Slashdot Mirror
Group Behind 'Aurora' Attack on Google Still Active
New submitter trokez writes "Symantec has monitored the activities of a group using a specific trojan (Hydraq/Aurora) since 2009. The particular group has been connected (by Symantec) to the attack on Gmail in China, but also other high-profile attacks. 'These attackers have used a large number of zero-day exploits against not just the intended target organization, but also on the supply chain manufacturers that service the company in their cross hairs. These attackers are systematic and re-use components of an infrastructure we have termed the "Elderwood Platform." The term "Elderwood" comes from the exploit communication used in some of the attacks. This attack platform enables them to quickly deploy zero-day exploits.' The attacks seems to focus on industry espionage, with the defense industry and its suppliers at the focus."
...who hacked the gibson?
Mysteriously, the attackers left the symbol for lucky dragon behind in all the systems they compromised.
that hacked into Symantec and couldn't be booted out?
I got to the chocolate box before you, that's why the hard ones have teeth marks.
Yea, we saw this with the RSA hack, basically it's going up the supply chain to exploit suppliers of big companies/the government. In the RSA hack they actually made it look like it was coming from an RSA supplier, and spoofed an email with the THIRD version of an excel spreadsheet that contained a zero day exploit. The Chinese, they're good at this.
Yes; let's rely on the same folks that can reduce any computer to a glacial, zombified, disk-grinding nightmare.
Sleep tight.
The attackers also left a coupon for a complimentary egg roll, good until the end of the month.
All well and good. The good folk at Symantec, a site that definitely caters to an audience of people who would be interested in this particular exploit, then goes on to link to their research paper:
That's right. The link to the research paper is, presumably by order of some marketroid who wants to get some metrics about this high-profile story (or are they?) is a goddamn bit.ly link redirector that goes directly to a PDF, and can be expected to spawn precisely one of the sorts of vectors that the attackers have been exploiting for years.
Peter Norton is still alive, but if he weren't, he'd be rolling in his grave. As it stands, he's merely rolling in a big pile of money.
"The PDF file attached to the email exploits the Adobe Reader 'CoolType.dll' TTF Font Remote Code Execution Vulnerability (BID 43057). It uses a technique known as return-oriented programming (ROP) to bypass Data Execution Prevention (DEP), using code in the icucnv36.dll module."
AccountKiller
"All your bases are belong to us." - It finally came true.
Naming a particular exploit instead of assigning it a number like ExTrojA.1234 is like trying to name a particular day for something. Like having all the days of the year with names like "Hot air balloon to work day", "Stop light appreciation day", or "Mother's muffins day". We are already doing this and the attack against Google was bigger but attacks like this are occurring on a daily basis. BTW was the term "Elderwood platform" a poor Chinese translation that was translated back to mean the "Microsoft Windows platform"?
Society use your Sciences
Let's just hope they don't steal the secrets to milliliter wave scanners!
Nobody would be safe if terrorists had such power under their control!