Vulnerabilities / Threats
3/31/2010
02:33 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%
Repost This

Google: Hackers Targeted Chinese And Vietnamese

A botnet focused on Vietnamese users was erroneously associated with the cyber attacks from China.

The cyberattack that Google disclosed in January, subsequently dubbed "Operation Aurora" by McAfee, turns out to have been two separate, unrelated attacks.

Initially, Google described the attack as "a highly sophisticated and targeted attack on our corporate infrastructure originating from China that resulted in the theft of intellectual property from Google." The company also noted that in the course of investigating this attack, it had discovered that dozens of Gmail accounts belonging to human rights activists had been compromised and accessed by unauthorized parties.

These e-mail break-ins, Google, believes, followed from successful phishing attacks or malware on the victim's computer.

In a blog post on Tuesday, Google security team member Neel Mehta explained that Google had found evidence of a separate, less sophisticated cyber attack directed at a different community of users -- Vietnamese activists.

Mehta said that the malware targeted Vietnamese computer users and may have affected tens of thousands of people, despite the fact that it isn't as sophisticated as the malware associated with the attack that came from China.

"These infected machines have been used both to spy on their owners as well as participate in distributed denial of service (DDoS) attacks against blogs containing messages of political dissent," said Mehta. "Specifically, these attacks have tried to squelch opposition to bauxite mining efforts in Vietnam, an important and emotionally charged issue in the country."

McAfee in a separate blog post acknowledged revising its appraisal of the Operation Aurora attack. "While originally some of these domains and files had been reported to be associated with Operation Aurora, we have since come to believe that this malware is unrelated to Aurora and uses a different set of Command & Control servers," CTO George Kurtz.

According to McAfee the attackers created their botnet using a malicious keyboard driver that replaces the VPSKeys driver used in the Vietnamese version of Windows.

The security company observes that politically motivated hacking, or hacktivism, is on the rise. Reports published on Wednesday by The New York Times and the Associated Press appear to support that claim. They note that the Yahoo Mail accounts of more than a dozen academics and journalists who cover China and Taiwan have been accessed by unknown parties.

A Yahoo spokesperson declined to comment on the attacks beyond offering a general condemnation of hacking for any reason and noting, "Yahoo! sold its China business in 2005 to a Chinese company called Alibaba, and while maintaining a 39% investment in Alibaba, we no longer have operational control or day-to-day management over the Yahoo! China business."

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-0360
Published: 2014-04-23
Memory leak in Cisco IOS before 15.1(1)SY, when IKEv2 debugging is enabled, allows remote attackers to cause a denial of service (memory consumption) via crafted packets, aka Bug ID CSCtn22376.

CVE-2012-1317
Published: 2014-04-23
The multicast implementation in Cisco IOS before 15.1(1)SY allows remote attackers to cause a denial of service (Route Processor crash) by sending packets at a high rate, aka Bug ID CSCts37717.

CVE-2012-1366
Published: 2014-04-23
Cisco IOS before 15.1(1)SY on ASR 1000 devices, when Multicast Listener Discovery (MLD) tracking is enabled for IPv6, allows remote attackers to cause a denial of service (device reload) via crafted MLD packets, aka Bug ID CSCtz28544.

CVE-2012-3062
Published: 2014-04-23
Cisco IOS before 15.1(1)SY, when Multicast Listener Discovery (MLD) snooping is enabled, allows remote attackers to cause a denial of service (CPU consumption or device crash) via MLD packets on a network that contains many IPv6 hosts, aka Bug ID CSCtr88193.

CVE-2012-3918
Published: 2014-04-23
Cisco IOS before 15.3(1)T on Cisco 2900 devices, when a VWIC2-2MFT-T1/E1 card is configured for TDM/HDLC mode, allows remote attackers to cause a denial of service (serial-interface outage) via certain Frame Relay traffic, aka Bug ID CSCub13317.

Best of the Web