All Episodes

June 17, 2025 16 mins

Teams from China used to dominate international hacking competitions, until Beijing ordered them to stop attending and take part only in domestic tournaments.

On today’s Big Take Asia Podcast, host K. Oanh Ha talks to Bloomberg’s Jamie Tarabay about how tournaments are helping boost China’s cyber-espionage capabilities and what that means for the world.

Read more: Chinese Hacking Competitions Fuel the Country’s Broad Cyber Ambitions - Bloomberg

Further listening: The ‘Everything, Everywhere, All at Once’ Cyber Threat

Watch, from Originals: How China Is Building an Army of Hackers

See omnystudio.com/listener for privacy information.

Mark as Played
Transcript

Episode Transcript

Available transcripts are automatically generated. Complete accuracy is not guaranteed.
Speaker 1 (00:02):
Bloomberg Audio Studios, podcasts, radio news.

Speaker 2 (00:09):
Okay, let's get started.

Speaker 3 (00:12):
Off and why are three?

Speaker 1 (00:16):
Two?

Speaker 3 (00:18):
Good Guy? As President Trump was preparing to take office
earlier this year and the battle for cyber dominance between
China and the US was looming large in Tokyo, one
of the most prestigious global hacking competitions was underway. They're
on the clock and actually attempting to exploit above him

(00:38):
called pone to Own, The competition has attracted some of
the world's best hackers, or, as the industry likes to
call them, researchers. A hacking competition looks exactly like what
you see in the movies, a group of people crowded
around a computer, all staring intently at the screen as
a main hacker types commands furiously on a keyboard. The

(00:58):
aim of these hacking tournaments is to find weaknesses or
holes in software in real world devices so that companies
can fix them before they're exploited by criminals. For example,
researchers would be looking for flaws and bugs, say in
Google Chrome or the Apple Watch. Teams that find the
vulnerabilities successfully win a cash prize and share with the

(01:19):
tech companies of how they hacked into the systems at
the poone to Own tournament in January. The competition was
sponsored by Tesla and teams had to discover weaknesses in
its wall charger, I.

Speaker 1 (01:35):
Think there's a success.

Speaker 3 (01:41):
The best hacking team is crown the Master of pone.
It's a title that the competition organizers began bestowing on
the best hackers in twenty sixteen. That first year, a
China affiliated team won. In twenty seventeen, Chinese hackers were
Master of pone again, but the year after that, twenty
eight there were no Chinese hackers at poone to Own.

(02:03):
In fact, since then, there have been barely any hackers
from mainland China at any international hackathon anywhere in the world.

Speaker 4 (02:11):
In twenty eighteen, Chinese researchers no longer traveled to compete
in international hacking competitions. Anyone who wanted to do so
had to get special permission from the Chinese government.

Speaker 3 (02:26):
That's Bloomberg reporter Jimmy Terrabe, who covers national security in Washington, DC.
Because they did not want.

Speaker 1 (02:34):
These folks to go overseas and compete, they created domestic
hacking competitions to ensure that those vulnerabilities continue to.

Speaker 4 (02:43):
Be discovered but remained within China.

Speaker 3 (02:48):
The travel and competition restrictions placed on Chinese hackers were
all about building what Jimmy calls a cyber army.

Speaker 1 (02:56):
China really began in earnest to invest in the cyber
sort of population in its country. It invested in the tech,
it invested in the talent, and it became a very
conservative focus for the regime because in the wars to come,

(03:18):
the cyber army in China is going to be a
very significant part of its arsenal.

Speaker 3 (03:25):
It's a formidable arsenal that China could deploy as tensions
between Washington and Beijing continue to ratchet up on everything
from trade to rearffs to national security.

Speaker 1 (03:37):
It could be something that the Chinese government would leverage.

Speaker 5 (03:41):
Everyone knows that.

Speaker 1 (03:42):
They have its capability to play with the water supply
in America? Would they do that now because of the tariffs?

Speaker 3 (03:56):
This is the Big Take Asia from Bloomberg News. I'm Wanha.
Every week we take you inside some of the world's
biggest and most powerful economies and the markets, tycoons and
businesses that drive this ever shifting region. Today on the show,
China's hacker army, How are Chinese hacking competitions powering its
growing network of cyber soldiers, and what's at stake for

(04:20):
the US and the rest of the world if their
knowledge stays inside China. It took Chinese hackers a while
to get involved in international hacking competitions like pone to Own,
but once they did, Chinese teams from universities and tech
companies quickly became a force to be reckoned, with the

(04:41):
Chinese committed in.

Speaker 5 (04:43):
A way that other teams did not.

Speaker 1 (04:46):
When a Western team would come and enter pone to
Own one of these hacking competitions, their teams were maybe
three to five, five to seven at best. The Chinese
was sending twenty to thirty people on each team, and
they were having people spend an entire year, like months

(05:06):
and months and months researching all the different.

Speaker 4 (05:10):
Contests, all the different challenges. It became a real contest.

Speaker 5 (05:14):
Of we're going to show everyone how good.

Speaker 1 (05:16):
We are, and that's exactly what they did.

Speaker 3 (05:20):
For a short time, teams from China dominated, but their
achievements abroad soon drew the attention of critical eyes back home.
In twenty seventeen, the founder of Chinese cybersecurity firm Chihu
three sixty Joe hong Yi publicly criticized Chinese participation in
international hackathons.

Speaker 1 (05:39):
The billionaire founder came out and said, I don't think
that our people should be going and competing in these
international contests and everyone getting to see the vulnerabilities that
they discover. We should not be sharing these treasures with
the rest of the world. These should be staying in

(06:00):
China for us to use and for only us to
have that knowledge.

Speaker 3 (06:06):
From twenty eighteen on, Chinese teams were effectively forbidden from
participating in any international hackathons. That same year, China launched
its own hacking tournament called the Tanfood Cup. The prizes
totaled a million dollars, almost double the prize money awarded
in Pune to Own that year. During the Tanfood Cup, participants,

(06:28):
mostly Chinese teams, packed into Apple operating systems, Google phones,
and Microsoft networks. What was different about the Tanfood Cup
was what participants did after those exploits were discovered. Usually
in international hackathons, the bugs are disclosed to the companies
that make the software or devices so that they can
patch them before criminal hackers exploit them. But in China,

(06:50):
contestants are required to report the vulnerabilities to the government first.

Speaker 1 (06:57):
The Weston Slash International contests are a place where a
lot of people from many different countries, they're competing, they're
sharing their learning and reporting their findings in a much
more open way, and you contrast that with what's happening
in China. A lot of the times, we don't know

(07:19):
what vulnerabilities they're investigating, we don't know what the results are,
we don't know if the vendor has been notified.

Speaker 3 (07:27):
And in twenty twenty one, the Chinese government went a
step further. A vulnerability disclosure regulation that came into effect
required anyone, whether you're researcher at a tech company or
if you discover a flaw during a competition, to report
the findings to the government within forty eight hours. Anyone
who doesn't comply could be punished and fined. Outside of China,

(07:51):
governments don't force hackers or companies to disclose vulnerabilities, but
they also don't publicly share any software flaws that their
intelligence agencies have discovered either. It's a practice called vulnerability hoarding,
and experts say organizations like the US National Security Agency
don't reveal their vulnerabilities because it uses them to spy

(08:15):
on other countries and attack their systems. For the longest time,
cybersecurity experts weren't really sure how the Chinese government was
using intel about security flaws until an alleged data leak
in February last year.

Speaker 2 (08:31):
Chinese police are investigating hundreds of files leaked online last week.
They purport to show Beijing's government agencies carrying out large
scale cyber attacks against foreign governments, companies, and more.

Speaker 3 (08:43):
The hundreds of hundreds of internal files from the Shanghai
based cybersecurity company i Soon, which works with Chinese government clients,
were posted on an online platform called GitHub. Chat Logs
and presentations, which industry experts believe to be authentic, appear
to reveal successful attacks in twenty twenty one and twenty
twenty two. There was a range of targets from the

(09:06):
UK Foreign Office to the Royal Thai Army and even
NATO Secretary General Jens Stoltenberg. What was also revealing in
these files was a link between the Chinese hacking competitions
and these state sponsored cyber attacks.

Speaker 5 (09:22):
We saw chats about vulnerability sharing.

Speaker 1 (09:25):
The people who were on these chats talking about infiltrating
a mail server, trying to get into a system with
a vulnerability. We saw people saying, hey, when am I
going to get that vulnerability from Tianfu kop and the
response was, well, it's gone to the Ministry of Public
Security or we've seen the.

Speaker 5 (09:45):
Ministry of Public Security has an exploit. It's not fully.

Speaker 1 (09:48):
Formed, but see how you go try it out.

Speaker 5 (09:51):
So it really kind of revealed a through line.

Speaker 3 (09:55):
In March, several employees of i Soon were charged by
US authorities for carrying out cyber attacks at the behest
of Chinese intelligence agencies. China denies the allegations. I Soon
hasn't responded to the charges and didn't respond to requests
for comment. With tensions rising between the two superpowers, what

(10:18):
are the risks that China's growing hacker army poses to
the US and the rest of the world, and can
governments do anything about it? That's after the break. Identifying
vulnerabilities in your phone or laptop isn't just important for

(10:41):
improving user experience and keeping your data safe. Bloomberg's Jamie
Terrabe says they are an important tool for governments to
use on the world stage, especially as tensions grow between
the US and China, and as China seeks to wield
more power and influence abroad.

Speaker 1 (10:58):
It's a really important weapon for any government to have.
You have the power to go into a device and
no one else knows about it, maybe for months, so
you can sit on it and use it at your will.
Who do you want to target? Do you want to
target your domestic population? Do you want to target dissidents?

(11:19):
The Chinese have recognized that it is a very useful tool,
and they're spending a lot of money. They're investing a
lot of time and talent, and they're growing their technology
at a pace that the rest of the world is
struggling too much.

Speaker 3 (11:36):
And it's not just about stealing data in corporate espionage.
Hacking campaigns can target operational technology that controls critical infrastructure,
think power grids and water supply systems. One hacking campaign
the US is especially concerned about is called vult Typhoon.
US intelligence agencies accused Chinese state hackers of compromising critical

(11:59):
infrastructure on where the US has a military base.

Speaker 1 (12:03):
The volt Typhoon campaign is basically the discovery of Chinese
state sponsored actors hiding in critical infrastructure just lurking and
waiting for the right moment to flick a switch, to disrupt,

(12:24):
to cause chaos or confusion, or to delay responses to
possible military action that China might decide to embark on.
So that's what.

Speaker 5 (12:37):
The cyber army looks like to the Chinese leadership. It
is a tool to be used in the event of
military action.

Speaker 4 (12:48):
It is also a tool to be used.

Speaker 1 (12:49):
In intelligence gathering, as they did when they hacked the
emails of many of the State Department officials, as well
as the most recent campaign where they hacked into the
funds of the Trump campaign.

Speaker 3 (13:06):
China has repeatedly denied any accusations of malicious hacking, and
have also long accused the US and other countries of
cyber espionage.

Speaker 1 (13:16):
This is all about.

Speaker 5 (13:17):
Who's the better spy.

Speaker 1 (13:18):
There's always been this idea that we're going to spy
on you, you're going to spy on us. But we
don't know what the US is doing. We don't know
what the French are doing, we don't know what the
Australians are doing, we don't know what the British are doing.

Speaker 5 (13:30):
But that's the game.

Speaker 3 (13:32):
And as we hear more about these cyber attacks. Is
there anything the US or other governments can do.

Speaker 5 (13:37):
At this point, with the latest administration, we're starting to
hear a lot more strident voices about hacking back on
the Hill.

Speaker 1 (13:48):
The head of the House Homeline Security Committee, doctor Mark Green,
wants to hack back, wants to get private companies to
carry out hacking offensive cyber campaigns. The thing is, we
don't know if they're not already doing that.

Speaker 4 (14:01):
You know, we don't know what the NSA is doing.

Speaker 1 (14:03):
For the longest time, it was called no such agency
because they never wanted to admit that they even existed,
let alone tell everyone what they were doing.

Speaker 3 (14:11):
And Jamie says, part of the reason why these calls
for offensive cyber campaigns are rising is because of the
difficulties in holding people accountable for these cyber attacks.

Speaker 1 (14:22):
This is the same thing that happens with Russian criminal hackers.
They all get indicted and they remain where they are.
They stay in Russia or China, or they travel to
countries where they won't get extradited and they face no consequences.

Speaker 4 (14:37):
One of the things with the ICEN leaks was these
people aren't really paid a.

Speaker 1 (14:40):
Lot, and they're sort of at the bottom of the ladder,
so they're doing someone else's bidding. So even if they
were targeted, it doesn't change the apparatus. It doesn't change
the fact that this is a policy in the government
or within this agency to carry out this kind of behavior.

Speaker 3 (15:01):
So what I'm hearing then is you're saying China is
basically going to continue to keep doing what it's doing
and there's no one that can stop them.

Speaker 1 (15:10):
There are sanctions. We see export controls coming in, we
see sanctions against individuals, we see.

Speaker 4 (15:17):
Sanctions against goods.

Speaker 1 (15:19):
Right we start to see Chinese products or companies getting
banned from the US. We see people in the US
being banned from trading or investing in Chinese companies. But
short of being able to bring some of these people in,
it doesn't really happen because attribution is always so hard.

(15:41):
You know, you can say I have all of the
elements that match this Chinese actor, but you're never going
to know definitively. We live in a world now where
AI is rapidly advancing. A lot of these cyber attacks
can be automated in the future. The more we rely
on tech, the more exposure we have, the more opportunities

(16:03):
for all kinds of hackers to infiltrade, encrypt sabotage, hold you, transom,
disrupt to all the things. So there are going to
be more opportunities, not less.

Speaker 3 (16:22):
This is The Big Take Asia from Bloomberg News. I'm wanha.
To get more from The Big Take and unlimited access
to all of Bloomberg dot Com, subscribe today at Bloomberg
dot com slash podcast Offer. If you like this episode,
make sure to subscribe and review The Big Take Asia
wherever you listen to podcasts. It really helps people find
the show. Thanks for listening, See you next time.
Advertise With Us

Popular Podcasts

Bookmarked by Reese's Book Club

Bookmarked by Reese's Book Club

Welcome to Bookmarked by Reese’s Book Club — the podcast where great stories, bold women, and irresistible conversations collide! Hosted by award-winning journalist Danielle Robay, each week new episodes balance thoughtful literary insight with the fervor of buzzy book trends, pop culture and more. Bookmarked brings together celebrities, tastemakers, influencers and authors from Reese's Book Club and beyond to share stories that transcend the page. Pull up a chair. You’re not just listening — you’re part of the conversation.

Dateline NBC

Dateline NBC

Current and classic episodes, featuring compelling true-crime mysteries, powerful documentaries and in-depth investigations. Follow now to get the latest episodes of Dateline NBC completely free, or subscribe to Dateline Premium for ad-free listening and exclusive bonus content: DatelinePremium.com

On Purpose with Jay Shetty

On Purpose with Jay Shetty

I’m Jay Shetty host of On Purpose the worlds #1 Mental Health podcast and I’m so grateful you found us. I started this podcast 5 years ago to invite you into conversations and workshops that are designed to help make you happier, healthier and more healed. I believe that when you (yes you) feel seen, heard and understood you’re able to deal with relationship struggles, work challenges and life’s ups and downs with more ease and grace. I interview experts, celebrities, thought leaders and athletes so that we can grow our mindset, build better habits and uncover a side of them we’ve never seen before. New episodes every Monday and Friday. Your support means the world to me and I don’t take it for granted — click the follow button and leave a review to help us spread the love with On Purpose. I can’t wait for you to listen to your first or 500th episode!

Music, radio and podcasts, all free. Listen online or download the iHeart App.

Connect

© 2025 iHeartMedia, Inc.