Web security consultancy Armorize, which has research labs in Taiwan. Not only are exploits for Chinese programs like QQ much easier to find -- software companies tend to take much longer to patch the exploits. "QQ is not going to be able to react as quickly as Microsoft," he said.

Cyberattacks in the region can be ingenious. Earlier this month, criminals redirected Taiwanese traffic to the tw.msn.com and taiwan.cnet.com Web sites using what's known as a non-blind TCP spoofing attack.

In this attack, the hackers managed to compromise a switch in Singapore, the country where the Web sites were hosted, Huang said. They then monitored the switch for traffic and when they saw packets looking for the MSN and Cnet Web sites, they sent back spoofed packets that redirected the victims to a malicious Web site, which launched attack code.

The attack lasted about 10 days, in part because security experts had such a hard time figuring out how it was working. "No attack that I have known has persisted for such a long time," Huang said.

He agreed that the economic downturn has had an effect on computer security. "People are more reluctant to disclose vulnerabilities because now they sell them," he said, and Chinese newsgroups are now awash with postings about hackers receiving large payouts for their exploit codes.

"I think the downturn has definitely made the crime scene a lot more active," he said.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags Chinamalware

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Robert McMillan

IDG News Service
Show Comments

Father’s Day Gift Guide

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Matthew Stivala

HP OfficeJet 250 Mobile Printer

The HP OfficeJet 250 Mobile Printer is a great device that fits perfectly into my fast paced and mobile lifestyle. My first impression of the printer itself was how incredibly compact and sleek the device was.

Armand Abogado

HP OfficeJet 250 Mobile Printer

Wireless printing from my iPhone was also a handy feature, the whole experience was quick and seamless with no setup requirements - accessed through the default iOS printing menu options.

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?