Vulnerabilities / Threats
3/31/2010
02:33 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

Google: Hackers Targeted Chinese And Vietnamese

A botnet focused on Vietnamese users was erroneously associated with the cyber attacks from China.

The cyberattack that Google disclosed in January, subsequently dubbed "Operation Aurora" by McAfee, turns out to have been two separate, unrelated attacks.

Initially, Google described the attack as "a highly sophisticated and targeted attack on our corporate infrastructure originating from China that resulted in the theft of intellectual property from Google." The company also noted that in the course of investigating this attack, it had discovered that dozens of Gmail accounts belonging to human rights activists had been compromised and accessed by unauthorized parties.

These e-mail break-ins, Google, believes, followed from successful phishing attacks or malware on the victim's computer.

In a blog post on Tuesday, Google security team member Neel Mehta explained that Google had found evidence of a separate, less sophisticated cyber attack directed at a different community of users -- Vietnamese activists.

Mehta said that the malware targeted Vietnamese computer users and may have affected tens of thousands of people, despite the fact that it isn't as sophisticated as the malware associated with the attack that came from China.

"These infected machines have been used both to spy on their owners as well as participate in distributed denial of service (DDoS) attacks against blogs containing messages of political dissent," said Mehta. "Specifically, these attacks have tried to squelch opposition to bauxite mining efforts in Vietnam, an important and emotionally charged issue in the country."

McAfee in a separate blog post acknowledged revising its appraisal of the Operation Aurora attack. "While originally some of these domains and files had been reported to be associated with Operation Aurora, we have since come to believe that this malware is unrelated to Aurora and uses a different set of Command & Control servers," CTO George Kurtz.

According to McAfee the attackers created their botnet using a malicious keyboard driver that replaces the VPSKeys driver used in the Vietnamese version of Windows.

The security company observes that politically motivated hacking, or hacktivism, is on the rise. Reports published on Wednesday by The New York Times and the Associated Press appear to support that claim. They note that the Yahoo Mail accounts of more than a dozen academics and journalists who cover China and Taiwan have been accessed by unknown parties.

A Yahoo spokesperson declined to comment on the attacks beyond offering a general condemnation of hacking for any reason and noting, "Yahoo! sold its China business in 2005 to a Chinese company called Alibaba, and while maintaining a 39% investment in Alibaba, we no longer have operational control or day-to-day management over the Yahoo! China business."

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-4199
Published: 2014-08-28
vm-support 0.88 in VMware Tools, as distributed with VMware Workstation through 10.0.3 and other products, allows local users to write to arbitrary files via a symlink attack on a file in /tmp.

CVE-2014-4200
Published: 2014-08-28
vm-support 0.88 in VMware Tools, as distributed with VMware Workstation through 10.0.3 and other products, uses 0644 permissions for the vm-support archive, which allows local users to obtain sensitive information by extracting files from this archive.

CVE-2014-0761
Published: 2014-08-27
The DNP3 driver in CG Automation ePAQ-9410 Substation Gateway allows remote attackers to cause a denial of service (infinite loop or process crash) via a crafted TCP packet.

CVE-2014-0762
Published: 2014-08-27
The DNP3 driver in CG Automation ePAQ-9410 Substation Gateway allows physically proximate attackers to cause a denial of service (infinite loop or process crash) via crafted input over a serial line.

CVE-2014-2380
Published: 2014-08-27
Schneider Electric Wonderware Information Server (WIS) Portal 4.0 SP1 through 5.5 uses weak encryption, which allows remote attackers to obtain sensitive information by reading a credential file.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
This episode of Dark Reading Radio looks at infosec security from the big enterprise POV with interviews featuring Ron Plesco, Cyber Investigations, Intelligence & Analytics at KPMG; and Chris Inglis & Chris Bell of Securonix.