recommended reading

It's Not Just You: Chinese Hackers Are Terrible at Making Passwords, Too

Karen Roach/

When The New York Times and other news outlets reported being the victims of a massive, years-long cyberattack, it set off a rash of concerns about online security and personal Internet hygiene, reinforcing plenty of old, enduring lessons: Choose strong passwords; don’t click on links from strangers (or strange links from people you know); consider using different usernames for different online services.

Many Americans still don’t follow these security suggestions that can help protect them from online snooping and identity theft. But, evidently, neither do some Chinese hackers. In a bit of poetic justice, the identities of two of The Times’ hackers have become public, all because they got sloppy.

According to a report by Mandiant, the company The Times hired to investigate its security breach, one hacker who went by the handle "UglyGorilla" went around the Chinese Internet asking plainly whether China had a cyberarmy. In a lapse of personal security, UglyGorilla signed his name on the malware he wrote, on the domains he registered, and on Web forums.

“UG’s consistent use of the username 'UglyGorilla' across various Web accounts has left a thin but strong thread of attribution through many online communities,” the report read.

Investigators learned to identify hackers when the spies logged onto Facebook and Twitter, which are blocked to the rest of China by what has collaquially become known as the Great Firewall of China:

Like many Chinese hackers, APT1 attackers do not like to be constrained by the strict rules put in place by the Communist Party of China (CPC), which deployed the GFWoC as a censorship measure to restrict access to web sites such as,, and Additionally, the nature of the hackers’ work requires them to have control of network infrastructure outside the GFWoC. This creates a situation where the easiest way for them to log into Facebook and Twitter is directly from their attack infrastructure. Once noticed, this is an effective way to discover their real identities.

Another hacker identified by Mandiant went by the name of "DOTA." DOTA also had a tendency to spread his name around, creating Hotmail and Gmail accounts using variations of the same handle. Investigators were able to pinpoint the hacker’s location when, as part of a security check, Google sent DOTA a text message. The message contained a code that DOTA had to plug in on his browser to access his Google services -- a standard identity-protection feature called two-factor authentication. (By the way, if you don’t have two-factor authentication enabled, please do it now.)

DOTA’s big mistake was in telling Google to send the text message to a convenient phone number -- one that told Mandiant both what carrier the hacker was on (China Mobile) and where he was (Shanghai).

“The speed of DOTA’s response also indicates that he had the phone with him at the time,” said the report.

DOTA is also apparently a huge J.K. Rowling fan. In response to security questions like “Who is your favorite teacher?” DOTA’s answer would frequently come up as “Harry” and “Poter” (yes, with one T). Despite his skills at penetrating other people’s systems, DOTA was, it turns out, no wizard at personal or operational security.

It’s no small irony the everyday shortcuts users take and which subsequently open them up to hackers like DOTA and UglyGorilla, are the same traps that the two hackers fell into. Still, there’s another possibility: What if they wanted to be found?

While some countries go to great lengths to hide their attacks, China takes no such precautions, said Yael Shahar, an Israeli cybersecurity expert at the International Institute for Counter-Terrorism.

“They're very careful not to cover their tracks very well,” she told me, adding that it enhanced Chinese self-perceptions of “face” to leave a calling card. “It's a projection of power; it's not that they're trying to hide it.”

(Image via Karen Roach/

Threatwatch Alert

Credential-stealing malware / User accounts compromised / Software vulnerability

Android Malware Infects More than 1M Phones, Adds 13,000 Devices a Day

See threatwatch report


Close [ x ] More from Nextgov

Thank you for subscribing to newsletters from
We think these reports might interest you:

  • Featured Content from RSA Conference: Dissed by NIST

    Learn more about the latest draft of the U.S. National Institute of Standards and Technology guidance document on authentication and lifecycle management.

  • PIV- I And Multifactor Authentication: The Best Defense for Federal Government Contractors

    This white paper explores NIST SP 800-171 and why compliance is critical to federal government contractors, especially those that work with the Department of Defense, as well as how leveraging PIV-I credentialing with multifactor authentication can be used as a defense against cyberattacks

  • Toward A More Innovative Government

    This research study aims to understand how state and local leaders regard their agency’s innovation efforts and what they are doing to overcome the challenges they face in successfully implementing these efforts.

  • From Volume to Value: UK’s NHS Digital Provides U.S. Healthcare Agencies A Roadmap For Value-Based Payment Models

    The U.S. healthcare industry is rapidly moving away from traditional fee-for-service models and towards value-based purchasing that reimburses physicians for quality of care in place of frequency of care.

  • GBC Flash Poll: Is Your Agency Safe?

    Federal leaders weigh in on the state of information security

  • Data-Centric Security vs. Database-Level Security

    Database-level encryption had its origins in the 1990s and early 2000s in response to very basic risks which largely revolved around the theft of servers, backup tapes and other physical-layer assets. As noted in Verizon’s 2014, Data Breach Investigations Report (DBIR)1, threats today are far more advanced and dangerous.


When you download a report, your information may be shared with the underwriters of that document.