SoylentNews

Freeman [soylentnews.org] writes:

https://arstechnica.com/security/2023/09/how-china-gets-free-intel-on-tech-companies-vulnerabilities/ [arstechnica.com]

For state-sponsored hacking operations, unpatched vulnerabilities are valuable ammunition. Intelligence agencies and militaries seize on hackable bugs when they're revealed—exploiting them to carry out their campaigns of espionage or cyberwar—or spend millions to dig up new ones or to buy them in secret from the hacker gray market.

But for the past two years, China has added another approach to obtaining information about those vulnerabilities: a law that simply demands that any network technology business operating in the country hand it over. When tech companies learn of a hackable flaw in their products, they’re now required to tell a Chinese government agency—which, in some cases, then shares that information with China's state-sponsored hackers, according to a new investigation. And some evidence suggests foreign firms with China-based operations are complying with the law, indirectly giving Chinese authorities hints about potential new ways to hack their own customers.

Today, the Atlantic Council released a report [atlanticcouncil.org]—whose findings the authors shared in advance with WIRED—that investigates the fallout of a Chinese law passed in 2021 [chinalawtranslate.com], designed to reform how companies and security researchers operating in China handle the discovery of security vulnerabilities in tech products.
[...]
The report’s authors combed through the Chinese government's own descriptions of that program to chart the complex path the vulnerability information then takes: The data is shared with several other government bodies, including China’s National Computer Network Emergency Response Technical Teams/Coordination Center, or CNCERT/CC, an agency devoted to defending Chinese networks. But the researchers found that CNCERT/CC makes its reports available to technology "partners" that include exactly the sort of Chinese organizations devoted not to fixing security vulnerabilities but to exploiting them. One such partner is the Beijing bureau of China's Ministry of State Security, the agency responsible for many of the country's most aggressive state-sponsored hacking operations [wired.com] in recent years, from spy campaigns to disruptive cyberattacks. And the vulnerability reports are also shared with Shanghai Jiaotong University [nytimes.com] and the security firm Beijing Topsec [washingtonpost.com], both of which have a history of lending their cooperation to hacking campaigns carried out by China's People Liberation Army.

Original Submission