Slashdot Mirror
Aurora Attack — Resistance Is Futile, Pretty Much
eldavojohn writes "Do you have branch offices in China? iSec has published a new report (PDF) outlining the severity of the attacks on Google.cn, allegedly by the Chinese government, dubbed 'Aurora' attacks. Up to 100 companies were victims, and some are speculating that resistance to such attacks is futile. The report lays out the shape of the attacks — which were customized per-company based on installed vulnerable software and antivirus protection: '1. The attacker socially engineers a victim, often in an overseas office, to visit a malicious website. 2. This website uses a browser vulnerability to load custom malware on the initial victim's machine. 3. The malware calls out to a control server, likely identified by a dynamic DNS address. 4. The attacker escalates his privilege on the corporate Windows network, using cached or local administrator credentials. 5. The attacker attempts to access an Active Directory server to obtain the password database, which can be cracked onsite or offsite. 6. The attacker uses cracked credentials to obtain VPN access, or creates a fake user in the VPN access server. 7. At this point, the attack varies based upon the victim. The attacker may steal administrator credentials to access production systems, obtain source code from a source repository, access data hosted at the victim, or explore Intranet sites for valuable intellectual property.' The report also has pages of recommendations as well as lessons learned, which any systems administrator — even those inside the US — should read and take note of."
Major attack vector: Acrobat Reader. Security company publishes intrusion analysis in pdf format. If you clicked it, you may be part of the problem.
Help stamp out iliturcy.
Just don't use MS Windows.
Okay, I know an ex-pat who has moved to China and married. I have a much better understanding of the current state of technology and governmental oversight there than most here. Let's clear some things up:
The government closely monitors it citizens using every form of surveillance available in public places (which include the internet) to ensure that they are not acting in a fashion the government defines as "subversive". They aren't interested in international cyber-terrorism. They simply realize that they need to be where their citizens are to maintain the umbrella of surveillance. They're not trying to blow up power plants or destroy financial markets, or engage in other acts of cyber-terrorism. They are simply of the mindset that the internet lacks geographical boundaries, and hence treat it somewhat like international waters, and regularily patrol and conduct intrusions on remote systems for the purpose of effecting surveillance on its own citizens.
They are also interested in industrial espionage against specific high-value targets that have technology that China cannot replicate with its limited (though rapidly growing) infrastructure. China is very good at copying technology. It has very little ability (or desire) to innovate. They are focused primarily on a massive modernization program so as to set themselves up to compete with the EU, US, and south asian markets. Hong Kong is about the only ace they have up their sleeve right now there. So they conduct limited cyber attacks for the purpose of acquiring the information and designs to manufacture technologies that are highly intricate (such as microprocessor design).
This is not a statement on the validity of any sovereignty claims, or a moral judgement on China's state-sponsored activities on the global communications networks, merely an statement of their motivations.
#fuckbeta #iamslashdot #dicemustdie
Humans are the biggest weakness in the chain. Don't hire them, or at least hire the most non-people types you can. Hire the non-team players and the ones that argue with everyone. When someone calls them and asks them to go to a web site, they'll say screw you and hang up.
"Attackers are willing to spend months attacking people in these companies, and they write custom malware specific to those companies," [iSec founding partner Alex Stamos] told The Register. "The malware for each of these companies has been customized based on the versions of vulnerable software they're running, as well as what kind of anti-virus they're using. ...
Since when has anti-virus heuristics algorithms been at all useful against custom malware?
Even the script kiddies can find encrypters to take their cookie cutter programs and make them invisible to the majority of anti-virus programs.
[Fuck Beta]
o0t!
Anyone else read that as Auror Attack?
QUIT RUNNING WINDOWS. Look, if anybody runs windows on more than their client box (and many would argue even that is stupid), then you deserve what you get. The same set of idiots will design tanks and subs with picture windows.
1. You must first find someone using windows who is prone to clicking things without thinking. - ok, I accept that.
2. Running a vulnerable browser - Still quite common, First security failure
3. Running windows - Still very plausible
4. Vulnerable to a privilege escalation exploit - Second security failure
5. With a network setup that is vulnerable to this kind of thing - Third security failure
5. Then "accessing" an AD server database - Fourth security failure
6. To be cracked - ok
So for this to work you have to have an insecure browser or other userland app that is easily exploitable (Acrobat), an OS with a privilege escalation flaw and A network that will let someone do things they probably shouldn't, an AD server that is crackable so that you can get at the DB.
IMHO that is a hell of a lot of failures by the various parties for this to work.
Resistance is not so futile -- the use of binary whitelisting tools such as Bit9 (http://www.bit9.com/) combined with network packet analysis allows sysadmins to greatly reduce the chance of an initial infection, and virtually eliminates the chances of an infection spreading across multiple hosts.
For all we know, the Chinese agent who hacked google.cn may have uploaded a trojan pdf reader extension.
Meanwhile I _am_ an expat, currently in China, and I can tell you your information is lacking in a few areas.
What areas are those. Enquiring minds want to know. GP already covered industrial espionage so what have you got?
HOW!!!?? Unless some boneheaded sysadmin granted a user with Domain Admin access, I don't see how this is even remotely possible. Someone with just plain Domain User access either authenticates, or doesn't. Is this article suggesting all local user names and passwords from a DC (domain controller) are locally cached prior to authentication?
Life is not for the lazy.
This type of social engineering attack has been around for atleast 2 decades now. there are manny books about it, including mitnicks.
Windows exploits, spicificley owning a windows AD network via local privelege escalation, sniffing, buffer under/overflows and dumping hashes from the domain controller has been around for atleast 1 decade, the kind of thing I pulled off in highschool.
All they did here is put together very old puzzle peices with a little bit of stratigy.
when will pepole learn to stop using windows? when will people learn to start instituting strict mail policies on corprate networks?
Probably never.
This is not about technical security, this is about exploiting the victums way of thinking.
make money first, keep staff happy second. building a well oilded, tightley maintained business machine does not even come into consideration.
and why would being inside china be any difference? the whole attack is remote, sounds like it can be done to any network from anywhere in the world. why would a chinese office be at higher risk?
--
Stay tuned for some shock and awe coming right up after this messages!
If you don't expect/want traffic from China, configure your firewall to block IP addresses assigned to China.
The initial route of infection for all of the known attacks has been through exploiting flaws in Internet Explorer or Adobe Acrobat using content hosted on external servers.
My box has no IE, no Acrobat. I even use Skim instead of Preview. Flash is turned off by default in the browsers that I do use. Back when I worked for someone who needed to use Windows, we would delete IIS from the system, just to be careful.
On the other hand, if it's an skilled, targeted attack, I would expect a custom exploration of my particular software vulnerabilities.
I read a paper about a decade ago (which I found thanks to Slashdot) describing how China would "hypothetically" wage a war against the US and win without firing a shot. I can't find the paper any more, but it was written by four Chinese generals. Over the last decade things have pretty much played out exactly like the paper laid things out: an economic assault, a propaganda assault, and an electronic assault. If anyone knows the paper I would love to see it again -- I think it even got turned into a book.
One day, long from now, will people wonder why we didn't see the attack coming until it was way too late?
The paper says that small and medium sized businesses are often targets and that they rarely have the resources to mitigate the attacks. Seems to me like this is a great reason to move to cloud computing. I would think 99% of businesses would be better off letting Google protect their servers than trying to find away around these attacks themselves.
I don't normally read the slashdot articles, but happened to read this one. Read the last paragraph, it is chilling.
DK
That paper was this one hosted on Cryptome: Unrestricted Warfare
by Qiao Liang and Wang Xiangsui (Beijing: PLA Literature and Arts Publishing House, February 1999)
It is translated by the FBIS, the CIA's Foreign Broadcast Information Service, which collects and translates reports from around the globe.
Isn't google putting in backdoors to their apps per government requirements? Now bend over.
"We went to do business in a communist nation and they attacked our network, attempting to gain access and who knows what!?" As my teenaged daughter used to say, "Uh..Hello! Yeah!?" Which loosely translates to: And you're surprised?
I'm sure that doesn't carry any risks!
But seriously, if Google were evil geniuses, they'd create hundreds of smaller data centers around the US, with different ecosystems of software security and virtualization and ip blocks, and then use them as a raid array to back up each other.
Damn I wish I had a billion bucks.
Well its obvious why all these attacks work in the first place, companies don't use custom built operating systems. Its a lot harder to attack anything when you have no idea what's what. Where everything is based on a single letter and number sequence to get things done such as f8 for internet, or q0 for delete, or r2 to set us up the bomb. Build it from scratch, write out any vulnerabilities or hell, just make sure everything important is on the corporate intranet and anything you might need to work on has to be copied to a separate intranet for VPN access to work from home, don't allow internet access :D
When I was in the military, we used to shred our secret documents to NSA specs, which is 0.8mm x 4mm. That's about the same width as the "i" in the subject, and about twice as long.
In 2002, we were informed that this was not small enough, and now had to run the shredded documents through the hammer mill, so everything would be reduced to powder.
They caught some folks rummaging at the local landfill, looking for the trash bags filled with end of week, end of month and end of year destruction.
Those people had stereo microscopes in their homes and apartments, and were reassembling the documents and crypto tapes, one tiny piece at a time.
The Chinese have existed as a nation for longer than any other civilization on the face of this planet, and they take the "long view" in such things.
[End Of Line]
with Preview as my pdf reader. I never use Acrobat. Does that move me out of the sight picture for this type of attack?
And get 0wned by a zombie in Switzerland or Dubai or Schenectady or something.
The World Wide Web is dying. Soon, we shall have only the Internet.
Whatever happened to using phrases like "confidence trick" instead of "social engineering"?
This problem was SOLVED by Dennis and Van Horn back in the 1960s, it's called capability based security. You can read more here: http://old.nabble.com/On-the-Spread-of-the-Capability-Approach-to5608409.html
The concept is simple, every process has a list of capabilities handed to it. It doesn't get to do anything not on the list.
It would be fairly easy to make sane default lists and still have a very usable computer.
I imagine most of us are saying: "Not a problem. I don't have anything China wants."
I wish. This is what hacking looks like now. If you haven't noticed, you haven't been paying attention.
We asked ourself, which 10 computers would cause us the greatest loss if they were compromised. When we took a hard look at their network traffic, we found an otherwise indetectable compromise. It appears to have been in place for at least 3 months. Just patiently listening and waiting.
You may want to try the same exercise.
Organized crime has demonstrated (http://www.ren-isac.net/alerts/banking-attacks_technical_201001.html) that patient, disciplined attacks yeild great monetary rewards.
The Chinese have demonstrated that patient, disciplined attacks are virtually unstoppable.
What more could any hacker want?
The most fragile secret is a successful economic model. Once it gets out, EVERYBODY copies it.
Learn how to defend yourself if you want to survive.
Miles
I for one welcome our new Aurorean Overlords.
Now let's see this PDF fi
Taggers take note.
you had me at #!
If you preview it using as suggested the google reader aren't you still loading that into memory?
You're loading it into Google's memory. Google is using a non-Adobe program to generate HTML.
In theory the attacker could have a Google-specific 0-day exploit that pwns Google's server (probably custom unreleased software on Linux, so VERY hard) and then ships you some evil HTML. This is damn unlikely.
I'd also be curious to know the effectiveness of these pdf attacks on linux hosts.
Linux is a bit harder to attack, especially if 64-bit. It's possible to make Linux **MUCH** harder to attack, but we haven't bothered yet.
Although not feasible for the work environment (or is it?) there are probably many users out there who now surf through virtual machines.
I think you have that backwards, but this is rare in either case. In the business environment it's possible to get site licenses, firewalls to block non-VM browsing, and even competant IT support. Note: "possible". It's very uncommon, but possible.
Currently I've been attempting to convert my Fedora system from SELinux working in targeted mode to strict mode. I found that numerous programs I'd like to run and that are provided will not work with SELinux without giving them permission to do insecure functions. So far several programs violate SELinux execmem rules when enforced. There is no way for a non-coder to fix this. One problem for a VLSI IDE I want to run is the TK interpreter 'wish'. Most of the others are 3D tools or games.
I will at some point weed out that garbage and run this in strict mode. This is a slow process.
I'd go on a Vegan diet but the delivery time from Vega is too long. --brownkitty
Let's try less crap on our machines that might be vulnerable.
I can agree for performance and cross-platform issues, but proper sandboxing solves the attack surface problem.
Imagine a web browser that starts up a fresh new virtual PC for each web site, then deletes the machine when you leave the web site. The virtual machine could even run IE 6 on Windows XP without any service packs, and the entire world allowed to run Active X shit without prompting. The virtual PC can get pwned in a fraction of a second every time, and you just don't need to care. Firewalling on the host OS can restrict the guest OS to the intended web site, so you don't need to worry about being a botnet node.
"The attacker socially engineers a victim, often in an overseas office, to visit a malicious website."
Hire people with a triple digit IQ...
"Why is the page blank?"
"Oh, the page I sent you won't work unless you load it in 'x' turn off 'y'"
"Ok"
Absolutely the same story in India. Sometimes I wonder if _any_ place outside of the US really gets it. Anecdotally, even Europe seems similarly third world-ish. This is also the reason I think predictions of the US being eclipsed anytime this century are hogwash.
Yea US gets it ... that's where it is at, 14 trillion dollars in debt, quantitative easing (aka printing money) to the rescue!
There are still the same vector of attack possible. e.g. if someone signs adobe an old PDF reader.exe as trusted, TCP is vulnerable immediately.
There really is no simple answer to this. The fact that everything is networked nowadays is not helping.
But all vector of attack can be made as hard as possible.
1. The attacker socially engineers a victim, often in an overseas office, to visit a malicious website.
Anwer -Train users.
2. This website uses a browser vulnerability to load custom malware on the initial victim's machine.
Answer: minimize number of plugin, up to date browser, Put internet acces in a virualized separate part of the network
3. The malware calls out to a control server, likely identified by a dynamic DNS address.
Anser: kill those control servers!
4. The attacker escalates his privilege on the corporate Windows network, using cached or local administrator credentials.
Answer: Should not be possible. A users should not get admin right.
5. The attacker attempts to access an Active Directory server to obtain the password database, which can be cracked onsite or offsite.
Answer: no answer possble, see 4.
6. The attacker uses cracked credentials to obtain VPN access, or creates a fake user in the VPN access server.
Answer: Check the VPN access logs AND Use second channel authorisation(token)
7. At this point, the attack varies based upon the victim. The attacker may steal administrator credentials to access production systems, obtain source code from a source repository, access data hosted at the victim, or explore Intranet sites for valuable intellectual property.'
Answer: Don't put all the eggs in one basket. A user should only be able to acces what he needs, not everything.
Aurora was also the name of the "cybersecurity attack" on an electric generator that resulted in it bouncing up and down in a video on CNN a few years ago.
Actually, the cyber intrusion was stipulated and the remainder of the attack simulated by doing things with the generator that are known to cause serious problems.
I love how "Step #1" is social engineering. Which can be translated to simply, find some stupid sucker that you can convince to do something they shouldn't be doing.
You cannot solve stupid.
No amount of security will prevent intrusion if all you have to do is call up some idiot and get him to turn it off for you.
The only solution to this is A) Training, or B) Don't hire freaking idiots.
Difficulty is that idiots are usually cheap labour, and don't particularly care one way or another. One might argue you can still hire idiots, just don't give them access to anything critical. However it today's world that can mean pretty much any network access, which means why bother hiring them as they won't be able to do anything (or even less than before).
Sadly many times it is the older people closer to retirement, or the very young temporary workers who are most vulnerable. I have personally worked with some people that A) I wonder how they hell they got that job, and B) how the hell they can get ANY job not directly associated with shovels (not including managers). I think a good litmus test is if the jerk at Bestbuy or Futureshop can Con you, then slowly step away from my computer console, as you are a danger to yourself and others. I find it hard to believe someone could be found without raising suspicion in a company like Google, but I guess every corporate structure has its flaws.
It also takes a bit of a suspicious mind, critical thinking, and a dash of paranoia. Both my Dad and my Sister fell for that malware that you get by clicking on the website that makes it look like your desktop, and it has an error. It actually took me a few moments to realize that the "error" they were talking about was really that phishing website. I was at somewhat a loss at what to tell them when they asked me how to prevent this in the future. I couldn't exactly tell them not to be suckers. In the end just telling them to pay attention to what they are doing and to be very suspicious of any new website you do not trust.
(Firmly adjusts tinfoil hat with pride)
With the amount of jerks out there trying to screw with you, as amazing as it sounds, a tinfoil hat is your best defense. (I mean that figuratively, not literally, though it is fashionable...)
that Google must have had a corporate Windoze network and active directory ? That's Evil ! ;-)
LOL.. And linux has no vulnerabilities?
http://milw0rm.com/platforms/linux
Just last year there were DOZENS of kernel vulnerabilities on Linux and NT had almost none. Ofcource since you're part of the online linux cheer-leading squad you ignore facts.
Linux is an average Unix clone. Get used to it. Although, to be fair, I guess the "clone" part is redundant. Everything in the F/OSS world is a copy of existing successful proprietary products.
They described in steps, the regular hack that happens in everyday hacking.
I don't know what they were trying to single out, but most hacks start off with a vulnerability being exploited and then the
hacker tends to put into effect means to be able to reconnect using proper credentials.
Anyways, using a hole to then log on and create your own account for later seems pretty simple in terms of
common sense, but the rest of the way would be to describe how a hacker goes about deleting tracks left behind in order to avoid flagging that the server was compromised. This would show more the effort you need to put into a good hack session.
You really think they don't use compromised hosts elsewhere to mount these attacks? Guess where the LEAST likely source address an attack from China would probably come from? Right. APNIC address space in China.
Yes and no.
While I'm sure a real attack would come from a compromised host somewhere else, I noticed that the bulk of the portscans and ssh auth attempts that my systems log are from these address blocks.
Maybe it's just kids screwing around or maybe they're gathering intel on systems they can use to conduct bigger attacks later. Either way, my systems see a whole lot less malicious traffic now that I've blocked China.
If you want a vision of the future, imagine a youtube comments section scrolling - forever.
You say you know what's going on in China because of someone who lives there? Someone who is, by your very admission, living in an Orwellian Panopticon of government lies and surveillance? Someone who is telling you the truth as he sees it, certainly, but why do you believe that the information he's gathered is itself true?
The government of China lies, and it steals information, and it kills its own people en masse...and yet you think it wouldn't sully itself with governmental espionage or industrial sabotage. All it wants, you say, is to steal information from foreign companies.
I'm glad we cleared that up.
Wha... ? Oh ! W - i - n -.... Man! You had me going for a moment, there ! :)