Vulnerabilities / Threats
3/31/2010
02:33 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%
Repost This

Google: Hackers Targeted Chinese And Vietnamese

A botnet focused on Vietnamese users was erroneously associated with the cyber attacks from China.

The cyberattack that Google disclosed in January, subsequently dubbed "Operation Aurora" by McAfee, turns out to have been two separate, unrelated attacks.

Initially, Google described the attack as "a highly sophisticated and targeted attack on our corporate infrastructure originating from China that resulted in the theft of intellectual property from Google." The company also noted that in the course of investigating this attack, it had discovered that dozens of Gmail accounts belonging to human rights activists had been compromised and accessed by unauthorized parties.

These e-mail break-ins, Google, believes, followed from successful phishing attacks or malware on the victim's computer.

In a blog post on Tuesday, Google security team member Neel Mehta explained that Google had found evidence of a separate, less sophisticated cyber attack directed at a different community of users -- Vietnamese activists.

Mehta said that the malware targeted Vietnamese computer users and may have affected tens of thousands of people, despite the fact that it isn't as sophisticated as the malware associated with the attack that came from China.

"These infected machines have been used both to spy on their owners as well as participate in distributed denial of service (DDoS) attacks against blogs containing messages of political dissent," said Mehta. "Specifically, these attacks have tried to squelch opposition to bauxite mining efforts in Vietnam, an important and emotionally charged issue in the country."

McAfee in a separate blog post acknowledged revising its appraisal of the Operation Aurora attack. "While originally some of these domains and files had been reported to be associated with Operation Aurora, we have since come to believe that this malware is unrelated to Aurora and uses a different set of Command & Control servers," CTO George Kurtz.

According to McAfee the attackers created their botnet using a malicious keyboard driver that replaces the VPSKeys driver used in the Vietnamese version of Windows.

The security company observes that politically motivated hacking, or hacktivism, is on the rise. Reports published on Wednesday by The New York Times and the Associated Press appear to support that claim. They note that the Yahoo Mail accounts of more than a dozen academics and journalists who cover China and Taiwan have been accessed by unknown parties.

A Yahoo spokesperson declined to comment on the attacks beyond offering a general condemnation of hacking for any reason and noting, "Yahoo! sold its China business in 2005 to a Chinese company called Alibaba, and while maintaining a 39% investment in Alibaba, we no longer have operational control or day-to-day management over the Yahoo! China business."

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Latest Comment: LOL.
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6213
Published: 2014-04-19
Unspecified vulnerability in Virtual User Generator in HP LoadRunner before 11.52 Patch 1 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1833.

CVE-2013-6214
Published: 2014-04-19
Unspecified vulnerability in the Integration Service in HP Universal Configuration Management Database 9.05, 10.01, and 10.10 allows remote authenticated users to obtain sensitive information via unknown vectors, aka ZDI-CAN-2042.

CVE-2014-0778
Published: 2014-04-19
The TCPUploader module in Progea Movicon 11.4 before 11.4.1150 allows remote attackers to obtain potentially sensitive version information via network traffic to TCP port 10651.

CVE-2014-1974
Published: 2014-04-19
Directory traversal vulnerability in LYSESOFT AndExplorer before 20140403 and AndExplorerPro before 20140405 allows attackers to overwrite or create arbitrary files via unspecified vectors.

CVE-2014-1983
Published: 2014-04-19
Unspecified vulnerability in Cybozu Remote Service Manager through 2.3.0 and 3.x before 3.1.1 allows remote attackers to cause a denial of service (CPU consumption) via unknown vectors.

Best of the Web