News

Evidence from Google Attacks Points to China

The fallout from the recent cyberattacks against Google and other companies, which occurred in December and were revealed by Google last week, continues to spread.

A security researcher for SecureWorks says he has found evidence to support Google's claim that last month's attacks on the company's systems originated in China, while another security expert called them the largest and most sophisticated attacks specifically aimed at businesses in years.

The attacks, which used the Hydraq Trojan to open a back door into infected systems, affected Google and 33 other companies. In addition to concerns over possible stolen information, the event has raised discussions about free speech and censorship in China.

Joe Stewart, SecureWorks' director of malware research, said he analyzed the software used in the attacks and found that it contained an algorithm from a Chinese technical paper that has been published only on Chinese-language Web sites, according to a report in The New York Times.

Google officials, in announcing the attack in a Jan. 12 blog post, have said they suspected that the attack originated in China, saying that the Gmail accounts of human rights activists in China had been monitored or hacked. The Gmail accounts of foreign journalists also have reportedly been hacked. The company is threatening to pull its operations out of the country. 

Other companies reported to have been affected include Adobe, Microsoft, Juniper Networks, Northrop Grumman, Symantec, Yahoo and Dow Chemical.

The attacks in many cases exploited a zero-day flaw in Adobe Acrobat and Reader to infect systems with the Hydraq Trojan, which launched when a user clicked on a malicious .PDF attached to an e-mail. Adobe issued a patch for the vulnerability this week.

The security company McAfee also said the attacks had exploited a vulnerability in Internet Explorer. Microsoft reported that the vulnerability exists in IE 6, but has issued an out-of-cycle security patch for all versions of the browser.

The attacks are similar to a July 2009 attack that involved about 100 companies, according to VeriSign iDefense.

In a blog post, McAfee Chief Technology Officer George Kurtz, dubbing recent the attacks "Operation Aurora," called it "the largest and most sophisticated cyberattack we have seen in years targeted at specific corporations."

"While the malware was sophisticated, we see lots of attacks that use complex malware combined with zero-day exploits," Kurtz wrote. "What really makes this is a watershed moment in cybersecurity is the targeted and coordinated nature of the attack with the main goal appearing to be to steal core intellectual property."

Meanwhile, Google is investigating whether some of its employees in China might have helped the attackers. Reuters reported that some employees in China had been placed on leave or transferred.

About the Author

Kevin McCaney is the managing editor of Government Computer News.

Featured

  • Everything Microsoft Announced at Its Surface Event

    Microsoft showed off its updated and expanded line of Surface devices this week, positioning the new Surface Laptop Studio as its flagship Windows 11 laptop.

  • M&A in Microsoft Channel: Progress Acquires Kemp

    Longtime Microsoft partner Progress Software is acquiring another Microsoft partner in Kemp Technologies.

  • The 2021 Microsoft Product Roadmap

    From Windows 10X to the next generation of Microsoft's application server products, here are the product milestones coming down the pipeline in 2021.

  • Microsoft Says System Center 2022 Will Arrive Early Next Year

    Microsoft is planning to release its new System Center product in the first quarter of 2022, with a private preview arriving within months.