Operation Aurora

Operation Aurora was a cyber attack which began in mid-2009 and continued through December 2009.^[1] The attack was first publicly disclosed by Google on January 12, 2010, in a blog post.^[2] In the blog post, Google said the attack originated in China. The attacks were both sophisticated and well resourced and consistent with an advanced persistent threat attack.

The attack has been aimed at dozens of other organizations, of which Adobe Systems,^[3] Juniper Networks^[4] and Rackspace^[5] have publicly confirmed that they were targeted. According to media reports, Yahoo, Symantec, Northrop Grumman, Morgan Stanley^[6] and Dow Chemical^[7] were also among the targets.

As a result of the attack, Google stated in its blog that it plans to operate a completely uncensored version of its search engine in China "within the law, if at all", and acknowledged that if this is not possible it may leave China and close its Chinese offices.^[2] Official Chinese media responded stating that the incident is part of a U.S. government conspiracy.^[8]

The attack was named "Operation Aurora" by Dmitri Alperovitch, Vice President of Threat Research at cyber security company McAfee. Research by McAfee Labs discovered that “Aurora” was part of the file path on the attacker’s machine that was included in two of the malware binaries McAfee said were associated with the attack. "We believe the name was the internal name the attacker(s) gave to this operation," McAfee Chief Technology Officer George Kurtz said in a blog post.^[9]

According to McAfee, the primary goal of the attack was to gain access to and potentially modify source code repositories at these high tech, security and defense contractor companies. “[The SCMs] were wide open,” says Alperovitch. “No one ever thought about securing them, yet these were the crown jewels of most of these companies in many ways — much more valuable than any financial or personally identifiable data that they may have and spend so much time and effort protecting."^[10]

History

Flowers left outside Google China's headquarters after its announcement it might leave the country.

On January 12, 2010, Google revealed on its blog that it had been the victim of a cyber attack. The company said the attack occurred in mid-December and originated from China. Google stated that over 20 other companies had been attacked; other sources have since cited that more than 34 organizations were targeted.^[7] As a result of the attack, Google said it was reviewing its business in China.^[2] On the same day, United States Secretary of State Hillary Clinton issued a brief statement condemning the attacks and requesting a response from China.^[11]

On January 13, 2010, the news agency All Headline News reported that the United States Congress plans to investigate Google's allegations that the Chinese government used the company's service to spy on human rights activists.^[12]

In Beijing, visitors left flowers outside of Google's office. However, these were later removed, with a Chinese security guard stating that this was an "illegal flower tribute".^[13] The Chinese government has yet to issue a formal response, although an anonymous official stated that China is seeking more information on Google's intentions.^[14]

Attack analysis

In its blog posting, Google stated that some of its intellectual property had been stolen. It suggested that the attackers were interested in accessing Gmail accounts of Chinese dissidents. According to the Financial Times, two accounts used by Ai Weiwei had been hacked, their contents read and copied; his bank accounts were investigated by state security agents who claimed he was under investigation for "unspecified suspected crimes".^[15] However, the attackers were only able to view details on two accounts and those details were limited to things such as the subject line and the accounts' creation date.^[2]

Security experts immediately noted the sophistication of the attack.^[9] Two days after the attack became public, McAfee reported that the attackers had exploited purported zero-day vulnerabilities (unfixed and previously unknown to the target system developers) in Internet Explorer and dubbed the attack "Operation Aurora". A week after the report by McAfee, Microsoft issued a fix for the issue,^[16] and admitted that they had known about the security hole used since September.^[17] Additional vulnerabilities were found in Perforce, the source code revision software used by Google to manage their source code.^[18][19]

VeriSign's iDefense Labs claimed that the attacks were perpetrated by "agents of the Chinese state or proxies thereof".^[20]

According to a diplomatic cable from the U.S. Embassy in Beijing, a Chinese source reported that the Chinese Politburo directed the intrusion into Google's computer systems. The cable suggested that the hacking was part of a coordinated campaign executed by "government operatives, public security experts and Internet outlaws recruited by the Chinese government."^[21] The report suggested that it was part of an ongoing campaign in which hackers have "broken into American government computers and those of Western allies, the Dalai Lama and American businesses since 2002."^[22] According to The Guardian's reporting on the leak, the attacks were "orchestrated by a senior member of the Politburo who typed his own name into the global version of the search engine and found articles criticising him personally."^[23]

Once a victim's system was compromised, a backdoor connection that masqueraded as an SSL connection made connections to command and control servers running in Illinois, Texas, and Taiwan, including machines that were running under stolen Rackspace customer accounts. The victim's machine then began exploring the protected corporate intranet that it was a part of, searching for other vulnerable systems as well as sources of intellectual property, specifically the contents of source code repositories.

The attacks were thought to have definitively ended on Jan 4 when the command and control servers were taken down, although it is not known at this point whether or not the attackers intentionally shut them down.^[24] However, the attacks were still occurring as of February 2010.^[1]

Response and aftermath

The German, Australian, and French governments publicly issued warnings to users of Internet Explorer after the attack, advising them to use alternative browsers at least until a fix for the security hole was made.^[25][26][27] The German, Australian, and French governments consider all versions of Internet Explorer vulnerable or potentially vulnerable.^[28][29]

In an advisory on January 14, 2010, Microsoft said that attackers targeting Google and other U.S. companies used software that exploits a hole in Internet Explorer. The vulnerability affects Internet Explorer versions 6, 7, and 8 on Windows 7, Vista, Windows XP, Server 2003, Server 2008 R2, as well as IE 6 Service Pack 1 on Windows 2000 Service Pack 4.^[30]

The Internet Explorer exploit code used in the attack has been released into the public domain, and has been incorporated into the Metasploit Framework penetration testing tool. A copy of the exploit was uploaded to Wepawet, a service for detecting and analyzing web-based malware operated by the computer security group at the University of California, Santa Barbara. "The public release of the exploit code increases the possibility of widespread attacks using the Internet Explorer vulnerability," said George Kurtz, CTO of McAfee, of the attack. "The now public computer code may help cyber criminals craft attacks that use the vulnerability to compromise Windows systems."^[31]

Security company Websense said it identified "limited public use" of the unpatched IE vulnerability in drive-by attacks against users who strayed onto malicious Web sites.^[32] According to Websense, the attack code it spotted is the same as the exploit that went public last week. "Internet Explorer users currently face a real and present danger due to the public disclosure of the vulnerability and release of attack code, increasing the possibility of widespread attacks," said George Kurtz, chief technology officer of McAfee, in a blog update. ^[33] Confirming this speculation, Websense Security Labs identified additional sites using the exploit on January 19.^[34] According to reports from Ahnlab, the second URL was spread through the Instant Messenger network Misslee Messenger, a popular IM client in South Korea.^[34]

Researchers have created attack code that exploits the vulnerability in Internet Explorer 7 (IE7) as well as in the newest IE8—even when Microsoft's recommended defensive measure (Data Execution Prevention (DEP)) is turned on. This piece of information proves that IE6 isn't the only version that is vulnerable and that upgrading to IE7 or IE8 could prove to be futile especially if one is running XP or only upgrading to IE7. According to Dino Dai Zovi, a security vulnerability researcher, "even the newest IE8 isn't safe from attack if it's running on Windows XP Service Pack 2 (SP2) or earlier, or on Windows Vista RTM (release to manufacturing), the version Microsoft shipped in January 2007."^[35]

Microsoft admitted that the security hole used had been known to them since September.^[17] Work on an update was prioritized^[36] and on Thursday, January 21, 2010, Microsoft released a security patch aiming to counter this weakness, the published exploits based on it and a number of other privately reported vulnerabilities.^[37] They did not state if any of the latter had been used or published by exploiters or whether these had any particular relation to the Aurora operation, but the entire cumulative update was termed critical for most versions of Windows, including Windows 7.

Security researchers have continued to investigate the attacks. HBGary, a security firm, recently released a report in which they claim to have found some significant markers that might help identify the code developer. The firm also said that the code was Chinese language based but could not be specifically tied to any government entity.^[38]

On February 19, 2010, a security expert investigating the cyber-attack on Google, has claimed that the people behind the attack were also responsible for the cyber-attacks made on several Fortune 100 companies in the past one and a half years. They have also tracked the attack back to its point of origin, which seems to be two Chinese schools, Shanghai Jiao Tong University and Lanxiang Vocational School.^[39] As highlighted by The New York Times, both of these schools have ties with the Chinese search engine Baidu, a rival of Google China.^[40]

In March 2010, Symantec, which was helping investigate the hacking for Google, identified Shaoxing as the source of 21.3% of all (12 billion) malicious emails sent throughout the world.^[41]

See also

• Google China
• Illegal flower tribute (simplified Chinese: 非法献花; traditional Chinese: 非法獻花; pinyin: fēi​fǎ​ xiàn​huā)
• Honker Union
• Cyber-warfare
• Titan Rain
• Chinese intelligence activity in other countries
• GhostNet
• Economic and Industrial Espionage
• Chinese Intelligence Operations in the United States
• Vulcanbot

References

1. ^ ^{a b} "'Aurora' Attacks Still Under Way, Investigators Closing In On Malware Creators". Dark Reading (TechWeb). 2010-02-10. http://www.darkreading.com/vulnerability_management/security/attacks/showArticle.jhtml?articleID=222700786. Retrieved 2010-02-13. 
2. ^ ^{a b c d} "A new approach to China". Google Inc.. 2010-01-12. http://googleblog.blogspot.com/2010/01/new-approach-to-china.html. Retrieved 17 January 2010. 
3. ^ "Adobe Investigates Corporate Network Security Issue". 2010-01-12. http://blogs.adobe.com/conversations/2010/01/adobe_investigates_corporate_n.html. Retrieved 17 January 2010. 
4. ^ "Juniper Networks investigating cyber-attacks". MarketWatch. 2010-01-15. http://www.marketwatch.com/story/juniper-networks-investigating-cyber-attacks-2010-01-15. Retrieved 17 January 2010. 
5. ^ "Rackspace Response to Cyber Attacks". http://www.rackspace.com/blog/?p=800. Retrieved 17 January 2010. 
6. ^ "HBGary email leak claims Morgan Stanley was hacked". http://www.theinquirer.net/inquirer/news/2029754/hbgary-email-leak-claims-morgan-stanley-hacked. Retrieved 2 Mar 2010. 
7. ^ ^{a b} Cha, Ariana Eunjung; Ellen Nakashima (2010-01-14). "Google China cyberattack part of vast espionage campaign, experts say". The Washington Post. http://www.washingtonpost.com/wp-dyn/content/article/2010/01/13/AR2010011300359.html. Retrieved 17 January 2010. 
8. ^ Hille, Kathrine (2010-01-20). "Chinese media hit at ‘White House’s Google’". Financial Times. http://www.ft.com/cms/s/e6022fe0-05c6-11df-88ee-00144feabdc0,Authorised=false.html. Retrieved 20 January 2010. 
9. ^ ^{a b} "Operation “Aurora” Hit Google, Others". McAfee, Inc.. 2010-01-14. http://siblog.mcafee.com/cto/operation-%E2%80%9Caurora%E2%80%9D-hit-google-others/. Retrieved 17 January 2010. 
10. ^ "‘Google’ Hackers Had Ability to Alter Source Code". Wired. 2010-03-03. http://www.wired.com/threatlevel/2010/03/source-code-hacks/. Retrieved 4 March 2010. 
11. ^ Clinton, Hillary (2010-01-12). "Statement on Google Operations in China". US Department of State. http://www.state.gov/secretary/rm/2010/01/135105.htm. Retrieved 17 January 2010. 
12. ^ "Congress to Investigate Google Charges Of Chinese Internet Spying". All Headline News. 13 January 2010. http://www.allheadlinenews.com/articles/7017511426?Congress%20to%20Investigate%20Google%20Charges%20Of%20Chinese%20Internet%20Spying. Retrieved 13 January 2010. 
13. ^ Robertson, Matthew (2010-01-14). "Flowers Laid, and Removed, at Google Headquarters in China". The Epoch Times. http://www.theepochtimes.com/n2/content/view/28043/. Retrieved 18 January 2010. 
14. ^ "Chinese govt seeks information on Google intentions". Xinhua (China Daily). 2010-01-13. http://www.chinadaily.com.cn/china/2010-01/13/content_9316162.htm. Retrieved 18 January 2010. 
15. ^ Anderlini, Jamil (January 15, 2010). "The Chinese dissident’s ‘unknown visitors’". Financial Times. http://www.ft.com/cms/s/0/c590cdd0-016a-11df-8c54-00144feabdc0.html. 
16. ^ "Microsoft Security Advisory (979352)". Microsoft. 2010-01-21. http://www.microsoft.com/technet/security/advisory/979352.mspx. Retrieved 26 January 2010. 
17. ^ ^{a b} Naraine, Ryan. Microsoft knew of IE zero-day flaw since last September, ZDNet, January 21, 2010. Retrieved 28 January 2010.
18. ^ Protecting Your Critical Assets, Lessons Learned from “Operation Aurora”, By McAfee Labs and McAfee Foundstone Professional Services
19. ^ 'Google' Hackers Had Ability to Alter Source Code
20. ^ Paul, Ryan (2010-01-14). "Researchers identify command servers behind Google attack". Ars Technica. http://arstechnica.com/security/news/2010/01/researchers-identify-command-servers-behind-google-attack.ars. Retrieved 17 January 2010. 
21. ^ Shane, Scott; Lehren, Andrew W. (28 November 2010). "Cables Obtained by WikiLeaks Shine Light Into Secret Diplomatic Channels". The New York Times. http://www.nytimes.com/2010/11/29/world/29cables.html?_r=1&hp. Retrieved 28 November 2010. 
22. ^ SCOTT SHANE and ANDREW W. LEHREN (November 28, 2010). "Leaked Cables Offer Raw Look at U.S. Diplomacy". The New York Times. http://www.nytimes.com/2010/11/29/world/29cables.html?_r=1. Retrieved 2010-12-26. "...The Google hacking was part of a coordinated campaign of computer sabotage carried out by government operatives, private security experts and Internet outlaws recruited by the Chinese government. They have broken into American government computers and those of Western allies, the Dalai Lama and American businesses since 2002, ..." 
23. ^ US embassy cables leak sparks global diplomatic crisis The Guardian 28 November 2010
24. ^ "Google Hack Attack Was Ultra Sophisticated, New Details Show". Wired. 2010-01-14. http://www.wired.com/threatlevel/2010/01/operation-aurora/. Retrieved 23 January 2010. 
25. ^ One News (19 January 2010). "France, Germany warn Internet Explorer users". TVNZ. http://tvnz.co.nz/technology-news/france-germany-warn-internet-explorer-users-3334330. Retrieved 22 January 2010. 
26. ^ Relax News (18 January 2010). "Why you should change your internet browser and how to choose the best one for you". London: The Independent. http://www.independent.co.uk/life-style/gadgets-and-tech/news/why-you-should-change-your-internet-browser-and-how-to-choose-the-best-one-for-you-1872048.html. Retrieved 22 January 2010. 
27. ^ http://www.abc.net.au/news/stories/2010/01/19/2795684.htm
28. ^ NZ Herald Staff (19 January 2010). "France, Germany warn against Internet Explorer". The New Zealand Herald. http://www.nzherald.co.nz/world/news/article.cfm?c_id=2&objectid=10620973. Retrieved 22 January 2010. 
29. ^ Govan, Fiona (18 January 2010). "Germany warns against using Microsoft Internet Explorer". London: The Daily Telegraph. http://www.telegraph.co.uk/technology/microsoft/7011626/Germany-warns-against-using-Microsoft-Internet-Explorer.html. Retrieved 22 January 2010. 
30. ^ Mills, Elinor (14 January 2010). "New IE hole exploited in attacks on U.S. firms". CNET. http://news.cnet.com/8301-27080_3-10435232-245.html. Retrieved 22 January 2010. 
31. ^ "Internet Explorer zero-day code goes public". Infosecurity. 18 January 2010. http://www.infosecurity-us.com/view/6537/internet-explorer-zeroday-code-goes-public/. Retrieved 22 January 2010. 
32. ^ http://securitylabs.websense.com/content/Blogs/3530.aspx?cmpid=pr
33. ^ http://www.computerworld.com/s/article/9145721/Hackers_wield_newest_IE_exploit_in_drive_by_attacks
34. ^ ^{a b} http://securitylabs.websense.com/content/Blogs/3534.aspx?cmpid=pr
35. ^ Keizer, Gregg (19 January 2010). "Researchers up ante, create exploits for IE7, IE8". Computerworld. http://www.computerworld.com/s/article/9145958/Researchers_up_ante_create_exploits_for_IE7_IE8?taxonomyId=17. Retrieved 22 January 2010. 
36. ^ http://blogs.zdnet.com/security/?p=5268
37. ^ http://www.microsoft.com/technet/security/bulletin/MS10-002.mspx
38. ^ "Hunting Down the Aurora Creator". TheNewNewInternet. 13 February 2010. http://www.thenewnewinternet.com/2010/02/12/hunting-down-the-aurora-creator/. Retrieved 13 February 2010. 
39. ^ Markoff, John; Barboza, David (18 February 2010). "2 China Schools Said to Be Tied to Online Attacks". New York Times. http://www.nytimes.com/2010/02/19/technology/19china.html. Retrieved 26 March 2010. 
40. ^ "Google Aurora Attack Originated From Chinese Schools". itproportal. 19 February 2010. http://www.itproportal.com/2010/02/19/google-aurora-attack-originated-chinese-schools/. Retrieved 19 February 2010. 
41. ^ Sheridan, Michael, "Chinese City Is World's Hacker Hub", London Sunday Times, March 28, 2010.

External links

• Forget Blaming Microsoft or Google – Blame Yourself AEON
• Google China insiders may have helped with attack news.cnet.com
• Operation Aurora – Beginning Of The Age of Ultra-Sophisticated Hack Attacks! Sporkings.com January 18, 2010
• In Google We Trust Why the company's standoff with China might change the future of the Internet. Rafal Rohozinski interviewed by Jessica Ramirez of Newsweek on 2010.1.29
• Recent Cyber Attacks – More than what meets the eye? Sporkings.com February 19, 2010
• ‘Google’ Hackers Had Ability to Alter Source Code Wired.com March 3, 2010
• 'Aurora' code circulated for years on English sites Where's the China connection?
• Google was brought down by Chinese hairdressers Curl up and dye westerners
• Gross, Michael Joseph, "Enter the Cyber-dragon", Vanity Fair, September 2011.

Internet video

• The Operation Aurora Internet Explorer exploit - live!
• McAfee Operation Aurora Overview
• Operation Aurora Explained by CNET