Chinese Government's Hacker Competition Is Being Used To Find Exploits To Wield Against Uighur Citizens

from the aiding-and-abetting dept

Anything the Chinese government can weaponize against its Uighur Muslim population, it will. And has. Further details about an iPhone exploit discovered by Chinese hackers show the Chinese government got into the bug bounty program solely to find vulnerabilities to wield against the government's least-liked residents.

Patrick Howell O'Neill's article for MIT Technology Review points out Chinese hackers used to participate in popular hacking competitions like Pwn2Own, providing invaluable assistance to tech companies and tech users by finding vulnerabilities that could be patched before they were exploited by malicious hackers.

In 2017, Chinese participation in international competitions came to a halt. The founder and CEO of tech giant Qihoo 360 publicly criticized Chinese hackers for helping foreign tech companies find and patch security flaws. The CEO suggested this talent should stay at home and help the government find vulnerabilities to exploit.

That's exactly what has happened. The Chinese government banned participation in foreign hacking competitions and started its own. The first homegrown event was won by a researcher working for Qihoo 360, who found an exploit that allowed malicious actors to take control of even the latest iPhones simply by steering the iPhone user to a webpage containing malware.

This was patched two months later by Apple, quietly and with little attention drawn to it. But incidents occurring in the two months between the discovery and the patch didn't go unnoticed. Google's security researchers observed unusual activity and wrote about it.

[I]n August of [2019], Google published an extraordinary analysis into a hacking campaign it said was “exploiting iPhones en masse.” Researchers dissected five distinct exploit chains they’d spotted “in the wild.” These included the exploit that won Qixun [of Qihoo 360] the top prize at Tianfu, which they said had also been discovered by an unnamed “attacker.”

Now, more details about that string of attacks has been revealed. And it shows the Chinese government took the winning exploit and weaponized it against its Uighur population.

Shortly after Google’s researchers noted the attacks, media reports connected the dots: the targets of the campaign that used the Chaos exploit were the Uyghur people, and the hackers were linked to the Chinese government. Apple published a rare blog post that confirmed the attack had taken place over two months: that is, the period beginning immediately after Qixun won the Tianfu Cup and stretching until Apple issued the fix.

This has now been confirmed by another source: the US government. Its surveillance agencies also picked up on the malicious hacking efforts and noted their targeting of China's favorite target of oppression. And it was the government's intervention that sped up Apple's response to the exploit.

The US quietly informed Apple, which had already been tracking the attack on its own and reached the same conclusion: the Tianfu hack and the Uyghur hack were one and the same. The company prioritized a difficult fix.

This is the sort of cooperation one prefers to see. The federal government has often portrayed Apple as an enemy -- not just of agencies like the DOJ, but of the American public. In this case, the government worked with Apple to stop attacks on foreign citizens by a foreign government. The Chinese government made the most of this exploit for two months -- one it obtained through a homegrown hacking competition that appears to exist solely to create offensive tech weapons for state-ordained hacking.

Meanwhile, the hacker who discovered the exploit and collected the cash (all while working for the company whose CEO called for Chinese hackers to stop helping foreign companies and start helping The Man stick it to locals and foreign adversaries) is trying to distance himself from the damage his exploit has wrought.

When we contacted Qixun Zhao via Twitter, he strongly denied involvement, although he also said he couldn’t remember who came into possession of the exploit code. At first, he suggested the exploit wielded against Uyghurs was probably used “after the patch release.”

Both of these claims are untrue. And both have been debunked by both independent research and US government surveillance. While it's unwise to tangle with the Chinese government by refusing to hand over discovered vulnerabilities, it's probably a little easier to sidestep that obligation by sitting out government-sponsored hacking competitions. In the end, this isn't the researcher's fault. The government chose to use it this way. But anyone entering a Chinese government-sponsored hacking competition is likely well aware any discoveries they make will be weaponized by an extremely oppressive government.

Hide this

Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.

Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.

While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.

–The Techdirt Team

Filed Under: china, exploits, hackathon, hackers, hacking competition, surveillance, uighurs
Companies: apple


Reader Comments

Subscribe: RSS

View by: Thread


  • identicon
    Anonymous Coward, 14 May 2021 @ 7:49pm

    In this case, the government worked with Apple to stop attacks on foreign citizens by a foreign government.

    ... because there are those in the American government who also use iPhones. If it had not been a rival government, and in the wild, the NSA would have sat on that vulnerability until the last plausibly deniable moment.

    reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 15 May 2021 @ 6:26am

    disgusting! is it any wonder why communism is despised worldwide, only active in nations where those at the top of the political chain force it to be, under penalty of imprisonment or even death for non-compliers?

    reply to this | link to this | view in chronology ]

    • icon
      PaulT (profile), 15 May 2021 @ 10:14am

      Re:

      Because the US would never do anything similar...

      In other news, there's a bridge that's recently become available and I'm looking for investors.

      reply to this | link to this | view in chronology ]

    • icon
      Scary Devil Monastery (profile), 17 May 2021 @ 12:46am

      Re:

      "is it any wonder why communism is despised worldwide..."

      Well, you are certainly correct about communism. It is, in theory, the perfect social system - if every human worked like a computer, assigning resources according to need and capacity. Since humans aren't perfect communism instead always turns out to be one which benefits a very few at the top at the expense of just about everyone else.

      This is true about every political system but free market capitalism, to name one example, at least incorporates human greed and ambition as a key mechanism. Doesn't make those traits good and without regulation or solid checks and balances pure capitalism becomes as odious as communism.

      Here's the thing; China can call itself "communist" as much as it like but that doesn't make it true. Politically China is the same animal it's always been - a feudal burecucracy governed by an elite conglomeration of old educated clans of academic elites, all wearing an emperor - or president for life - as a figurehead.
      "Communism" is what they've used to convince and brainwash their citizenry while using the same tried-and-true old imperial formula of keeping enough people happy to maintain their government and use iron fists on the rest.

      "...under penalty of imprisonment or even death for non-compliers?"

      Have you looked at the US lately? Scratch that, have you even read US history books? Oppression, genocide, and taking down the minority is a core part of north american history. Just ask asian americans, african americans, the latino community, and, of course, ze jews. Always the jews. And even they have it comparatively easy compared to native americans.

      When studies keep showing that for the same crimes black and latino people are convicted more often and to more severe sentences than white people, it gets real hard for the US to claim moral high ground.

      China's oppression of the Uyghur is not a new story. It goes back many centuries and the victimization of the civilian population has gone unnoticed or been ignored by the west for as long as the western powers have been aware of it.

      In recent times because the US is no longer able to lead the world against ANY moral failing. Not after Abu Ghraib and Guantanamo. Not after the Patriot Act. Not after the war of aggression against Iraq under ridiculously obvious false pretenses.
      GWB and Donald Trump managed to eliminate the US completely as a credible leader.

      This is terrifying as the world certainly needs someone both able to point out to great nations behavior which is not OK or deplorable.

      This is made extra hard as China has been able to consistently call on the same excuses the US has for their actions; in the 50's the Uyghurs managed to briefly secede, aligned with the Soviet Union. In the 2000's the Uyghur independent movement aligned with first Al-quaeda and later on, ISIS/Daesch.

      This means that every time an american diplomat has the balls to raise the question of Uyghur internment camps the chinese response is "So, tell us about Abu Ghraib. Have you dismantled Guantanamo yet? Would you care to take a loot at american mass incarceration statistics?" - and the american diplomat falls silent.

      Two wrongs don't make a right. It's just that no one wants to listen to the obvious hypocrite condemning others for failings they themselves possess.

      reply to this | link to this | view in chronology ]


Add Your Comment

Have a Techdirt Account? Sign in now. Want one? Register here



Subscribe to the Techdirt Daily newsletter




Comment Options:

  • Use markdown. Use plain text.
  • Remember name/email/url (set a cookie)

Close

Add A Reply

Have a Techdirt Account? Sign in now. Want one? Register here



Subscribe to the Techdirt Daily newsletter




Comment Options:

  • Use markdown. Use plain text.
  • Remember name/email/url (set a cookie)

Follow Techdirt
Insider Shop - Show Your Support!

Essential Reading
Techdirt Deals
Report this ad  |  Hide Techdirt ads
Techdirt Insider Chat
Recent Stories
.

This site, like most other sites on the web, uses cookies. For more information, see our privacy policy. Got it
Close

Email This

This feature is only available to registered users. Register or sign in to use it.