bodyType

customContents

entityId

entityUuid

articlePageQuery

filter

article

articleBaseAdvertisingInfoArticle

articleListArticle

articleSeoArticle

helpersCheckIsPostiesArticle

hooksArticleAcknowledgementGateOverlayArticle

hooksTrackPageViewArticle

hooksContentInterestArticle

articleLinkingDataContent

hooksAmpRedirectArticle

articleSchemaContent

liveArticle

advertZone

sentiment

contentLock

topics

types

sections

moreOnThisArticles

urlAlias

commentCount

authorLocations

authors

corrections

sponsorType

displaySlideShow

multimediaEmbed

printHeadline

seriesContainer

socialHeadline

headline

flag

firstTopic

glossary

flattenTypeIds

publishedDate

additionalInfoBoxes

quizIds

images

image

relatedLinks

relatedNewsletters

__typename

createdDate

sponsor

paywallTypes

pdfFiles

seriesReverseOrder

series

disableOffPlatformContent

published

updatedDate

summary

subHeadline

body

keywords

readingTime

customTimezone

liveContents

Zen Soo

A group of hackers gathered for a cruise departing from Hong Kong on Saturday, armed with laptops, smartphones and various electronic devices.
One claimed he could hack into a children’s smartwatch, calling and impersonating a child’s parent. Another wanted to hack into the user accounts of four bike-sharing companies.
Such a scenario might seem sinister, especially since the gathering occurred on the day after a spate of ransomware attacks spread rapidly across the globe, including Spain, France and Russia.
The virus took control of users’ files. In England, for instance, 48 National Health Service hospitals fell victim.

But the hackers meant no malice – they were so-called “white-hat hackers”, who expose vulnerabilities in the smart devices people use in their everyday lives at the GeekPwn (pronounced Geek-Pawn) hacking contest.
White-hat hackers are ethical and aim to discover vulnerabilities in a system in order to strengthen cybersecurity.
Wang Qi, chief executive of Keen Team, a white-hat hacking collective in China that organises annual GeekPwn competitions, said such events enabled hatters to detect loopholes and prevent cyberattacks that could cripple networks across the globe.
Another such example was last year’s Mirai botnet attack, which saw widespread denial-of-service attacks on network systems executed through various internet of things devices such as printers and IP cameras that had been infected by Mirai malware.
At GeekPwn, every hacker’s success is equivalent to successfully preventing another widespread cyberattack
Wang Qi, chief executive, Keen Team
“We are very proud because we’ve actually helped to eliminate many similar issues,” Wang said. “At GeekPwn, every hacker’s success is equivalent to successfully preventing another widespread cyberattack. We’re helping to safeguard the privacy of millions and preventing the loss of data.”
GeekPwn hackers demonstrate the loopholes they have found in various smart devices by hacking them, and the findings are later submitted to product manufacturers so that the security loopholes can be patched.
Security experts from companies such as Tencent Holdings, Baidu and Xiaomi serve as judges for the competition, overseeing each demonstration and ensuring that the loopholes have been successfully proven.

This year, the hack that drew most attention was by a 25-year-old female known only by her initials “tyy”.
Within half an hour, she demonstrated the ability to break into the user accounts of four Chinese bike-sharing companies – Xiaoming, 100Bike, Yonganxing and Xiangqi – obtaining not only a user’s log-in credentials, but also information such as the user’s bike-renting history and account balance.
With the credentials obtained, “tyy” then took her hack a step further – her assistant in Shanghai was able to log into the users’ accounts with the information provided and rent bikes with them, essentially riding for free with someone else’s money.

“Over the past month, I have researched more than 10 bike-sharing companies and found security loopholes in seven of them, although I only demonstrated four [on Saturday],” she said, adding that even the biggest bike-sharing companies were prone to loopholes.
She also previously discovered that Mobike, for instance, one of China’s two largest bike-sharing companies backed by Tencent Holdings, Foxconn and Temasek Holdings, had a security loophole that would allow her to obtain security credentials.
This was patched within a day of her discovery, however, she said, which she put down to a coincidence as she did not report it to the company – but it still showed even major firms had serious loopholes.
“The biggest impact of such a loophole is user privacy. Money is not so much of an issue – one ride is only 50 cents, it will take a long time to lose 100 yuan [US$15]. But many users ride these bikes to their office and back home – hackers can easily find out their addresses through these loopholes,” she said.
She said loopholes that caused a loss of user privacy were “unforgivable”, especially since they were sometimes due to sloppy programming by the respective firms.
Impact of global cyberattack could strike Hong Kong on Monday morning, security experts warn
“A problem with [ride-sharing] is that the industry is expanding much faster than the technology and technology is also developing more rapidly than their security abilities,” Wang said.
“Security and technology development have not been moving at the same pace. Perhaps now, in technology we have surpassed the United States in certain aspects, but in terms of cybersecurity we are still behind by a decade.”
Such hacking competitions can help draw attention to the need for cybersecurity, but despite the buzz generated at such events, companies often still take “little or no action”, according to Michael Gazeley, chief executive of cybersecurity firm Network Box Corp.
“The internet of things is the rapid injection of data into all our lives. Cameras, microphones, GPS location systems ... are monitoring everything we do, say and type. Users can lose privacy, money and even personal safety,” he said.
“Too few people, companies and organisations seem to actually care much about cybersecurity ... Unfortunately, things will only get worse until people wake up and say ‘no’.”


Malaysia assures users their privacy is protected in mobile data grab: ‘truly anonymous’

South Korea’s Lee faces security challenges in ambitious plan to relocate presidential office

Iran says it obtained sensitive Israeli nuclear documents

Hegseth aides probed by Pentagon watchdog for potentially deleting leaked Signal chat messages

Cybersecurity

Hacking elite gather in Hong Kong: but this is for a good cause

British security researcher ‘MalwareTech’, who helped limit Friday’s ransomware attack, has predicted ‘another one coming ... quite likely on Monday’, according to various reports. The virus, which took control of users’ files, spread to 100 countries, including Spain, France and Russia. In England, 48 National Health Service hospitals fell victim. Photo: Reuters

Hacker ÒtyyÓ breaking into a userÕs account in four bike-sharing companies (handout)

Wang Qi, chief executive of KEEN which organises the GeekPwn hacking competition each year (handout)

Hackers demonstrate a loophole in a children's smartwatch, allowing hackers to make calls to a child and impersonate a parent (handout)

China, US anti-hacking group holds first talks since September pact

The two nations agreed during a trip to Washington last year by China’s President Xi Jinping not to knowingly carry out hacking for commercial advantage . Photo: SCMP Pictures

Chinese national Su Bin admits hacking US defence firms to steal plans for fighter jets

Su Bin, in a 2012 photo that was included in court documents. Photo: Handout

BEAUFORT, SC - MARCH 08: (EXCLUSIVE COVERAGE) The F-35B Lightning II fifth generation multi role combat aircraft showing the vertical lift fan, at Marine Corps Air Station Beaufort on March 8, 2016 in Beaufort, South Carolina. UK personnel from the Royal Navy and RAF are embedded with the US Marine Corps on the F-35 operational training programme, based in Beaufort, South Carolina. This includes pilots and engineers, with numbers of UK personnel starting to grow in the build to the reforming of 617 Squadron (the Dambusters) in summer 2018. The Dambusters will reform at Beaufort before returning to the UK, to be based at RAF Marham. Jeff J Mitchell/Getty Images/AFP == FOR NEWSPAPERS, INTERNET, TELCOS & TELEVISION USE ONLY ==

Hacking highlights risks for digital advertisers

Snaptech Marketing co-founder Flavio Marquez cautions that any advertising that relies on algorithms can be hacked. Photo: Rob Kruyt/BIV

Hacking tools stolen from NSA show Chinese cyberfirms were targeted, experts say

The anonymous hacking group Shadow Brokers released some of the data, apparently stolen from the National Security Agency, over the weekend. Photo: AP

Tech

Business

News

Hong Kong

Enterprises

Big Tech

Innovation

One of the young ‘white-hat’ hackers, ‘tyy’, manages to break into user accounts of four Chinese bike-sharing companies within half an hour


Internet