Revealed: The Chinese forums offering hacking courses for just US$100
Amid increasing cyber attacks on both political and commercial targets by groups linked to China, the barriers to entering this potentially lucrative black market industry are close to non-existent as hackers share tips and best practices online.
In April, cybersecurity firm FireEye reported that Chinese hacking groups had been spying on governments and businesses in southeast Asia and India for almost a decade.
Last month, the United States government blamed hacking groups in China for an attack on the Office of Personnel Management which saw the perpetrators make off with at least 21.5 million records, including highly confidential security clearance information.
On the Chinese internet, websites and forums dedicated to teaching hacking proliferate. Techniques on offer can be used by both criminal "black hat" hackers and "white hat" cybersecurity researchers.
On HDHacker, a forum which claims more than 465,000 members, one training programme for "black hat" hackers promises tutors with six years of experience who will guide students through a curriculum that includes "dozens of security and remote control methods" and "site penetration and analysis of source code" for a one off fee of 650 yuan (US$105).
Those willing to pay 990 yuan for the premium service can get VIP treatment with outside experts who give regular online seminars and a curated curriculum.
Another site, "Black Hat Hacker Training Base", offers training for 100 yuan and claims hundreds of subscribers across mainland China.
A number of Chinese universities and the Ministry of Education also sponsor "white hat" hacking competitions, which are often attended by army talent scouts, according to media reports.
HackShanghai, China's largest college hackathon, was hosted in 2014 by New York University Shanghai, an education institute jointly run by New York University and Shanghai's East China Normal University. At the event, more than 100,000 yuan (US$16,000) in prizes were given out by sponsoring companies and entrepreneurs. Neither NYU Shanghai or the Ministry of Education contributed to the prize money.
A 2012 report by security firm Northrop Grumman found that China's cyber warfare tactics "focused on blending the resources of state, civil and military sectors".
"The nexus of the government political ministries with civilian universities represents one element of this strategy," the report said.
In 2013, faculty members at Shanghai's Jiaotong University were linked to Unit 61398 of the People's Liberation Army, a group that has been accused by US authorities of hacking American companies and media outlets.
While there is no evidence to suggest that the university was involved in the cyber attacks in any way, members of its School of Information Security Engineering (SISE) have collaborated with the PLA hackers on several research papers regarding cybersecurity.
"Cybersecurity research can be dual purpose," Adam Meyer, the director of intelligence at security firm CrowdStrike, told Reuters at the time.
Corporations are also known to employ hackers to steal trade secrets and spy on competitors. In an interview with the New York Times, a former hacker said that one of China's largest makers of construction equipment had employed him to commit cyber espionage against a rival firm.
While some hackers may be motivated by patriotism or even a simple desire to cause chaos, hacking can also be a source of incredible personal profit.
An unidentified Russian hacker sold a zero-day exploit (a vulnerability unknown to the software manufacturer and therefore impossible to defend against) to Italian cybersecurity firm Hacking Team for US$45,000 according to emails leaked last week after the firm was itself hacked.
Zero-day exploits and other hacking tools are also traded on "dark net" forums, those hidden from the wider web and accessible only via anonymising software, for thousands of dollars. Hackers also sell stolen credit card and personal information for other criminals to exploit.
A report by the Washington-based think tank the Centre for Strategic and International Studies estimated that each year US$445 billion is lost due to cyber attacks, with this amount expected to increase. The centre said it saw "no credible scenario in which cybercrime losses diminish".
For Chinese hackers, online gaming may be the most lucrative target, according to "PW", a member of a large hacking group on messaging platform QQ who spoke to Tech in Asia.
PW said that one hacker earned as much as 5 million yuan (US$820,000) by selling access to an online game's entire database to a third party.
