19

I'm not professionally involved in security, so hopefully you can pardon me if I misuse any terminology or demonstrate my naivete in some other way. This question came to me as I was reading this paper on the role of language in cyber-crime. Here are some relevant excerpts from the paper:

Figure 2 reflects the fact that, although English is the most used language, Arabic, Russian, [and] Chinese users have increased over 1000% in just over ten years. These three language groups are significant in that the vast majority of cyber-crime incidents have originated in Russia and China, whereas Arabic has been more in use for other purposes.

...

Well-known cyber-crime groups have established mini-communities and societies centered around language...All trusted groups use language cues to establish credibility; this is a well-established socio-linguistic principle which has been documented since the 1950's.

As a disclaimer, I'm a little skeptical of the paper. For instance, when it says that "the vast majority of cyber-crime incidents have originated in Russia and China", it seems that there are a number of factors at play here that constitute "cyber-crime incidents", e.g. rate of local infections, proportion of infected web pages, and distribution of malware, and each of these categories seems to produce different statistics. I'd also assume (without evidence, so please correct me if I'm wrong) that most of what a security practitioner would deal with is domestic rather than international, and even then, I'd assume that much of what someone does online to 'attack' others (e.g. designing malware) is somewhat independent of the 'natural' languages that they speak.

Then again, when it comes to something like cryptography and decryption, perhaps language might come into play? One example that comes to mind is how British and American cryptographers intercepted and decoded Japanese ciphers at Bletchley Park during WWII. It seems this was very high-priority work back then -- enough to incite the Inter-Services Special Intelligence School to start a 6-month crash course in Japanese that lasted until the war ended (where those who completed the course would then work on decoding Japanese naval messages) -- but I'm not sure if automatic translation capabilities and such would have rendered all of this obsolete in the modern age.

I suppose that I'm ultimately interested in whether or not it is ever worthwhile to learn other languages for the purposes of tackling problems that concern information or network security. Or is language learning generally a non-useful way for a practitioner to spend their time?

  • It's probably not a very useful way to spend time, unless you want to communicate with people using those languages. I mean if you're into reverse engineering, learning Russian or Chinese would be great. But it won't provide any benefit other than that sort of thing. – forest Apr 3 '18 at 5:07
  • 1
    Not sure I have enough coherent thoughts to write an answer, but one benefit you will get from learning languages and cultures will be the ability to identify poor/dishonest research. As an example, here's an article whose author claims with a great deal of pride that he succeeded in tracking the evil mastermind behind a nefarious Russian botnet. He then reveals that the villain's name is Vasily Ivonovich Petrov... completely unaware of the fact that the name is essentially the Russian version of John Doe. – undercat Apr 4 '18 at 5:39
29

Code is written in English-based languages, and coders from any country generally know enough English not to need their native language even in comments.

The most accurate way of identifying a writer's country of origin in such a scenario is based on counting the frequency of various types of mistakes they make in English. This calls for scientific knowledge, not basic communication skills. A level of language not passable for native also won't help you much in infiltrating any group.

China and Russia are the go-to scapegoats for wrongdoings both in the cyber world and outside it, so it's likely that some attacks are misattributed to them by intent or by default. Throw a random hanzi or a cyrillic word from a dictionary in a comment and you've created a false lead to nowhere.

All in all, while learning foreign languages is certainly good for many reasons, it's hard to see how it would be more useful in IT security than elsewhere. If anything, this is one of the fields that put the most pressure on non-native speakers to learn English.

  • 23
    It happens... a lot. It's a standard method of misattribution employed by amateur hackers and APTs alike. Usually it's more subtle, like "accidentally" leaving debug information in malware with a Russian word, or "accidentally" including timestamps that are set to a Chinese timezone. – forest Apr 3 '18 at 5:58
  • 5
    "Throw a random hanzi or a cyrillic word from a dictionary in a comment and you've created a false lead to nowhere." - and that's exactly a reason where speaking (reading) Chinese and Russian would help. If, during forensic investigation, you recognize obviously ungrammatical or machine translated comments, you have a hint that you are following a false lead. Unfortunately, machine translation is getting better and better, and it's not difficult to copy&paste authentic phrases from Wikipedia or somewhere. – Radovan Garabík Apr 3 '18 at 7:12
  • 15
    Code is written in English-based languages, and most coders from any country write comments in English as well. I don't know if that's the case. I've seen plenty of examples on SO itself where somebody would ask for help but all variable and function names would be in French, for example. It seems to me that unless somebody is writing code with international audience in mind, they would just be using their first language. Even then, I have a friend who worked in a company that is based in both England and Japan and some of the Japanese code comments were in Japanese. – VLAZ Apr 3 '18 at 8:07
  • 7
    It certainly happens both ways. But English based code is common even among non-native speakers just because so much is based on copy-pasting and tweaking existing code, following existing patterns, etc. – Therac Apr 3 '18 at 8:55
  • 7
    Native English speakers misspell more and are almost the only ones prone to homophone errors ("would of"). Speakers of languages that don't use articles tend to forget or abuse them. Comma use differs little between languages and rarely gets corrected, so Europeans tend to stick to their first language rules. Double-checking doesn't help against this, it's which mistakes people make when they do that counts. False friends are a dead but rare giveaway. In their absence, checking what language the writer's preposition mistakes would make sense in helps narrow down the country. – Therac Apr 3 '18 at 17:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.