News

Evidence from Google Attacks Points to China

The fallout from the recent cyberattacks against Google and other companies, which occurred in December and were revealed by Google last week, continues to spread.

A security researcher for SecureWorks says he has found evidence to support Google's claim that last month's attacks on the company's systems originated in China, while another security expert called them the largest and most sophisticated attacks specifically aimed at businesses in years.

The attacks, which used the Hydraq Trojan to open a back door into infected systems, affected Google and 33 other companies. In addition to concerns over possible stolen information, the event has raised discussions about free speech and censorship in China.

Joe Stewart, SecureWorks' director of malware research, said he analyzed the software used in the attacks and found that it contained an algorithm from a Chinese technical paper that has been published only on Chinese-language Web sites, according to a report in The New York Times.

Google officials, in announcing the attack in a Jan. 12 blog post, have said they suspected that the attack originated in China, saying that the Gmail accounts of human rights activists in China had been monitored or hacked. The Gmail accounts of foreign journalists also have reportedly been hacked. The company is threatening to pull its operations out of the country. 

Other companies reported to have been affected include Adobe, Microsoft, Juniper Networks, Northrop Grumman, Symantec, Yahoo and Dow Chemical.

The attacks in many cases exploited a zero-day flaw in Adobe Acrobat and Reader to infect systems with the Hydraq Trojan, which launched when a user clicked on a malicious .PDF attached to an e-mail. Adobe issued a patch for the vulnerability this week.

The security company McAfee also said the attacks had exploited a vulnerability in Internet Explorer. Microsoft reported that the vulnerability exists in IE 6, but has issued an out-of-cycle security patch for all versions of the browser.

The attacks are similar to a July 2009 attack that involved about 100 companies, according to VeriSign iDefense.

In a blog post, McAfee Chief Technology Officer George Kurtz, dubbing recent the attacks "Operation Aurora," called it "the largest and most sophisticated cyberattack we have seen in years targeted at specific corporations."

"While the malware was sophisticated, we see lots of attacks that use complex malware combined with zero-day exploits," Kurtz wrote. "What really makes this is a watershed moment in cybersecurity is the targeted and coordinated nature of the attack with the main goal appearing to be to steal core intellectual property."

Meanwhile, Google is investigating whether some of its employees in China might have helped the attackers. Reuters reported that some employees in China had been placed on leave or transferred.

About the Author

Kevin McCaney is the managing editor of Government Computer News.

Featured

  • Windows 10 Mobile To Fall Out of Support in December

    Microsoft will end support for the Windows 10 Mobile operating system on Dec. 10, 2019, according to an announcement.

  • Get More Out of Your Outlook Inbox with TakeNote

    Brien comes across a handy, but imperfect, feature in Outlook that lets you annotate specific e-mails. Its provenance is something of a mystery, though.

  • Microsoft Resumes Rerelease of Windows 10 Version 1809

    Microsoft on Wednesday once more resumed its general rollout of the Windows 10 version 1809 upgrade, also known as the "October 2018 Update."

  • Microsoft Ups Its Windows 10 App Compatibility Assurances

    Microsoft gave assurances this week that organizations adopting Windows 10 likely won't face application compatibility issues.

comments powered by Disqus
Most   Popular

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.