Feeds

Google Aurora hackers AT LARGE, launch 0-day bazookas

Security snoopers back? They never left

The Power of One eBook: Top reasons to choose HP BladeSystem

Security researchers have traced a continuing run of zero-day attacks to the hackers who infamously hit Google and other hi-tech firms three years ago.

Symantec has kept close tabs on the hackers behind the so-called Aurora attacks ever since. No other group has used more zero-day vulnerabilities – eight – to further their malicious goals than the attackers behind Aurora (Hydraq) and other related attacks, the researchers said. Previous unknown vulnerabilities leveraged by the group have included Internet Explorer and Adobe Flash security bugs.

Identifying zero-day attacks takes hard graft as well as skills in reverse-engineering, a factor that means the group must be well-resourced.

"The group behind the Hydraq attacks is very much still active, with evidence indicating their involvement in a consistent and ongoing pattern of large-scale targeted attacks," according to Symantec.

"Targeted sectors include, but are not limited to: the defence industry, human rights and non-governmental organisations (NGOs) and IT service providers," it added.

Attacks used to be launched via targeted email (phishing) but over the years the group has moved on towards increased adoption of "watering hole" attacks – the "watering holes" being websites likely to be visited by the gazelle-like target organisation. Defence supply chain firms (suppliers of electronics and other sub components) of defence systems have been the prime target of these attacks. Suppliers are selected because they have lower security standards than tier-one defence contractors, who have been a prime target for cyber-espionage many years.

The attackers reuse components of an infrastructure Symantec has dubbed the Elderwood Platform. Most of the attacks have focused on either intelligence gathering or swiping valuable trade secrets from compromised computers, say the researchers.

"Although there are other attackers utilising zero-day exploits (for example, the Sykipot, Nitro, or even Stuxnet attacks), we have seen no other group use so many," a blog post by Symantec security response concludes.

At the time of the 2010 hack, Google all but said the attackers behind the Aurora attacks were backed by the Chinese government. Symantec is more circumspect.

The number of victims, the duration of the ongoing attacks as well as their apparent goal of wholesale intelligence and intellectual property theft mean the group must be backed by a nation state or (less probably) a large criminal organisation.

A white paper by Symantec on the ongoing attacks by the group can be found here (PDF). ®

Designing a Defense for Mobile Applications

More from The Register

next story
DARPA-derived secure microkernel goes open source tomorrow
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.