Skip Navigation

Close and don't show again.

Your browser is out of date.

You may not get the full experience here on National Journal.

Please upgrade your browser to any of the following supported browsers:

It's Not Just You: Chinese Hackers Are Terrible at Making Passwords, Too It's Not Just You: Chinese Hackers Are Terrible at Making Passwords, T...

This ad will end in seconds
Close X

Not a member? Learn More »

Forget Your Password?

Don't have an account? Register »

Reveal Navigation



It's Not Just You: Chinese Hackers Are Terrible at Making Passwords, Too

The building housing “Unit 61398” of the People’s Liberation Army, in the outskirts of Shanghai. (AP)()

photo of Brian Fung
February 19, 2013

When The New York Times and other news outlets reported being the victims of a massive, years-long cyberattack, it set off a rash of concerns about online security and personal Internet hygiene, reinforcing plenty of old, enduring lessons: Choose strong passwords; don’t click on links from strangers (or strange links from people you know); consider using different usernames for different online services.

Many Americans still don’t follow these security suggestions that can help protect them from online snooping and identity theft. But, evidently, neither do some Chinese hackers. In a bit of poetic justice, the identities of two of The Times’ hackers have become public, all because they got sloppy.

According to a report by Mandiant, the company The Times hired to investigate its security breach, one hacker who went by the handle "UglyGorilla" went around the Chinese Internet asking plainly whether China had a cyberarmy. In a lapse of personal security, UglyGorilla signed his name on the malware he wrote, on the domains he registered, and on Web forums.


“UG’s consistent use of the username 'UglyGorilla' across various Web accounts has left a thin but strong thread of attribution through many online communities,” the report read.

Investigators learned to identify hackers when the spies logged onto Facebook and Twitter, which are blocked to the rest of China by what has collaquially become known as the Great Firewall of China:

    Like many Chinese hackers, APT1 attackers do not like to be constrained by the strict rules put in place by the Communist Party of China (CPC), which deployed the GFWoC as a censorship measure to restrict access to web sites such as,, and Additionally, the nature of the hackers’ work requires them to have control of network infrastructure outside the GFWoC. This creates a situation where the easiest way for them to log into Facebook and Twitter is directly from their attack infrastructure. Once noticed, this is an effective way to discover their real identities.

Another hacker identified by Mandiant went by the name of "DOTA." DOTA also had a tendency to spread his name around, creating Hotmail and Gmail accounts using variations of the same handle. Investigators were able to pinpoint the hacker’s location when, as part of a security check, Google sent DOTA a text message. The message contained a code that DOTA had to plug in on his browser to access his Google services -- a standard identity-protection feature called two-factor authentication. (By the way, if you don’t have two-factor authentication enabled, please do it now.)

DOTA’s big mistake was in telling Google to send the text message to a convenient phone number -- one that told Mandiant both what carrier the hacker was on (China Mobile) and where he was (Shanghai).

“The speed of DOTA’s response also indicates that he had the phone with him at the time,” said the report.

DOTA is also apparently a huge J.K. Rowling fan. In response to security questions like “Who is your favorite teacher?” DOTA’s answer would frequently come up as “Harry” and “Poter” (yes, with one T). Despite his skills at penetrating other people’s systems, DOTA was, it turns out, no wizard at personal or operational security.

It’s no small irony the everyday shortcuts users take and which subsequently open them up to hackers like DOTA and UglyGorilla, are the same traps that the two hackers fell into. Still, there’s another possibility: What if they wanted to be found?

While some countries go to great lengths to hide their attacks, China takes no such precautions, said Yael Shahar, an Israeli cybersecurity expert at the International Institute for Counter-Terrorism.

“They're very careful not to cover their tracks very well,” she told me, adding that it enhanced Chinese self-perceptions of “face” to leave a calling card. “It's a projection of power; it's not that they're trying to hide it.”

LIKE THIS STORY? Sign up for Tech Edge

Sign up for our daily newsletter and stay on top of tech coverage.

Sign up form for Tech Edge
Job Board
Search Jobs
Biomedical Service Internship Position
American Society of Civil Engineers | Flint, MI
Fire Sprinkler Inspector
American Society of Civil Engineers | Charlotte, NC
Professional Development Program Engineer
American Society of Civil Engineers | Farmington Hills, MI
Deputy Director of Transit Operations
American Society of Civil Engineers | San Jose, CA
Transportation Planner
American Society of Civil Engineers | Salinas, CA
Assistant Professor - Water Resources/Ecological Engineering
American Society of Civil Engineers | Auburn, AL
Product Manager - Chemical Development and Supply - Tulsa, OK
American Society of Civil Engineers | Tulsa, OK
Commissioning Intern
American Society of Civil Engineers | Chicago, IL
Assessment and Remediation Team Lead
American Society of Civil Engineers | Regina, SK
Business Development Manager
American Society of Civil Engineers
Sr. Controls Systems Engineer
American Society of Civil Engineers | Grand Island, NE
Senior Project Manager- Transportation
American Society of Civil Engineers | San Antonio, TX
Materials Engineer 2
American Society of Civil Engineers | IL
Land Surveyor
American Society of Civil Engineers
Quality Engineer
American Society of Civil Engineers | Attica, IN
comments powered by Disqus