Vulnerabilities / Threats
3/31/2010
02:33 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

Google: Hackers Targeted Chinese And Vietnamese

A botnet focused on Vietnamese users was erroneously associated with the cyber attacks from China.

The cyberattack that Google disclosed in January, subsequently dubbed "Operation Aurora" by McAfee, turns out to have been two separate, unrelated attacks.

Initially, Google described the attack as "a highly sophisticated and targeted attack on our corporate infrastructure originating from China that resulted in the theft of intellectual property from Google." The company also noted that in the course of investigating this attack, it had discovered that dozens of Gmail accounts belonging to human rights activists had been compromised and accessed by unauthorized parties.

These e-mail break-ins, Google, believes, followed from successful phishing attacks or malware on the victim's computer.

In a blog post on Tuesday, Google security team member Neel Mehta explained that Google had found evidence of a separate, less sophisticated cyber attack directed at a different community of users -- Vietnamese activists.

Mehta said that the malware targeted Vietnamese computer users and may have affected tens of thousands of people, despite the fact that it isn't as sophisticated as the malware associated with the attack that came from China.

"These infected machines have been used both to spy on their owners as well as participate in distributed denial of service (DDoS) attacks against blogs containing messages of political dissent," said Mehta. "Specifically, these attacks have tried to squelch opposition to bauxite mining efforts in Vietnam, an important and emotionally charged issue in the country."

McAfee in a separate blog post acknowledged revising its appraisal of the Operation Aurora attack. "While originally some of these domains and files had been reported to be associated with Operation Aurora, we have since come to believe that this malware is unrelated to Aurora and uses a different set of Command & Control servers," CTO George Kurtz.

According to McAfee the attackers created their botnet using a malicious keyboard driver that replaces the VPSKeys driver used in the Vietnamese version of Windows.

The security company observes that politically motivated hacking, or hacktivism, is on the rise. Reports published on Wednesday by The New York Times and the Associated Press appear to support that claim. They note that the Yahoo Mail accounts of more than a dozen academics and journalists who cover China and Taiwan have been accessed by unknown parties.

A Yahoo spokesperson declined to comment on the attacks beyond offering a general condemnation of hacking for any reason and noting, "Yahoo! sold its China business in 2005 to a Chinese company called Alibaba, and while maintaining a 39% investment in Alibaba, we no longer have operational control or day-to-day management over the Yahoo! China business."

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Latest Comment: nice one good
Current Issue
E-Commerce Security: What Every Enterprise Needs to Know
The mainstream use of EMV smartcards in the US has experts predicting an increase in online fraud. Organizations will need to look at new tools and processes for building better breach detection and response capabilities.
Flash Poll
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
Join Dark Reading community editor Marilyn Cohodas in a thought-provoking discussion about the evolving role of the CISO.