Feeds

Google may exit China after 'highly targeted' attack

Activists hit in 20-company dragnet

Reducing security risks from open source software

Updated Google plans to curb its controversial practice of censoring search results in China after uncovering a "highly sophisticated and targeted attack" designed to steal information about human rights activists from its Gmail service and at least 20 other large companies.

The attack that hit Google in mid-December originated in China and was aimed at accessing the Gmail accounts of human rights activists. Although only two email accounts appear to have been breached, "accounts of dozens of US-, China- and Europe-based Gmail users who are advocates of human rights in China" have been routinely breached, most likely as a result of phishing or malware attacks, the company said Tuesday.

The discovery came as Google uncovered similar attacks on at least 20 other companies in the financial, technology, media, and chemical industries. Adobe Systems issued a separate statement that reported it and and other companies had also come under attack. In light of the revelations, Google said it is considering shuttering its Chinese operations altogether.

"These attacks and the surveillance they have uncovered - combined with the attempts over the past year to further limit free speech on the web - have led us to conclude that we should review the feasibility of our business operations in China," Google's chief legal officer David Drummond wrote here. "We have decided we are no longer willing to continue censoring our results on Google.cn, and so over the next few weeks we will be discussing with the Chinese government the basis on which we could operate an unfiltered search engine within the law, if at all."

Drummond said Google has already used the investigation findings to introduce security improvements. The company is also in the process of sharing its findings with law enforcement authorities and the other targeted sites.

"We have taken the unusual step of sharing information about these attacks with a broad audience not just because of the security and human rights implications of what we have unearthed, but also because this information goes to the heart of a much bigger global debate about freedom of speech," Drummond wrote.

He didn't provide details about the two breached Gmail accounts except to say that "activity was limited to account information (such as the date the account was created) and subject line, rather than the content of emails themselves." The names of the 20 large companies were also omitted.

Drummond's description of an industry-wide attack carried out from China is reminiscent of a warning issued two years ago by the MI5's director-general. In a letter sent in late 2007 to 300 UK chief executives and security chiefs, Jonathan Evans warned the leaders of British businesses to be on the lookout for state-sponsored Chinese hackers carrying out electronic surveillance attacks.

"This is highly likely to be much wider than even Google knows," said Alan Paller, director of research for the SANS Institute. "Two years is a long time in this business." According to The New York Times 34 companies, most of them high-technology companies in Silicon Valley, have been targeted in the attacks, which attempted to access source code repositories. The attackers used Taiwanese internet addresses, the paper reported, citing James Mulvenon, an expert on Chinese cyberwarfare capabilities.

Adobe, whose Acrobat and Reader apps are frequently targeted by attackers to install malware on the machines of its users said here that early this month it learned of a "computer security incident involving a sophisticated, coordinated attack against corporate network systems managed by Adobe and other companies." While investigators have no indication customer, employee or financial data was accessed, it said a full accounting of the incident will "take quite some time to complete."

Adobe spokeswoman Wiebke Lips declined to elaborate or say whether the disclosure was related to Google's advisory. Adobe on Tuesday fixed a critical Reader vulnerability that was being narrowly targeted in an unusually sophisticated attack. The timing of Google's warning and the fixing of the Reader bug is already touching off speculation that at least some of the attacks exploited the Adobe flaw.

Lending credibility to that theory was a separate Google post that claimed the attack didn't target the companies' servers.

"The route the attackers used was malicious software used to infect personal computers," Dave Girouard, president of Google Enterprise, wrote. "Any computer connected to the Internet can fall victim to such attacks. While some intellectual property on our corporate network was compromised, we believe our customer cloud-based data remains secure."

Google, whose corporate credo is "Don't be evil," entered the Chinese market in 2006 with the promise to censor search results that were objectionable to the country's government. The pledge has often stuck in the craw of free-speech advocates. While Google remains the uncontested search leader in most regions of the world, its share of the Chinese market is about 30 percent, less than half what Baidu has. ®

This story was updated throughout to add details about Adobe, attacks on other companies and market share.

Mobile application security vulnerability report

More from The Register

next story
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Microsoft: You NEED bad passwords and should re-use them a lot
Dirty QWERTY a perfect P@ssword1 for garbage websites
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
NUDE SNAPS AGENCY: NSA bods love 'showing off your saucy selfies'
Swapping other people's sexts is a fringe benefit, says Snowden
L33t haxxors compete to p0wn popular home routers
EFF-endorsed SOHOpelessly Broken challenge will air routers' dirty zero day laundry
Own a Cisco modem or wireless gateway? It might be owned by someone else, too
Remote code exec in HTTP server hands kit to bad guys
British data cops: We need greater powers and more money
You want data butt kicking, we need bigger boots - ICO
Crooks fling banking Trojan at Japanese smut site fans
Wait - they're doing online banking with an unpatched Windows PC?
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Mobile application security vulnerability report
The alarming realities regarding the sheer number of applications vulnerable to attack, and the most common and easily addressable vulnerability errors.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.