19: Operation Aurora

JACK: [MUSIC] In 2009 around Christmastime something terrible was lurking in the network
at Google. Google is the most popular website on the internet. It’s so popular that many people
just think Google is the internet. Google hires many of the most talented minds and
has been online since the 90s. Hacking into Google is practically impossible. There is
a team of security engineers who test and check all the configurations of the site before they go
live and Google has teams of security analysts and technicians watching the network 24/7 for attacks,
intrusions, and suspicious activity. Security plays a vital role at Google and everything has to
have the best protections but this attack slipped past all that. Hackers had found a way into the
network. They compromised numerous systems and burrowed their way deep into Google’s servers
and were trying to get data that they shouldn’t be allowed to have. Google detected this activity
and realized pretty quickly they were dealing with an attack more sophisticated than anything
they’ve ever seen. JACK (INTRO): [MUSIC]
These are true stories from the dark side of the internet. I’m Jack Rhysider.
This is Darknet Diaries. [INTRO MUSIC ENDS] JACK:
Once Google detected the attack they were able to stop it pretty quickly and clean it off the
network. On January 12th, 2010, Google made a blog post telling everyone about the attack.
They said this attack was more sophisticated than any attack they’ve seen. The virus that was
used was not detected by any antivirus software so McAfee, an antivirus company got a copy of
the malware and began studying it. [MUSIC] Hours after the announcement from Google another company
posted another announcement, this one from Adobe, the makers of Photoshop and PDF readers.
Adobe admitted that they too, got hacked over the winter holidays.
After that it was clear that even more companies were hit by this attack at the same time; Yahoo,
Rackspace, Microsoft, Juniper Networks, and Dow Chemicals to name a few.
Google had detected that over twenty companies were victim to this attack.
Some reports said as high as two hundred companies were attacked. Something big was going on.
The victim’s companies, security companies, and law enforcement all began a full investigation.
After looking through logs and analyzing the malware, researchers learned exactly how the
attack took place. When McAfee reverse-engineered the malware they found that when the hacker
executed the attack they ran it out of a folder called Aurora.
Because the attacker had their malware in that folder,
McAfee called this attacked Operation Aurora. Here’s how the hackers got in;
first they would pick their target, an employee of a company they want to attack,
even better if they can find a developer or someone with extra access to the network.
Then they would research that person, figure out what their e-mail address is,
who they talk to, and what some of those e-mails look like between the two of them.
Then they would send a phishing e-mail to the target. This isn’t some stupid looking e-mail from
the Prince of Nigeria telling you you have a large inheritance. This one is much, much more clever.
The hackers knew who that person would e-mail normally and what those e-mails would look like
so the hacker spoofed an e-mail to make it look like it came from that co-worker
and made it look like an important e-mail wanted them to click a link.
These e-mails were so well-crafted that it would be very hard for even a seasoned security expert
to detect. The victims clicked the link which takes them to a website that has malware on it.
No big deal though, because the victim has patched their internet explorer browser so [00:05:00] the
malware shouldn’t have any effectiveness but here’s where things start to get more serious.
The malware was not known by Microsoft so it was still able to exploit a fully-patched
internet explorer. It was using what’s known as a zero-day exploit. It’s called a zero-day
because that’s how many number of days that Microsoft has been aware of this exploit.
Since Microsoft wasn’t aware of it, the exploit worked.
When the victim visited the malicious website it executed some commands on the victim’s computer.
The commands that were sent to the victim’s computer downloaded a program and ran it. Here’s
where things get even more sophisticated; the program that was downloaded and ran was a Trojan
and it was a brand new, freshly-made Trojan so it bypassed any antivirus software and it was able
to infect a fully-patched version of Windows. This Trojan was very sophisticated, too. The
encryption was strong and it was stealthy. This Trojan opened up a tunnel back to the hackers
so they could control the victim’s computer. It was designed to look like regular web traffic.
All this would happen within seconds of someone clicking the link.
What makes this attack so sophisticated? Google gets attacked all day,
every day but most of the people attacking Google are using well-known exploits,
something you can learn by watching a YouTube video or reading a blog post. This attack was
using multiple exploits that weren’t known to anyone and it’s rare to see attacks that use
zero-day exploits. The hackers either had a lot of money to buy these zero-day exploits or they
had a research and development team to help them make it. The other scary part is how much research
the attackers did on their victims before sending them e-mails in the hopes they would click on it.
It appears the attackers specifically picked Christmas and New Year’s holidays to attack,
knowing that it would be a skeleton crew defending the network at that time.
These advanced methods and techniques the hackers used isn’t new. The government sees
sophisticated attacks like this fairly often. Banking industries and utility companies do too,
but commercial businesses have never seen an attack this advanced waged against them.
This would forever change the threat landscape for commercial companies.
Google looked further into the logs and tried to trace where the attacker went and what they
were trying to do. They saw the attackers were trying to access two specific pieces of data;
first was access to Gmail accounts. It’s presumed the attackers wanted to read someone’s e-mails
but not just anyone’s e-mails, specifically human rights activists’ e-mails. But not just any human
rights activists’ e-mails, they were after Chinese human rights activists’ Gmail accounts.
Whoever did this attack really wanted to see what those people were planning and organizing around
China’s human rights movement. But when Google looked more closely at these accounts they noticed
another connection. All of the accounts that were attempted to be accessed all had court orders.
United States law enforcement had requested access to those specific Gmail accounts
and these attackers were looking at those same exact accounts. This was really odd
and has baffled a lot of people as to why someone would be trying to get into Gmail
accounts of Chinese human rights activists that have already been subject to court orders.
Perhaps this was some government espionage or a way to check how much the government
can see into Gmail accounts. Google was able to stop the attackers from seeing any e-mails.
The attackers were only able to tell when the account was created.
The second piece of data the attackers were after in Google was their source code.
Google is a company that makes software and usually they don’t want anyone to see the source
code to it because that’s intellectual property. If someone had the source code they could create
a competing site or find bugs in the source code to exploit later. The source code needs to be kept
in a secure location. Source code is often kept in something like Git but for large companies
it’s stored in what’s called Software Configuration Management Systems.
Companies that make this kind of software are Perforce, Concurrent Versions Systems,
Microsoft Visual SourceSafe, and IBM Rational. At Google, their source code was kept in Perforce but
as they researched this attack they found numerous problems with Perforce. The attackers knew exactly
where the Perforce servers were and used yet another unknown bug to get into Perforce.
But that may not have mattered. After this attack McAfee looked into Perforce and found it to be
insecure by default. McAfee found the following problems in Perforce; anyone can go and create
their own user account, no need for an admin to set one up for you. The passwords are unencrypted.
It’s easy to gather data on Perforce without any privileges. All communication to Perforce is
unencrypted. It’s easy to bypass authentication altogether, it’s prone to directory traversal
attacks, and all files are stored in clear text. It’s unknown how Perforce was set up in Google but
it’s clear that it takes a lot of work to lock it down and secure it. Even then, it’s not very
secure. These attackers had a strong knowledge of Perforce and once they were in Google’s network
they were able to easily access Perforce and take some of the source code from Google, possibly the
source code for the Chrome browser. [00:10:00] The other companies that were
also compromised by this attack did not give any details as to what was taken or accessed
but it’s speculated that the source code was targeted for them, too.
Sophisticated attacks like this often work in stages so it’s possible the attackers were just
gathering information in this attack to be used for a bigger attack later.
For instance, if they had the source code for how Adobe handles PDFs they could find
new ways to create malicious PDFs so they can create new viruses to infect someone else.
Upon discovering these vulnerabilities Microsoft issued an emergency patch for the browser and
operation system. McAfee antivirus created new signatures to detect these attacks as well.
It’s interesting that so many companies were attacked with the same exploit all at once.
Once the Aurora exploit was known, companies could patch and detect it so it appears this
hacker group was attacking as many places as it could and sort of letting the exploit
become known in the process. But it also indicates that an attack at this scale would require dozens
of people to conduct it; a team to develop the exploit, a team to research the attack,
and a team to conduct the attack and remotely access those source code repositories. Further
analysis of this attack and Trojan revealed more information. The attacks were seen coming from two
different schools in China; the Shanghai Jiao Tong University and Lanxiang Vocational School.
Both of these schools are legitimate, well-established, and respectable. If you go there
you see students walking around campus and it looks like an average school. The school might not
have anything to do with this as the attackers may have just used a server within the school to wage
their attacks, but then again maybe there’s some hidden basement full of hackers and this school
is just some kind of screen. Because this was a major incident hitting dozens of US companies, the
FBI and the US government began investigating the attacks. It’s really difficult to figure out who
conducted a cyber-attack because of how anonymous and hidden you are on the internet.
A few pieces of information began to add up, though. The attackers wanted into those e-mail
accounts of Chinese human rights activists and the attack originated from two schools
in China, and the malware that was used had a checksum algorithm that’s only used in China.
Rumors started to circulate that China was likely behind this attack. As the
US government investigated, then Secretary of State Hillary Clinton addressed the media.
CLINTON: We are obviously very concerned about Google’s announcement
regarding a campaign that the company believes originated in China to collect the passwords
of Google e-mail account holders. These allegations are very serious. We take
them seriously. We’re looking into them. JACK: Some news outlets were even taking this
a step further. REPORTER: ‘Cause it’s
basically an act of war. REPORTER2: Yeah.
REPORTER: Especially if it is really tied to the army
and the government; it’s an act of war. JACK: Personally I think this is espionage, not an
act of war. This is just theft of information. A spokesperson for the Chinese foreign ministry had
a reply. [CHINESE] “Blaming China is unacceptable. The Chinese government places great importance
on the computer and internet security and controls the internet according to law and
demands that internet users respect relevant laws and regulations when using the internet.”
As Google investigated this more, it became more certain that China was behind this.
An attack with this level of sophistication hitting this many companies at once
had to be done by a group that’s very advanced.
They must have had dozens of people working on this attack. They’re well-funded and they were
given extra privileges on China’s internet infrastructure. This isn’t the work of some
amateurs or even Google competitors. This was far more advanced with far more capabilities.
To understand what happens next we need to go back five years to 2005.
In 2005 Google started building google.cn which was going to be a version of Google for people
in China. See, the people in China can’t get to many of the sites we can. The Chinese government
blocks anyone in China from getting to sites like Twitter, Facebook, Pinterest, most porn sites,
YouTube, and yes, google.com. [MUSIC] But since China is the country with the largest population
in the world, Google wanted to build a local version in China that would be allowed.
The Chinese government [00:15:00] required Google to have a license to operate in China, and they
got it. They started building their offices, hiring their top talent, and creating google.cn
but while they were building it China decided to cancel the license. Google had to spend another
eighteen months negotiating with the Chinese government to get the license to operate in China.
One of the requirements was to censor certain search results.
For instance they wanted no results if you searched for Tiananmen Square protests.
Google executives weren’t happy about all this censorship but still wanted to get in the Chinese
market so they complied with all the censorship requirements. In 2007 an agreement was made and
google.cn finally came up and online. Millions of people began using the site
but then the Olympics took place in 2008 in China. Ramping up for that,
the Chinese government started requesting even more search terms to be censored,
some that were very broad. The US executives at Google were very unhappy with this and expressed
their frustrations but eventually complied thinking this new censorship was only temporary
until the Olympics were over, but the censorship didn’t end after the Olympics ended. In fact,
China requested even more broader search terms to be censored after the Olympics.
Scary stuff too, like anything sexual in nature was banned and anything that
criticized the Chinese government or politicians was banned search terms in google.cn.
The Google executives were even more angry with this. They thought they were now helping this
country conduct their oppression and it made them dissatisfied with China.
When these attacks happened in late 2009, Google created a massive war room not only to combat
the attack technically but to determine what to do next. Sergey Brand, a co-founder of Google,
was extremely upset with China over these attacks. He specifically was upset that the
attackers tried to get into the Chinese civil rights activists’ accounts and that the Chinese
government was censoring so much from its people. Sergey reminded the executives that the motto at
Google is Don’t Be Evil and by helping China be oppressive they were, in fact, being evil.
Eric Schmidt, the Executive Chairman, did not agree. He reminded Sergey that they
always complied with local laws in any country they operate in and that’s just part of doing
business internationally. A very passionate and internal debate waged among the Google executives
for almost four months trying to determine what to do about China. Eventually Larry Page,
the other co-founder of Google, agreed with Sergey and the debate was over. Google had
decided to shut down their google.cn website and close most of their offices in China. They
redirected all their traffic to google.com.hk which is a version of Google built in Hong Kong
because Hong Kong maintains a totally separate body of government with different laws.
Now when people in China went to google.cn they were able to search for sexual content and the
Tiananmen Square protests because it was going through the Hong Kong version of Google. This was
a huge deal for Google to shut down google.cn and pull out of China. China has the most population
of any country in the world and Google is the most popular website in the world. There are
more than twice as many people on the internet in China that there are total people in the US.
Leaving a market this size will make a noticeable impact upon Google’s traffic and revenue but even
more importantly it meant that Google would quit their fight over Chinese censorship laws.
Silence fell on all Google employees who read the memo. The news of shutting down the google.cn
office was dropped at 6:00 a.m. Beijing time. Many of the Google employees in China learned
about the announcements by co-workers calling them and waking them up. Panicked employees
flooded the Google office in China with questions and concerns but management just told everyone to
leave and gave them all tickets to go see the movie Avatar which had just came out.
The next day employees came back to the Google office in China and Sergey himself
had a teleconference call with all of them to explain the situation. It didn’t go well.
Emotions were high and employees felt that they were abandoned by the generals overseas
in the middle of a war. A few months after that China blocked its people from being able to
get to all Google sites including google.cn and google.com.hk. According to the website
greatfire.org China has been blocking Google ever since. The major search engine that is
used in China is called Baidu which if you search Tiananmen Square protests in there,
you see stories about how the protests are a myth and didn’t happen. Ever since Operation Aurora,
Google and many others have had to step up their defenses, knowing that more sophisticated attacks
can hit even commercial companies. This attack forever changed how we see our adversaries
when defending commercial networks. [00:20:00] Security researchers at Symantec, Del
Secure Works, and CrowdStrike dove further into Operation Aurora to try to understand the group
behind these attacks. When Symantec investigated the malware further they found the code frequently
used a variable with the name Elderwood so they called this hacking group Elderwood. CrowdStrike
came up with a different name which was Sneaky Panda and Del called them the Beijing Group. I
like Elderwood the most, so let’s stick with that one. Security researchers created a big list of
everything that’s known about Operation Aurora and started building a dossier on the Elderwood group.
For years after the attack researchers would examine other big hacks and breaches to try to
find if there’s any connection with the Elderwood hacking group. Some connections were made;
either the same Trojan was used, or the same command and control servers were used,
or comments in the code were similar. In the three years after Operation Aurora
the Elderwood group was suspected to be behind seven different attack campaigns.
[MUSIC] Each campaign resulted in numerous companies being hacked. The next attack
they conducted after Operation Aurora contained a zero-day exploit using Adobe Flash. This is really
interesting because during Operation Aurora they hacked into Adobe so we can speculate that maybe
they did take the source code for Flash from Adobe and used it to build new exploits, because if you
have the source code it’s much easier to find a vulnerability. In fact, they had five different
zero-day exploits for Adobe Flash and were able to breach many companies using these exploits.
This group had immense capabilities. They seemed to be growing more powerful over time,
stealing more source code from places like Google, Adobe, Oracle, and Microsoft and building more
zero-day exploits with them. It seemed like the Elderwood hacking group had endless amounts
of zero-day exploits it can use. Hacking using zero-day exploits is not actually that common.
In 2011 there were only eight reported breaches that used a zero-day exploit in the attack,
but four of those exploits was from the Elderwood group so you can see how this group was dominating
the hacker scene. What else is strange about the Elderwood group is that they have this uncanny
ability to know when their zero-day exploits is about to be discovered or fixed. When they
get wind that it’s going to be patched they burn their zero-day by trying to hack as many places as
they can all at once to get the most of it. They may have access to an internal bug-tracking
tool within Google or Microsoft or Adobe and they may have someone inside tipping them off.
After Operation Aurora the Elderwood group changed their initial entry tactics. Instead of getting
people to click the phishing e-mail they used what’s known as a watering-hole attack. This
would hack into a popular website, put malware on it, and wait for users to visit the site to become
infected. As soon as the victim’s computer would be infected, the hacking group would have full
access to that computer. They also changed their targets. While attacking Microsoft, Google, and
Adobe will help them find new exploits, it doesn’t look like that’s their primary objective.
They seem to be mostly interested in gaining access to defense companies,
companies like Lockheed Martin, Raytheon, Boeing, and General Dynamics to name a few.
These companies supply tanks, weapons, and planes to the US military. They presumably want access to
these companies to gain information on the latest weapons and military technology, maybe also get
a glimpse as to what the military has in stock. This would certainly be valuable information for
a super power like China. But the Elderwood group doesn’t attack these companies directly. Instead
they’re almost always seen hacking into suppliers and third party companies that deal directly with
the top-tier defense companies. They’re also seen hacking into the suppliers of suppliers because if
they can infect the supply chain and that software gets into the defense company, then it’s just as
good as hacking into the defense company. It’s easier and sneakier because those third party
companies don’t have nearly the security defenses as a top-tier defense contractor. Elderwood would
possibly study all the parts that are used in a specific weapon or tank and figure out
which companies supply those parts or software and figure out which websites those companies visit to
do their work. One website they infected was the Center for Defense Information in Washington, DC.
This is a non-profit organization that posts information on military matters.
People who visit this site are likely to be military or those working in the defense industry.
Even if it’s a third party to a contractor, infecting them can be very valuable.
From there you can implant malware into software and that can make its way into bigger companies.
Details aren’t given as to what companies were specifically hit by Elderwood.
Symantec doesn’t release that information and those companies that are breached
aren’t always required to publically disclose it so all we can tell from
Symantec is the way the attacks happened and what types of companies were targeted.
The second-biggest target for the Elderwood hacking group are human rights organizations.
It’s suspected that the same group that did Operation Aurora in 2010 were also responsible
for placing zero-day Flash exploits on the website for Amnesty International Hong Kong.
Users have visited that site, have become infected, and this group could then access
their computers to see anything they wanted to see on that computer. Other sites that had zero-day
exploits on them were International Institute for Counter-Terrorism and The Cambodian Institute of
Foreign Affairs. Users who visited those websites in May of 2012 had a high likelihood of being
infected and having their systems controlled by the Elderwood group. [00:25:00] Some researchers
believe that there must be hundreds if not thousands of people working for this group.
There would be a team of developers to comb through the stolen source code to
develop exploits, then there’s a team to gather information on the targets and do open-source
intelligence gathering, then there’s a team that puts together the attacks and plans a way to get
into places, then there’s a team to conduct the attack and sit there waiting for the infected
machines to show up. Then there are people talented at knowing certain software to be
able to grab the data they need and navigate around. Then there’s a team of analysts to
make sense of the data once it’s stolen, then there must also be interpreters and spies and
website developers and instructors and labs and commanders. The Elderwood group is well-funded,
highly trained, and very advanced. A group like this doesn’t just show up overnight.
I suspect they probably have been working together for years, if not decades before being discovered
like this. But still, we can only guess as to who they are based on the footprints they leave.
Research papers have been published outlining the tactics, techniques, and procedures of the
Elderwood group. Since then it appears they’ve changed their tactics to avoid being connected.
Some researchers also believe they’ve broken up into smaller groups specifically designed
for certain attacks such as spying on people or hacking into certain sectors. The hacking activity
we continue to see from China today remains to be one of the most advanced, persistent threats.
In 2015, US President Barack Obama and Chinese President Xi Jinping
met to discuss cyber-attack diplomacy. They had dinner together and came to an agreement.
The two presidents stood side-by-side on the White House lawn
to explain what they agreed on. OBAMA: I raised, once again, our very
serious concerns about growing cyber threats to American companies and American citizens.
I indicated that it has to stop. The United States government does not engage in cyber
economic espionage for commercial gain and today I can announce that our two countries have reached
a common understanding on the way forward. We’ve agreed that neither the US or the Chinese
government will conduct or knowingly support cyber-enabled theft of intellectual property
including trade secrets or other confidential business information for commercial advantage.
In addition we’ll work together and with other nations to promote international rules of the road
for appropriate conduct in cyber space. JACK: If I can break character for a second here;
this is what I love about having a career in InfoSec. I can turn on the nightly news and
sometimes see the president talking my lingo. It’s just amazing to see what I’m passionate
about being talked about on the world stage like this. It’s awesome. Anyway, this agreement was
likely a direct result from the project Aurora attacks. Then again in 2017, US President Donald
Trump and the Chinese President Xi Jinping met at Mar-a-Lago and renewed the same truce that neither
country would attack commercial sectors to steal intellectual property for commercial gain.
Personally I don’t think this truce has much value as both countries continue to do what they can to
gather details from each other. Hacking into commercial companies to steal source code to
develop new vulnerabilities is simply a part of that process. For instance China is suspect to be
behind the virus found in CCleaner, a popular Windows clean-up tool, which that attack got
them access to data at Microsoft and Google. China denied its involvement but even if it
did admit to it they could just say that the data stolen wasn’t used for commercial gain.
This agreement between the two is just weak and unenforceable. Now that we know the
Elderwood hacking group is capable of targeting commercial sectors now, companies should take this
as a cautionary tale, especially companies that supply to defense contractors.
If this attacking group knows that a defense company uses your product
they might try hacking you to get into the defense company because it’s easier and sneakier.
By taking on a defense company as a client it significantly increases your threat landscape.
This is the modern-day arms race. Foreign countries will continuously be trying to hack
into our government and defense companies to gather as much information as they can.
At the same time our government is trying to gather information about foreign governments
by hacking them as well. This makes it difficult to understand governments.
If the NSA finds a bug in Microsoft they might not tell Microsoft but instead they’ll keep it
to themselves and potentially use it in a cyber-attack because they want to be one
step ahead of the enemy. We’re seeing the US and foreign governments are keeping zero-day exploits
just for themselves. Governments hacking into other governments or companies in other countries
is now the new normal. Spyware vs. spyware, ghosts in the wire, cyber-patriots. This is the current
battlefront that is secret and hidden from all of us until something goes wrong or gets sloppy
or until someone wants us to see something. JACK (OUTRO): [OUTRO MUSIC]
You’ve been listening to Darknet Diaries. This episode is made by me,
Jack Rhysider, with theme music [00:30:00] from the mysterious Breakmaster Cylinder.
Okay, so a lot of you want more episodes of this show and I’ll make a deal with you.
I’ll go back to producing two episodes a month if you can help me reach 3,000 followers on Facebook.
Deal? Okay, if you’re in go to facebook.com/darknetdiaries
and follow the page. Tell your friends to follow it too. I also posted a preview of
the next episode on Facebook for you to check out right now so come on, let’s go do this.