Slashdot Mirror
Aurora Attack — Resistance Is Futile, Pretty Much
eldavojohn writes "Do you have branch offices in China? iSec has published a new report (PDF) outlining the severity of the attacks on Google.cn, allegedly by the Chinese government, dubbed 'Aurora' attacks. Up to 100 companies were victims, and some are speculating that resistance to such attacks is futile. The report lays out the shape of the attacks — which were customized per-company based on installed vulnerable software and antivirus protection: '1. The attacker socially engineers a victim, often in an overseas office, to visit a malicious website. 2. This website uses a browser vulnerability to load custom malware on the initial victim's machine. 3. The malware calls out to a control server, likely identified by a dynamic DNS address. 4. The attacker escalates his privilege on the corporate Windows network, using cached or local administrator credentials. 5. The attacker attempts to access an Active Directory server to obtain the password database, which can be cracked onsite or offsite. 6. The attacker uses cracked credentials to obtain VPN access, or creates a fake user in the VPN access server. 7. At this point, the attack varies based upon the victim. The attacker may steal administrator credentials to access production systems, obtain source code from a source repository, access data hosted at the victim, or explore Intranet sites for valuable intellectual property.' The report also has pages of recommendations as well as lessons learned, which any systems administrator — even those inside the US — should read and take note of."
Major attack vector: Acrobat Reader. Security company publishes intrusion analysis in pdf format. If you clicked it, you may be part of the problem.
Help stamp out iliturcy.
Just don't use MS Windows.
Humans are the biggest weakness in the chain. Don't hire them
This.
"Attackers are willing to spend months attacking people in these companies, and they write custom malware specific to those companies," [iSec founding partner Alex Stamos] told The Register. "The malware for each of these companies has been customized based on the versions of vulnerable software they're running, as well as what kind of anti-virus they're using. ...
Since when has anti-virus heuristics algorithms been at all useful against custom malware?
Even the script kiddies can find encrypters to take their cookie cutter programs and make them invisible to the majority of anti-virus programs.
[Fuck Beta]
o0t!
QUIT RUNNING WINDOWS. Look, if anybody runs windows on more than their client box (and many would argue even that is stupid), then you deserve what you get. The same set of idiots will design tanks and subs with picture windows.
1. You must first find someone using windows who is prone to clicking things without thinking. - ok, I accept that.
2. Running a vulnerable browser - Still quite common, First security failure
3. Running windows - Still very plausible
4. Vulnerable to a privilege escalation exploit - Second security failure
5. With a network setup that is vulnerable to this kind of thing - Third security failure
5. Then "accessing" an AD server database - Fourth security failure
6. To be cracked - ok
So for this to work you have to have an insecure browser or other userland app that is easily exploitable (Acrobat), an OS with a privilege escalation flaw and A network that will let someone do things they probably shouldn't, an AD server that is crackable so that you can get at the DB.
IMHO that is a hell of a lot of failures by the various parties for this to work.
For all we know, the Chinese agent who hacked google.cn may have uploaded a trojan pdf reader extension.
This type of social engineering attack has been around for atleast 2 decades now. there are manny books about it, including mitnicks.
Windows exploits, spicificley owning a windows AD network via local privelege escalation, sniffing, buffer under/overflows and dumping hashes from the domain controller has been around for atleast 1 decade, the kind of thing I pulled off in highschool.
All they did here is put together very old puzzle peices with a little bit of stratigy.
when will pepole learn to stop using windows? when will people learn to start instituting strict mail policies on corprate networks?
Probably never.
This is not about technical security, this is about exploiting the victums way of thinking.
make money first, keep staff happy second. building a well oilded, tightley maintained business machine does not even come into consideration.
I follow steps 1 - 4. Regarding step 5 however...
Log into that box.
That user must be either a member of the Domain Admins group, or Local Administrators group of that PC. The later seems possible as there are many users that love to RDP into their own boxes from work over a VPN connection. Even then, only one user is allowed access unless it is a Terminal Server.
As for the NT security token. I know that when a user (regardless of membership) logs into a machine, the security credentials get cached. But from what I understand, you can't recover passwords from the local SAMS database unless the box is already rooted.
Life is not for the lazy.
Have you been keeping up with current events? The news on ACTA, for starters. Those school kids being spied on in Philadelphia via school mandated computers. Traffic light cameras. There is little doubt in my mind that the US is moving toward the same sort of round the clock surveillance that England and China enjoy right now. Law enforcement is pushing through a variety of rules, regulations, and even laws, permitting them to track citizens via mobile phone and other means, WITHOUT a warrant.
I definitely see an Orwellian future for the United States. Unless, of course, the citizens revolt against it. Unfortunately, the very citizens are subsidizing all of this surveillance. How many people do you know who have PAID FOR that GPS tracking that General Motors offers? Yes, PAID FOR some nice un-intrusive surveillance. Soon, the insurance companies will mandate that all vehicles have such surveillance, and we'll just roll over, and accept the edict.
"Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
"We went to do business in a communist nation and they attacked our network, attempting to gain access and who knows what!?" As my teenaged daughter used to say, "Uh..Hello! Yeah!?" Which loosely translates to: And you're surprised?
Hey, nice to hear. I have this Black friend so I know Blacks. /yay
I hope you weren't counting on a Funny mod because Google was a victim of this attack. IF you were, then I'm sorry that I walked around it. I do not think cloud computing would be the solution to something like this.
You see, they infiltrated the regular network before infiltrating the servers. Even cloud computing services wouldn't be looking for attacks from inside as it would appear once the workstations were compromised. They basically tricked users into giving them access or visiting a site that took advantage of an exploit to get access on the workstations. From there, it was almost like sitting in the offices that were supposed to be accessing the servers. This would work with or without cloud computing.
.. Root the box, and you might be able to recover the cached passwords from it.
Almost. The iSec paper mentioned, but didn't explain 'Pass The Hash' attacks. See the excellent SANS paper at: http://www.sans.org/reading_room/last.php
Bottom line is, the attacker doesn't need to get back to the passwords by cracking the hashes. The attacker can just directly use the hashes.
Being targetted by these guys is like standing in the middle of a crowd of pick-pockets. No matter what you do, they are going to get stuff. You are lucky get get out with your teeth.
Miles
If you preview it using as suggested the google reader aren't you still loading that into memory?
You're loading it into Google's memory. Google is using a non-Adobe program to generate HTML.
In theory the attacker could have a Google-specific 0-day exploit that pwns Google's server (probably custom unreleased software on Linux, so VERY hard) and then ships you some evil HTML. This is damn unlikely.
I'd also be curious to know the effectiveness of these pdf attacks on linux hosts.
Linux is a bit harder to attack, especially if 64-bit. It's possible to make Linux **MUCH** harder to attack, but we haven't bothered yet.
Although not feasible for the work environment (or is it?) there are probably many users out there who now surf through virtual machines.
I think you have that backwards, but this is rare in either case. In the business environment it's possible to get site licenses, firewalls to block non-VM browsing, and even competant IT support. Note: "possible". It's very uncommon, but possible.
There is no concept of repeat business here. Any supplier who believes they can get away with it will supply a shipment of non-functional crap and pocket the single payment rather than even bother trying to set up monthly deliveries of functional goods.
Don't know about China, but I read about one guy in a similar situation in Belgrade, where at the time they sold gasoline for cars in open buckets on the side of the road. Some of the gas was high quality, and others was cheap and could ruin your car. This guy built a relationship with a 'supplier' (who was named Stevo, from Zemun), and paid him extra to make sure he always got him the high quality stuff.
Same thing in China, if you are willing to establish a good relationship with some suppliers, and make sure they get paid extra for their effort. If you aren't willing to pay extra, if you are stingy and try to wring the last cent out of your supplier, well, you get what you pay for.
Qxe4
What makes you think the US is any different? We're talking about a nation that has offshored most of its manufactoring industry for the promise of a few cheap, possibly-functional trinkets.
If the Chinese cultural mindset "believes they can get away with [supplying a single] shipment of non-functional crap" it is because this approach is working for them. I wonder who their customers are.