China hacker opens window into cyber-espionage

BEIJING — For a 25-year-old computer whiz enlisted in a People’s Liberation Army hacking unit, life was all about low pay, drudgery and social isolation.

Nothing at all like the unkempt hackers of popular imagination, the young man wore a military uniform at work in Shanghai. He lived in a dorm where meals often consisted of instant ramen noodles. The workday ran from 8 a.m. to 5:30 p.m., although hackers were often required to work late into the evening.

With no money and little free time, he found solace on the Internet. He shopped, chatted with friends and courted a girlfriend. He watched movie and television shows. He drew particular inspiration from the Fox series “Prison Break,” and borrowed its name for his blog.

The blog provides a rare peek into the secretive hacking establishment of the Chinese military, which employs thousands of people in what is believed to be by far the world’s largest institutionalized hacking operation.

Concern about computer security has risen sharply in recent weeks. Top U.S. intelligence officials said Tuesday that attacks and espionage now pose a greater potential danger than al-Qaida and other militant organizations. The computers of more than 30 journalists and executives of Western news organizations in China, including The New York Times and The Wall Street Journal, have been hacked.

Mandiant Corp., a U.S. computer security compamy based in Alexandria, Va., said in a report last month that it had traced an epidemic of attacks on dozens of U.S. and Canadian companies to an office building in Shanghai occupied by an espionage unit of the People’s Liberation Army.

Richard Bejtlich, Mandiant’s security chief, said posts written by the blogger, who called himself “Rocy Bird,” provided the most detailed first-person account known to date of life inside the hacking establishment. Although the blog was discontinued four years ago, the techniques described in it remain the same. “It is relevant,” said Bejtlich. “Things have not changed that much.”

The hacker, whose real family name is Wang, posted 625 entries between 2006 and 2009. “Fate has made me feel that I am imprisoned,” he wrote in his first entry on Sina.com. “I want to escape.”

Los Angeles Times reporters tracked down Wang and his blog through an e-mail address that was listed on a published 2006 paper about hacking. A coauthor of the paper was Mei Qiang, identified by Mandiant as a key hacker who operated under the alias “Super Hard” in Unit 61398.

One of many Chinese military units linked to hacking, Unit 61398 falls under the People’s Liberation Army’s General Staff 3rd Department, 2nd Bureau, which is roughly equivalent to the U.S. National Security Agency.

The PLA recruits computer scientists, mathematicians and linguists from China’s top universities for its Internet espionage programs. Not unlike in the U.S., students can continue their education for free in return for their enlistment in military service.

Wang earned his master’s degree in Internet security at age 25 at the Information Engineering University, run by the PLA in Zhengzhou, Henan province.

Immediately after graduating in 2006, he was enlisted in a hacking operation in Shanghai.

In the blog, Wang did not disclose which unit he worked for, but he made it clear that he was wearing a uniform and carrying a military badge. He described his building as being far from the Shanghai city center, one of his many complaints.

“What I can’t understand is why all the work units are located in the most remote areas of the city,” Wang wrote in an entry in 2007. “I really don’t get what those old guys are thinking in the beginning. They should at least take us young people into consideration. How can passionate young people like us handle a prison-like environment like this?”

One of his first tasks was to improve on a Trojan virus known as Back Orifice 2000, which is designed to remotely hijack a computer system to steal information.

In July 2007, he boasted that his virus had successfully escaped detection by three leading detection programs made by McAfee, Symantec and Trend Micro, but that it didn’t get past a fourth, Kaspersky. He also described another assignment: write a virus that would detect any USB storage device attached to a computer and copy its files. The virus was a success and Wang’s boss was pleased.

“If we’re lucky enough, we might be able to complete this year’s target and earn a year-end bonus for everyone,” Wang wrote with enthusiasm.

Otherwise, Wang poured out his unhappiness. The hackers were required to speak English, the international language of technology, as well as an essential for phishing attacks on mostly U.S. targets. But when Wang tried to hone his English skills by reading magazines such as the Economist and Harvard Business Review, his boss rebuked him for reading too much foreign press.

“The boss doesn’t understand. I’ll have to be more careful,” he complained. Wang was also unhappy that supervisors refused to reimburse him for a $1 bus ticket to attend a business conference, while his boss claimed more than $100 for a bottle of liquor.

A high school reunion left Wang feeling discouraged about his paycheck and prospects.

“They all have a bright future. Some of them became lawyers; some went into property business or finance; some wrote programs for a commercial software company. Compared with their handsome monthly income, I even felt ashamed to say hello to them,” Wang wrote.

Wang never reflected on the pros and cons of hacking for the Chinese government, but he clearly regretted having enlisted. “My only mistake was that I sold myself out to the country for some minor benefits and put myself in this embarrassing situation,” he wrote. With the help of his family, he managed to get out in 2008. He stopped writing the blog a year later.

Wang is believed to be living in Chengdu. One of his last online traces was a comment posted on Dianping, a popular restaurant review site, about an ice cream parlor in that city.

Wang did not return several e-mails and instant messages requesting comment.

The period covered in Wang’s blog coincides with an upsurge in hacking detected by Mandiant. In a report issued last month, the company said hackers had systematically stolen hundreds of terabytes from 141 organizations, most of them American.

Industries targeted included chemicals, technology, financial services, mining, energy, health care, media and international organizations. The data included blueprints, pricing strategies and e-mails, which are suspected of being given to Chinese state-owned enterprises for competitive advantage.

The Chinese government has repeatedly denied hacking and has said it has been the victim of attacks originating from the United States.

“Cyberspace needs rules and cooperation, not war. China is willing to have constructive dialogue and cooperation with the global community, including the United States,” Foreign Ministry spokeswoman Hua Chunying said at a briefing Tuesday.

Last month’s report by Mandiant marked the first time individual hackers were identified by name. More information has trickled out since.

Investigators have unearthed birthdays, photographs, profiles on Kaixin (a Chinese version of Facebook), shopping and dining preferences. One hacker’s user name appeared in a forum for flower-arranging enthusiasts.

They logged on to personal e-mail or social networking sites from work, or used their real phone numbers to register Gmail or Hotmail accounts later used for phishing attacks. Mei Qiang, Wang’s research partner, posted a note on a software developer’s message board looking for extra work.

“I’m good at writing hacking tools, such as Trojan viruses,” read the advertisement posted in 2005. It was taken down last month after it was discovered by an investigator based in India who runs a blog called Cyb3rSleuth.

“These were not elite uber-hackers,” said Richard Mogull, an Internet security consultant and head of the Phoenix-based Securosis. “Some people want to demonize these guys, but they are just frontline soldiers doing their job for their country – not evil people.”

Wang probably never imagined his blog would catch the focus of journalists or Internet security experts, Bejtlich said. “This is really an anguished person who didn’t enjoy his situation, and this is probably just an outlet for him to share his story,” he said.

Because the hackers were operating under military protection, they probably weren’t as intent on concealing their identities as criminals who would face punishment if caught. Bejtlich compared them to members of the U.S. military who inadvertently make disclosures on Facebook or on blogs. “They will get better. That’s how they will learn.”

Talk to us

> Give us your news tips.

> Send us a letter to the editor.

> More Herald contact information.

More in Local News

A firefighter stands in silence before a panel bearing the names of L. John Regelbrugge and Kris Regelbrugge during the ten-year remembrance of the Oso landslide on Friday, March 22, 2024, at the Oso Landslide Memorial in Oso, Washington. (Ryan Berry / The Herald)
‘Flood of emotions’ as Oso Landslide Memorial opens on 10th anniversary

Friends, family and first responders held a moment of silence at 10:37 a.m. at the new 2-acre memorial off Highway 530.

Julie Petersen poses for a photo with images of her sister Christina Jefferds and Jefferds’ grand daughter Sanoah Violet Huestis next to a memorial for Sanoah at her home on March 20, 2024 in Arlington, Washington. Peterson wears her sister’s favorite color and one of her bangles. (Annie Barker / The Herald)
‘It just all came down’: An oral history of the Oso mudslide

Ten years later, The Daily Herald spoke with dozens of people — first responders, family, survivors — touched by the deadliest slide in U.S. history.

Victims of the Oso mudslide on March 22, 2014. (Courtesy photos)
Remembering the 43 lives lost in the Oso mudslide

The slide wiped out a neighborhood along Highway 530 in 2014. “Even though you feel like you’re alone in your grief, you’re really not.”

Director Lucia Schmit, right, and Deputy Director Dara Salmon inside the Snohomish County Department of Emergency Management on Friday, March 8, 2024, in Everett, Washington. (Ryan Berry / The Herald)
How Oso slide changed local emergency response ‘on virtually every level’

“In a decade, we have just really, really advanced,” through hard-earned lessons applied to the pandemic, floods and opioids.

Ron and Gail Thompson at their home on Monday, March 4, 2024 in Oso, Washington. (Olivia Vanni / The Herald)
In shadow of scarred Oso hillside, mudslide’s wounds still feel fresh

Locals reflected on living with grief and finding meaning in the wake of a catastrophe “nothing like you can ever imagine” in 2014.

Rep. Suzan DelBene, left, introduces Xichitl Torres Small, center, Undersecretary for Rural Development with the U.S. Department of Agriculture during a talk at Thomas Family Farms on Monday, April 3, 2023, in Snohomish, Washington. (Olivia Vanni / The Herald)
Under new federal program, Washingtonians can file taxes for free

At a press conference Wednesday, U.S. Rep. Suzan DelBene called the Direct File program safe, easy and secure.

Former Snohomish County sheriff’s deputy Jeremie Zeller appears in court for sentencing on multiple counts of misdemeanor theft Wednesday, March 27, 2024, at Snohomish County Superior Court in Everett, Washington. (Ryan Berry / The Herald)
Ex-sheriff’s deputy sentenced to 1 week of jail time for hardware theft

Jeremie Zeller, 47, stole merchandise from Home Depot in south Everett, where he worked overtime as a security guard.

Everett
11 months later, Lake Stevens man charged in fatal Casino Road shooting

Malik Fulson is accused of shooting Joseph Haderlie to death in the parking lot at the Crystal Springs Apartments last April.

T.J. Peters testifies during the murder trial of Alan Dean at the Snohomish County Courthouse on Tuesday, March 26, 2024 in Everett, Washington. (Olivia Vanni / The Herald)
Bothell cold case trial now in jury’s hands

In court this week, the ex-boyfriend of Melissa Lee denied any role in her death. The defendant, Alan Dean, didn’t testify.

A speed camera facing west along 220th Street Southwest on Tuesday, Nov. 21, 2023 in Edmonds, Washington. (Olivia Vanni / The Herald)
New Washington law will allow traffic cams on more city, county roads

The move, led by a Snohomish County Democrat, comes as roadway deaths in the state have hit historic highs.

Mrs. Hildenbrand runs through a spelling exercise with her first grade class on the classroom’s Boxlight interactive display board funded by a pervious tech levy on Tuesday, March 19, 2024 in Marysville, Washington. (Olivia Vanni / The Herald)
Lakewood School District’s new levy pitch: This time, it won’t raise taxes

After two levies failed, the district went back to the drawing board, with one levy that would increase taxes and another that would not.

Alex Hanson looks over sections of the Herald and sets the ink on Wednesday, March 30, 2022 in Everett, Washington. (Olivia Vanni / The Herald)
Black Press, publisher of Everett’s Daily Herald, is sold

The new owners include two Canadian private investment firms and a media company based in the southern United States.

Support local journalism

If you value local news, make a gift now to support the trusted journalism you get in The Daily Herald. Donations processed in this system are not tax deductible.