madison

Zero Day

Ryan Naraine and Dancho Danchev

China's Blue Army: When nations harness hacktivists for information warfare

By | May 31, 2011, 7:17am PDT

Summary: The methodology used in offensive cyber warfare is fairly simple — if you’re attacking us we reserve the right to strike back at you. That methodology is just plain wrong.

China has recently announced the existence of the Blue Army, a government sponsored cyber warfare unit similar to those launched by the U.S, the United Kingdom, Australia and Israel.

Although the majority of the cyber warfare units have been established for defensive purposes, it’s the offensive cyber capabilities that are worth discussing in the context of establishing a borderline for offensive cyber operations. The methodology used in offensive cyber warfare operations is fairly simple - if you’re attacking us we reserve ourselves the rights to strike back at you.

It’s a methodology that is totally wrong, taking into consideration the fact that the attack may be coming from a country that is basically abusing the infrastructure of another country, in a combination with reliance of localized attack kits and tactics typical to those used by what is originally perceived as the attacking country.

It’s been a decade since the release of the Chinese “Unconventional warfare” book, and a lot has changed from a conceptual perspective. From symmetric to asymmetric shift in the concepts, to the currently in progress of implementation unrestricted warfare military doctrines, the Chinese has proven that they they’re not just able to keep up with the developing environment, but to dominate it with new concepts in cyberspace.

What constitutes unrestricted warfare in the cyberspace realm, really? Basically, it’s the reliance on civilians for executing government sponsored or government tolerated cyber operations, the so called people’s information warfare concept. The concept is fairly simple. Instead of establishing a dedicated cyber warfare unit, a country such as China is actively harnessing the potential of its hacktivist community for executing military operations and activities across the Web.

A number of questions remain for each and every cyber warfare department compared to the people’s information warfare empowered civilians:

  • Would they be allowed to embed sites of human rights watch activists with malicious software, and develop custom malware?
  • Would they be allowed to hijack an existing botnet for the purpose of data mining for OSINT-gathering practices?
  • Would they be allowed to launch offensive cyber warfare practices such as Denial of Service attacks against compromised infrastructure residing in a 3rd country?
  • Would take take into consideration island hopping tactics before striking back?
  • Would they be allowed to develop practical web exploitation tools assisting in massive exploitation attacks?
  • To what degree would they be allowed to outsource their operations to providers of malicious underground services, instead of developing in-house solutions?

The answer to the majority of these is probably no, as the majority of these tasks are already actively executed by the Chinese cybercrime underground and the extremely vibrant hacktivist community inside the country — China Eagle Union, the Hacker Union of China, and the Red Hacker’s Alliance for starters. This has become possible due to the China’s military realization of the untapped potential for asymmetric cyber dominance, thanks to the government tolerated and nurtured vibrant hacktivist community.

The Chinese underground and hacktivist community is developed well enough to manage the tasks of a fully operational cyber warfare unit, because it relies on the people not on the department.

The net is vast and infinite, and trying to establish a borderline for cyber warfare operations based on the actions of the actual cyber warfare units, and not on the vibrant hacktivist communities and cybercrime underground within the countries, is totally wrong.

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

Topics

Dancho Danchev is an independent security consultant and cyber threats analyst, with extensive experience in open source intelligence gathering, malware and cybercrime incident response.

Disclosure

Dancho Danchev

More details on Dancho Danchev's current and past professional affiliations, can be found in his LinkedIn profile.

Biography

Dancho Danchev

Dancho Danchev is an independent security consultant and cyber threats analyst, with extensive experience in open source intelligence gathering, and cybercrime incident response. He's been an active security blogger since 2007, and maintains a popular security blog sharing real-time threats intelligence data with the rest of the community on a daily basis. More details on Dancho Danchev's current and past professional affiliations, can be found in his LinkedIn profile. You can also follow him on Twitter

Talkback Most Recent of 3 Talkback(s)

  • Al Qaeda Plotting Cyber Attack on U.S. Banking
    http://www.centerfornationalpolicy.org/ht/display/ContentDetails/i/995

    Worth remembering that the war industry was promoting Bin Laden cyber attacks on America for years. When they actually caught Bin Laden, he was living in a crappy concrete house, without internet, an old CRT TV. Just a bloke, not a supervillain.

    This is an Aussie newspaper quoting a unnamed Chinese 'ex general' (unlikely) using cyber war phrases to describe a basic sys-admins job. Is more likely to be some Chinese person they interviewed with the writer projecting that cyber-nonsense to make it a more interesting story.

    Quit building up imaginary enemies into super villains. If as much effort had gone into getting Bin Laden in 2004 as went into marketing the 'cyber-terror' (now 'Cyber war') brand, then you'd have got him 7 years earlier.

    If Lockheed had puch as much effort into keeping their firewalls up to date, as they do in marketing the 'cyber-war' meme, then they wouldn't be claiming to be a victim of a sustained cyber attack, they'd be calling it nuisance traffic like everyone else does.
    ZDNet Gravatar
    guihombre
    31st May
  • Payload Mass, Vehicle Mass and Speed
    A 12 ton payload on a 275 ton vehicle seems rather low. I wonder what the payload to vehicle mass is for most other systems? I think a chart comparing payload mass, vehicle mass and speed would be interesting.
    ZDNet Gravatar
    ivank2139
    31st May
  • RE: China's Blue Army - departmental warfare VS people's information warfare concept
    @ivank2139

    What? What does that have to do with anything? I think you responded to the wrong article. Or maybe the wrong site.
    ZDNet Gravatar
    josh92
    31st May

Talkback - Tell Us What You Think

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]
Click Here

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

White Papers, Webcasts, & Resources