Topic: Web security a "pressing" challenge in China, say experts

[Samker]

By Xinhua writers Zhou Zhou and Yuan Ye Chen Guangyu is annoyed these days by persistent pop-ups when using MSN Messenger which invite her to click on unfamiliar ads' Web links. They're stubbornly resistent to protective software.

"All my friends deny sending the pop-ups," Chen said. "My ID must be being illegally exploited by spy software." She is just one of numerous Internet users to have fallen prey to rampant online viruses, trojan horses and spy software that have prompted growing worries about web security in China, whose netizen population, 338 million, is the world's largest.

Li Xiaodong, deputy director of the China Internet Network Information Center (CNNIC), a government-affiliated web research organization, said Saturday China's Web security was in dire need of improved technology and better legal structure to protect net users.

"Hackers' activities are now running wild because they have easy access to free online attack tools," he said.

"Also, a majority of crackers are not aware of the dangers of their pranks." Hackers, usually computer-savvy geeks who compromise other users' computer security systems to gain unauthorized access, are aware of protective technological benchmarks now becoming much more quickly outdated.

"They can easily obtain free attack tools on hacker websites, and launch assaults like guerrillas. But to defend against them demands comprehensive and powerful security systems," Li said.

Web security in China is far from "developed", said Li. "It's a costly enterprise. We have to try every possibility to close a loophole accidentally found by attackers." Worse, by plugging trojans into other computers, hackers could easily obtain users' ID, bank numbers and other personal information.

Two 27-year-old men, surnamed Piao and Jin, were arrested on June 16 and June 27 respectively in Yanbian county in Jilin Province on the charge of collaboratively stealing 2.36 million yuan (345,269 U.S. dollars) by breaking into online banking systems, a county police spokesman said Friday.

But activities not causing direct financial damage such as Chen Guangyu experienced are not presently covered by law.

"This is a grey area in cyberspace where rules are lacking," Li said.

At least two online training companies which allegedly taught Web attack-and-defence knowhow were recently exposed by the Chinese media, arousing new worries over possible abuse.

Nang Feng Chuang, a Guangzhou-based news biweekly, recently reported that the Beijing-based online school Hackbase had recruited more than a million members in the past three years.

The majority are young technical engineers, Web administrators and college graduates. Many are keen to learn skills such as stealing online gaming accounts, sneaking into others' mail accounts, or even attacking Web servers, Nang Feng Chuang said.

Some young hackers dream of making big and quick money by blackmailing online gaming companies, a booming business in China, the magazine said. While big online gaming companies have enough money to upgrade defensive systems, small and medium-sized companies often end up reaching compromises with hackers through paying them "advertising fees." But Wang Xianbing, a security consultant with Hackbase, rubbished the allegations that their school was a "training base for hackers." "We learn and teach skills merely to improve defensive capabilities," Wang was quoted as saing. "We don't break the law." Hackbase has even obtained 10 million yuan of venture capital and hoped to build itself into an authorized agency for training web security engineers, Wang said.

But this does not allay Li Xiaodong's worries.

"Like kongfu, these skills can be exercised legally to be sure.

But they can play havoc as well," said Li. But he said he doubted most trainees would eventually opt for illegal ways to gain financially.

Guan Zhenyu, a computer engineer with Fujitsu China, shares similar worries.

"Some young geeks are showing off their skills," said Guan. "They know no limits. They don't realize they are on the verge of breaking the law when they use such skills for spying out personal information." "To bring activities in cyberspace under control, we must draw a clear line between what is permitted and what is not, and also make the hackers fully aware of the law," Li said.

The seventh amendment to China's Criminal Law enacted in Februry extended the scope of computer safety protection from state computers to those for personal use. But relevant civil laws to safeguard personal cyberspace are still wanting.

Liu Deliang, a law professor at the Beijing University of Posts and Telecommunications, said in his blog that private virtual space should be protected just as real private property.

Since China's online population hit 338 million at the end of June, according to a CINNIC survey in July, "Web safety protection is not only pressing but also arduous," Li Xiaodong said.

(TMCnet)