this post was submitted on 04 May 2025
44 points (94.0% liked)

Cybersecurity

7744 readers
127 users here now

c/cybersecurity is a community centered on the cybersecurity and information security profession. You can come here to discuss news, post something interesting, or just chat with others.

THE RULES

Instance Rules

Community Rules

If you ask someone to hack your "friends" socials you're just going to get banned so don't do that.

Learn about hacking

Hack the Box

Try Hack Me

Pico Capture the flag

Other security-related communities !databreaches@lemmy.zip !netsec@lemmy.world !securitynews@infosec.pub !cybersecurity@infosec.pub !pulse_of_truth@infosec.pub

Notable mention to !cybersecuritymemes@lemmy.world

founded 2 years ago
MODERATORS
 

cross-posted from: https://scribe.disroot.org/post/2653687

Archived version

Hackathons are common, but Chinese hacking competitions are different.

...

In 2017, Zhou Hongyi, the founder of Chinese cybersecurity giant Qihoo 360, publicly criticised the practice of sharing vulnerability discoveries internationally, arguing that such strategic assets should stay within China. His sentiments, supported by the Chinese government, gave birth to the national hacking competition called the Tianfu Cup. The contest is focused on discovering vulnerabilities in global tech products like Apple iOS, Google’s Android, and Microsoft systems.

How is Tianfu Cup different?

A 2018 rule mandates participants of the Tianfu Cup to hand over their findings to the government, instead of the tech companies.

Dakota Cary, a China-focused consultant at the US cybersecurity company SentinelOne, said, “In practice, this meant vulnerabilities were passed to the state for use in operations.”

This approach effectively turned hacking competitions into a government pipeline for acquiring zero-day vulnerabilities — software flaws unknown to vendors and extremely valuable for cyber-espionage.

...

In recent years, China’s hacking competitions have increasingly shifted focus toward breaching domestic products, including Chinese-made electric vehicles, phones, and security software.

...

all 25 comments
sorted by: hot top controversial new old
[–] Maeve@kbin.earth 6 points 2 months ago (3 children)

Honestly, every rich country.

[–] randomname@scribe.disroot.org 11 points 2 months ago (1 children)

... criticised the practice of sharing vulnerability discoveries internationally, arguing that such strategic assets should stay within China.

A 2018 rule mandates participants of the Tianfu Cup to hand over their findings to the government, instead of the tech companies.

Which countries do have something similar to a 'Tianfu Cup?'

[–] Maeve@kbin.earth -3 points 2 months ago (1 children)

And handing it to techbros for profit first is different how?

[–] randomname@scribe.disroot.org 11 points 2 months ago (1 children)

As I asked already in this thread: Why is it that whenever one posts something critical of China here on Lemmy, there is some commentary arguing that the US is doing the same? I don't understand that.

That's whataboutery back and forth.

[–] Maeve@kbin.earth -3 points 2 months ago (1 children)

Because if we're focused on other governments' misdeeds, we ignore our own, and our own is the more immediate treat, afaict

Eta unless that's the point

[–] randomname@scribe.disroot.org 9 points 2 months ago (1 children)

That's an absurdly bad take to justify whataboutism.

[–] Maeve@kbin.earth 2 points 2 months ago

You can and will obviously do what you like. My take is, neglecting our own business to focus too much on others' is precisely what got us here. The Red Scare is old tricks and we still refuse to learn from our own mistakes.

[–] Samskara@sh.itjust.works 3 points 2 months ago (1 children)

For some it's an ambition, but not a priority. Germany simply doesn't pay skilled people enough to serve as cyber soldier.

[–] Maeve@kbin.earth 1 points 2 months ago (1 children)

How does mandatory armed or civil service fit into this model?

[–] Samskara@sh.itjust.works 3 points 2 months ago (1 children)

It could help. Mandatory service typically gets you young people straight from school. That means you need to train them. To be good at cybersecurity and cyber warfare takes years though. Not something you can teach over the course of a year of service.

[–] Maeve@kbin.earth 0 points 2 months ago (1 children)

If they get them straight from Gymnasium, there's still time to pound the whole "love of country/fellow countrymen,” too. I don't know because current generations are leaning alarmingly right.

[–] Samskara@sh.itjust.works 1 points 2 months ago (1 children)

love of country/fellow countrymen

Germany is still far below the patriotism of France or Poland. Some adjustment towards their levels of patriotism is about time.

[–] Maeve@kbin.earth 1 points 2 months ago

Patriot is a fancy way of saying nationalist, nowadays. But there's no reason not to have a love of country/fellow citizens. Or global citizens. And that doesn't preclude defense.

[–] Samskara@sh.itjust.works 1 points 2 months ago

For some it's an ambition, but not a priority. Germany simply doesn't pay skilled people enough to serve as cyber soldier.

[–] Sylvartas@lemmy.dbzer0.com 6 points 2 months ago (2 children)

I mean, the NSA doesn't need to do the same because they're wiretapping the entire fucking country (see : room 641A, Edward Snowden...) so they already get every American hackaton's results

[–] randomname@scribe.disroot.org 10 points 2 months ago* (last edited 2 months ago) (1 children)

Not that I think wiretapping is a good thing (it's very bad, no matter who does it), but why is it that whenever one posts something critical of China here on Lemmy, there is some commentary arguing that the US is doing the same? I don't understand that. US wiretapping doesn't make this Chinese policy better.

[Edit to correct a typo.]

[–] Sylvartas@lemmy.dbzer0.com 2 points 2 months ago (1 children)

It doesn't. But it irks me that when the USA does the same shit, if not worse, and just as blatantly, no one cares. But when it's China it's instantly nefarious and dangerous, when in reality it's a world superpower doing exactly what the "good ones" are also doing in this case.

And I'm not pretending that China is less autocratic than our western democracies. But our state surveillance has nothing to envy to theirs.

[–] randomname@scribe.disroot.org 5 points 2 months ago (2 children)

when the USA does the same shit, if not worse, and just as blatantly, no one cares.

This is outright false. Just the most recent post in this community is about the NSA spying on air-gapped networks. And there is an awful lot more news on Lemmy criticizing the US, EU, or other Western democracies. (However, there's no whataboutism in these cases. Why?)

[–] Sylvartas@lemmy.dbzer0.com 3 points 2 months ago* (last edited 2 months ago)

Because criticizing china on that stuff is like beating a dead horse. Of course the autocratic country is gonna spy on their citizens and other countries, and engage in state sponsored hacking (and, mind you, I think it's ok for a State to use hacking defensively). But our leaders are criticizing them for that and foaming at the mouth to do the same shit domestically, which makes us look hypocritical as fuck and opens us up to stupid headlines like "Putin blasts France for police violence during recent protests" (which is very tangentially related but a very common one over here)

I guess I got jumpy because I recently watched a video about this that ended with the usual "the state pulled out an obscure old law and shut down the lawsuit and possibly proceeded to secretly fuck with the whistleblower for a while".

[–] Maeve@kbin.earth -1 points 2 months ago

Don't let the right hand know what the left hand is doing is great for tricks.

[–] Maeve@kbin.earth 0 points 2 months ago (2 children)
[–] x_pikl_x@lemmy.world 1 points 2 months ago

Yearly cyber security convention in USA

[–] kbal@fedia.io 0 points 2 months ago

It's a con. A def one.

[–] randomname@scribe.disroot.org 2 points 2 months ago

'China has almost doubled their aggression in cyber’, experts say

Today, Western governments have been more outspoken in linking China to cyber attacks and sanctioned organizations linked to malicious cyber activity. Despite this growing awareness of the threat posed by China-backed groups, ... people still don’t have a firm grasp on the extent to which China has infiltrated enterprise systems ...