Posts Tagged ‘Operation Aurora’

Who is Afraid of State-Sponsored Attacks?

October 10, 2012 Leave a comment

Last week, for the second time since June, Google warned his Gmail users of possible state-sponsored attacks. According to Mike Wiacek, a manager on Google’s information security team, Google started to alert users to state-sponsored attacks three months ago. Meanwhile the security team has gathered new intelligence about attack methods and the groups deploying them, and that information was used to warn “tens of thousands of new users”, possible targets of the attack.

Apparently this increase in state-sponsored activity comes from the Middle East, although no particular countries have been explicitly quoted.

This is not the first time that Gmail is the target of alleged state-sponsored attacks, unfortunately the secrets hidden inside the mailboxes have proven to be a too tempting target for states without scruples.

June 5, 2012: Eric Grosse, Google VP Security Engineering issues a Security warnings for suspected state-sponsored attacks.The warning seems more a preventive measure than the result of a true campaign.

September 8, 2011: As consequence of the infamous Diginotar Breach by the so-called Comodo Hacker, Google advises its users in Iran to change their Gmail passwords, and check that their Google accounts have not been compromised. Several Iranian users who may have been hit by a man-in-the-middle attack are contacted directly.

June 1, 2011: In an unusual blog post, Google declares to have discovered and alerted hundreds of people victims of a targeted “phishing” scam originating from Jinan, the capital of Shandong province. Hackers aimed to get complete control of the personal Gmail accounts of hundreds of users including, among others, senior U.S. government officials, Chinese political activists, officials in several Asian countries (predominantly South Korea), military personnel and journalists. Google does not rule out the possibility of the attack being state-sponsored, although China firmly denies Gmail hacking accusations.

January 13, 2010: In a blog post, Google discloses the details of the infamous Operation Aurora. A highly sophisticated and targeted attack on its corporate infrastructure originating from China that resulted in the theft of intellectual property from Google. At least twenty other large companies from a wide range of businesses have been targeted, but the primary goal of the attackers was accessing the Gmail accounts of Chinese human rights activists (only two Gmail accounts appear to have been accessed with limited damage). As part of the investigation (but independent of the attack on Google), it turns out that the accounts of dozens of U.S.-, China- and Europe-based Gmail users, advocates of human rights in China, appear to have been routinely accessed via phishing scams or malware placed on the users’ computers.

State-Sponsored attacks or not, setting a complex password and enabling 2-step verification are two effective countermeasures to mitigate the risk.

An Advanced Anti-Malware solution can be really effecive as well, such as Lastline. It is not a coincidence that Wepawet, based on our technology, was the first to detect the Internet Explorer “Aurora” Memory Corruption exploit behind the state-sponsored Operation Aurora.

Web Based Threats and False Positives

September 29, 2012 Leave a comment

In the last few days I have received a couple of advises regarding the fact that some URL filter engines flagged several pages of my blog as malicious. One page in particular appears to have been inserted inside the category of Malicious sites.

Unfortunately so far I have not been able to identify the URL Filter technology that has categorized that page as malicious and. Of course, I would greatly appreciate if someone who encountered the same problem could be so kind to provide me some additional details. In any case I believe that the semantics of the site (probably full of long links and terms as “malware”, “hacking”, and so on) has tricked the content filter engine (why apparently just that specific page has been affected, is something I cannot explain right now).

In any case I want to give you a couple of useful suggestions to handle similar occurrences and to make reasonably sure that a web page does not hide web based exploits.

If you have any doubt about the content of a page or a link received inside a suspicious email message, I suggest you, before clicking, to submit it to Wepawet, a cloud-based service for detecting and analyzing web-based threats (iFrame injections, Drive-by, etc.) embedded in Flash objects, JavaScript code, and PDF files. You will probaly remember Wepawet because it was able to discover the (since then unknown) 0-day vulnerability behind Operation Aurora.

If you have similar doubts for unknown binaries, you can analogously submit them to Anubis (Analyzing Unknown Binaries), a cloud-based service with a sandbox for analyzing malware, which provides a complete and detailed report about malware activity (it executes the binary on-the-fly hence does not need a-priori knowledge). Anubis may also check if a certain URL is the vector for a possible drive-by download or similar attack, by showing the Activity of the page inside Internet Explorer.

Android APKs may be also submitted to its variant Andrubis, which runs them inside an Android sandbox providing a detailed report (the icon is really pretty cool isn’t it?).

All the above services are free for internal use and have been brought to the next level by Lastline, Inc., my current company, which has developed a commercial version of the same technologies in its advanced malware detection and mitigation solution.

Of course I checked the incriminated page of my blog with Wepawet, and I did not find any web-based exploit… At least so far… Meanwhile, if you encounter the same issue on one of my blog pages, I would greatly appreciate if you could notify me.

After latest F-35 hack, Lockheed Martin, BAE Systems, Elbit under multiple cyber attacks….right now.

March 14, 2012 2 comments

Cross Posted from TheAviationist.

I have just published a timeline covering the main Cyber Attacks targeting Military Industry and Aviation, but it looks like the latest events will force me to post an update, soon.

Although perpetrated with very different timelines, origins and motivations behind them, the last three days have seen a new wave of attacks against military industry that has unexpectedly become the point of intersection between cybercrime and cyberwar.

The first clamorous attack was disclosed a couple of days ago, when the Sunday Times revealed that alleged Chinese Hackers were able to penetrate into computers belonging to BAE Systems, Britain’s biggest defence company, and to steal details about the design, performance and electronic systems of the West’s latest fighter jet, the costly F-35 Joint Strike Fighter. The hacking attack has raised concerns that the fighter jet’s advanced radar capabilities could have been compromised and comes few weeks after papers about the future British-French drone were stolen in Paris.

Apparently, once again, an APT-based attack, or maybe one of its precursors, since it was first uncovered nearly three years ago. In any case, according to the sources and the little information available, it lasted continuously for 18 months, exploiting vulnerabilities in BAE’s computer defences to steal vast amounts of data. A fingerprint analogous to other similar cyber operations, allegedly generated from China such as Operation Aurora or the controversial operation Shady RAT.

Details of the attack have been a secret within Britain’s intelligence community until they were disclosed by a senior BAE executive during a private dinner in London for cyber security experts late last year.

Curiously the F-35 seems to be a very attracting prey for hackers as it was already the victim of a Cyber Attack in 2009; once again the latest attack is believed to be originated from China, who is showing a restless cyber activity.

Although completely different for impact and motivations, a second attack has just been announced by the infamous hacking collective Anonymous, which, in name of the #OpFreePalestine operation, has published the contact details for senior staff at BAE (hit once again), Lockheed, Gulfstream Aerospace, a division of General Dynamics, and the United States Division Of Israeli Owned Arms Company Elbit Systems. An attempt to embarrass military industry considered involved in the events happening in Palestine.

Although the data dumps apparently contain little valuable information (according to many of the telephone numbers listed are for company headquarters, while several of the names appear to be out of date), the latest attacks represent a quantum leap in the Middle East Cyber War, after the “reign of terror” threatened by Anonymous against Israel.

The F-35 JSF is not only the most advanced stealthy fighter plane of the next future. It is also the most expensive. That’s why some partners have been compelled to downsize their initial requirements because of cuts imposed by the increasing unit price (with the new contract the total unit cost for an LRIP 5 jet is 205.3 million USD!!).

Apparently these cuts are interesting even the IT Security budgets of the manufacturers.

If you want to have an idea of how fragile our data are inside the cyberspace, have a look at the timelines of the main Cyber Attacks in 2011 and 2012 (regularly updated) at And follow the author of this article @pausparrows on Twitter for the latest updates.

The China Cyber Attacks Syndrome

November 11, 2011 5 comments

A week ago, the Office of the National Counterintelligence Executive published a report to Congress concerning the use of cyber espionage to attempt to gain business and industrial secrets from US companies. Easily predictable, the results present a frightening picture!

With no surprise it turned out that the biggest dangers and perpetrators of cyber-espionage operations against American business are China and Russia.

  • Chinese actors are the world’s most active and persistent perpetrators of economic espionage. US private sector firms and cybersecurity specialists have reported an onslaught of computer network intrusions that have originated in China, but the Intelligence Community cannot confirm who was responsible.
  • Russia’s intelligence services are conducting a range of activities to collect economic information and technology from US targets.
  • Some US allies and partners use their broad access to US institutions to acquire sensitive US economic and technology information, primarily through aggressive elicitation and other human intelligence tactics. Some of these states have advanced cyber capabilities.

Unfortunately the predictions for the near future are not encouraging: the authors of the report judge that the governments of China and Russia will remain aggressive and capable collectors of sensitive US economic information and technologies, particularly in cyberspace.

This is mainly due to three factors: a technological shift with a growing number of devices connected to the Internet (according to a Cisco Systems study, the number of devices connected to the Internet is expected to increase from about 12.5 billion in 2010 to 25 billion in 2015). An economical shift driven by the Cloud Paradigm which requires the information to be ubiquitous and always available and, last but not least, a cultural shift which bring users to a growing use of social media for personal and professional use with a dangerous overlapping.

With these considerations in mind I decided to concentrate on a single table all the attacks with cyber espionage implications reported in 2011 for which China was directly or indirectly (or allegedly) considered responsible. The details (and links) of each single attack can be found on my 2011 Cyber Attacks Timeline Master Index (of course the list does not include the infamous Operation Aurora and the attack to G20 during the French Leadership since these events occurred during 2010).

U.S., Canada, Japan and Korea are among the countries hit by the Cyber Attacks from Far East. The most known attack is for sure the one perpetrated against RSA, whose wake affected several U.S. Contractors. Moreover the same attack was not an isolated episode, but the tip of an iceberg hiding 760 affected organizations worldwide.

Shady Rat and the IMF attack were other noticeable events as also the breach reported against the Cyworld the Korean Social Networks in which 37 million users were affected.

A frightening scenario that also generated some resounding fake attacks during 2011 (do you remember the Renault affair?)

A new cold (cyber)war at the gates?

Five Years of Hacking (Updated)

August 3, 2011 8 comments

Strange Days for Information Security, you may watch my July 2011 Attacks Chart for noticing how troubled July has been. August promises to be even worse, but this is not the point…

The point is that in an Interview to Vanity Fair, which is not tipically an Information Security Magazine, Dmitri Alperovitch, Vice President of threat research at McAfee reported that, for at least five years, a high-level hacking campaign, dubbed Operation Shady RAT (like Remote Access Tool), has infiltrated the computer systems of national governments, global corporations, nonprofits, and other organizations. This infiltration has made more than 70 victims in 14 countries for what has been defined “Biggest-ever series of cyber attacks uncovered”, an attack so big that, according to Alperovitch: “It’s been really hard to watch the news of this Anonymous and LulzSec stuff, because most of what they do, defacing Web sites and running denial-of-service attacks, is not serious. It’s really just nuisance.”

Victims included government agencies in the United States, Taiwan, South Korea, Vietnam, and Canada, the Olympic committees in three countries, and the International Olympic Committee. Rounding out the list of countries where Shady rat hacked into computer networks: Japan, Switzerland, the United Kingdom, Indonesia, Denmark, Singapore, Hong Kong, Germany, and India. The vast majority of victims—49—were U.S.-based companies, government agencies, and nonprofits. The category most heavily targeted was defense contractors—13 in all.

Courtesy Of McAfee

In addition to the International Olympic Committee, the only other victims that McAfee has publicly named are the World Anti-doping Agency, the United Nations, and ASEAN, the Association of Southeast Asian Nations (whose members are Indonesia, Malaysia, the Philippines, Singapore, Thailand, Brunei, Burma, Cambodia, Laos, and Vietnam).

All the signs of the attack point to China. If confirmed this would be the third attack discovered by McAfee originating from China, after Operation Aurora and the Night Dragon.

One thing is clear: if Vanity Fair is dealing with Information Security, there is really something strange. At least let us hope this is not the sign Information Security is simply becoming a matter of fasion.

Meanwhile, after the Vanity Fair preview, McAfee has released its report on Shady RAT. McAfee was able to gain access to one specific Command & Control server used by the intruders, collecting logs that reveal the full extent of the victim population since mid-2006 when the log collection began. The results are described inside the documents and Curiously China, which was reported by the press as the alleged author of the attack, is never expressely quoted.

Courtesy Of McAfee

Interesting to say, this report raised several doubts on McAfee Competitors. As an example, Sophos, on a dedicated post, considers that there’s nothing particularly surprising in McAfee’s report since companies get often targeted by hackers, who install malware to gain remote access to their computers and data, sometimes driven by motivations for hacking which extend beyond purely financial (for instance, IP theft, economic, political, etc motivations).

Moreover, Sophos wonders why McAfee did not disclose what kind of information was stolen from the targeted organisations, and how many computers at each business were affected.

In any case I noticed with pleasure that, like I did, Sophos was also surprised from the fact the preview was first released on Vanity Fair…

Mobile Warfare… Certified…

March 30, 2011 3 comments

In this post I explained that, what I called the mobile warfare (that is social protest driven by mobile technologies and social networks), is rapidly spreading all over the Middle East, apparently with a systematic time scale (so far events in Tunisia, Egypt and Libya have been separated by approximately a month).

Many observers claim that, in the shorter term, Syria and Bahrain could be the next targets of internal protests (last week 150 people were killed in Syria and today the government led by PM Naji Otri has resigned, apparently a quantum shift).

But the wave coming from Maghreb, led by the mobile warfare, seems unstoppable and in the longer term, also Iran and Iraq, the main barriers of fundamentalism, could be affected as well.

Of course, one of the most exciting things of Infosec, is the fact that the reality is always one step ahead of the imagination. As a matter of fact I tried to imagine different ways in which bad guys from totalitarian regimes could prevent mobile technologies and social networks from achieving their scope to encourage citizens to join the protests, including DDoS, Internet connectivity disruption and so on… I could not imagine, however, that one could think to issue rogue certificates for some high profile websites used for email and chat in order, maybe, to intercept cumbersome and subversive communications.

That is exactly what happened with the Comodo Affaire in which some fraudulent certificates were issued by the Comodo Certificate Authority, exploiting a vulnerability of a couple of Italian affiliates (sigh!) and allowing to issue a legitimate signed certificate on behalf of any requesting entity. This vulnerability was used in order to issue rogue Certificate Signing Request (CSR), that is false request to obtain legitimate SSL certificates for the following web sites:


For those of you, who are not too much practical with Public Key infrastructure and Cryptography, this means that, in simple words, once obtained a rogue certificate one may build a false web site (for instance a false website) to capture precious information normally “traveling” on the web encrypted, for instance username and password of private email. This is called a man-in-the-middle attack.

Since it was discovered that the rogue Certificate Signing Request originated from an ISP located in Iran, an alleged political origin for the attack was proposed, motivating it with the attempt of the Iranian government (enforced by a Cyber Army), to intercept communications and more in general emails and chats belonging to political leaders not “too close” to the positions of Mr. Mahmoud Ahmadinejad (mmhh.. at least for the alleged purpose, to me it reminds Operation Aurora, doesn’t it?)

Now, it looks like that a lonely ranger Iranian hacker, not belonging to any army, claimed the to be the only author of hack (at this link the complete history and a detailed analysis of the event). Probably a real Iranian involvement will not ever been confirmed, but to me, the doubt that this action was planned to stop the mobile warfare remains intact. Otherwise I would not be able to understand why only certificates related to secure communication methods were affected, often used by dissidents to organize protests and share news with the world.

Report Symantec Q4 2010: Fate Presto… Prima che la sicurezza SCADA!

February 16, 2011 1 comment

Symantec è particolarmente attiva in questo scorcio del 2011, così, dopo la pubblicazione del Dossier Stuxnet aggiornato, ha appena rivelato alla comunità di sicurezza il Symantec Intelligence Quarterly Report: October – December, 2010 che è interessante analizzare, notando, come questo si discosti notevolmente dall’analogo report recentemente pubblicato dalla livrea rossa di McAfee, principale concorrente del produttore di sicurezza di Cupertino.

Il titolo del report è tutto un programma: “Targeted Attacks on Critical Infrastructures” e riassume quelle che sono state le caratteristiche, dal punto di vista della sicurezza, di questo fine 2010: i cybercriminali si sono concentrati sulla creazione di malware targeted (ovvero ritagliato su misura) per danneggiare infrastrutture critiche.

Gli attacchi cosiddetti targeted sono perpetrati verso una specifica organizzazione o una specifica categoria di utenti e per questo sono notevolmente pericolosi ed efficaci, anche se usano tecniche tradizionali come phishing o link malevoli, essendo ritagliati su misura per l’infrastruttura obiettivo o anche per le abitudini o caratteristiche comportamentali degli utenti.

Attacchi di questo tipo, definiti anche Advanced Persistent Threat, trovano purtroppo una vasta gamma di applicazioni che spaziano dal furto di dati confidenziali finalizzato al profitto (ad esempo la sottrazione di credenziali bancarie), sino all’interferenza con le operazioni , se non in un vero e proprio sabotaggio dell’infrastruttura obiettivo. In molti casi, come ci ha dimostrato il 2011 (ed in particolare il mai troppo abusato Stuxnet) per ottenere lo scopo è sufficiente infettare un solo host (il famigerato paziente 0) per poi utilizzarlo come ponte involontario e catalizzatore per l’ondata di attacchi successiva.

E quindi cosa è accaduto nel 2010? La risposta è relativamente semplice, come dimostrato dal Trojan Hydraq (aka Operation Aurora secondo la nomenclatura adottata dal concorrente McAfee): una volta scoperte le potenzialità dei targeted attack i Cyber-criminali ne hanno utilizzato l’energia distruttiva verso le Infrastrutture Critiche.

A sostegno di questa tesi, il documento cita appunto i casi di Hydraq e Stuxnet. Il primo è inizialmente nato come un targeted attack facente leva su una Vulnerabilità del browser di casa Microsoft (advisory number 979352) con lo scopo finale di sottrarre informazioni alla vittima ed inviarle ad un server di comando e controllo. Questo attacco, che ha caratterizzato l’inizio del 2010 si è da subito tinto di giallo, non tanto per il mistero, quanto per i sospetti che sia stata proprio la Cina ad utilizzarlo con lo scopo di rubare credenziali di dissidenti dagli Account di Google.

Del secondo sappiamo tutto, addirittura Stuxnet era talmente targeted e così interconnesso con l’infrastruttura vittima, a tal punto che, secondo i ricercatori Symantec, sono passate solo 12 ore dalla prima compilazione alla prima infezione.

Curiosamente (ma fino a un certo punto) il report Symantec non cita Night Dragon, il malware scoperto dal concorrente McAfee che a mio avviso incarna meglio di chiunque altro, nel corso dell’ultimo trimestre 2010, il concetto del targeted attack rivolto a specifiche facility (questa volta un malware con il vizio del petrolchimico) e soprattutto facente uso di metodi tradizionali (SQL Injection e soprattutto download di malware tramite tecniche di Spearphishing) al fine di penetrare le barriere iniziali di protezione ed addentrarsi intimanente all’interno della rete verso le casseforti virtuali dove sono custoditi i segreti tecnici ed economici dell’organizzazione.

Gli attacchi di tipo targeted si fanno particolarmente pericolosi quando, come nel caso di Stuxnet. incrociano il mondo SCADA (Supervisory Control and Data Acquisition), ovvero quei processi e tecnologie che sottendono al monitoraggio e controllo delle Infrastrutture Critiche e dell’Industria, e che proprio per questo motivo, soprattutto in un momento turbolento come quello che stiamo vivendo, potrebbero essere al centro dell’attenzione di paesi nemici o singoli individui guidati da motivazioni ideologiche e politiche.

La pericolosità di SCADA non è nuova (si legga ad esempio questo articolo della stessa Symantec risalente al 2006), tuttavia nel 2010, è assurta alla ribalta grazie a Stuxnet e agli eventi successivi. Solo nell’ultimo trimestre dell’anno passato Symantec ha documentato 10 vulnerabilità pubbliche di SCADA, sulle 15 totali scoperte nel corso dell’anno. Ma non facciamoci troppe illusioni… Anche se numericamente esigue a causa della natura elitaria delle ricerche di sicurezza su questa tecnologia,  l’impatto di queste vulnerabilità è immane e un malintenzionato che volesse sfruttarle saprebbe bene come rendere il proprio attacco targeted per i punti deboli di SCADA, tra i quali Symantec ha annoverato nel 2010:

  • Tre vulnerabilità nell’interfaccia Web CGI dei prodotti Intellicom Netbiter webSCADA WS100 e WS200. Le vulnerabilità rilevate non sono di poco conto poiché consentono di caricare ed eseguire codice arbitrario ed accedere di conseguenza ad informazioni potenzialmente sensibili;
  • Una vulnerabilità di tipo SQL-injection all’interno della pagina di login del sistema SCADA Industrial Technology System (ITS). La vulnerabilità in oggetto consente di compromettere l’applicazione modificando la struttura del database sottostante;
  • Tre vulnerabilità di tipo buffer-overflow per il server DATAC RealWin SCADA. Grazie a questo insperato aiuto un attaccante è in grado di eseguire codice sul server;
  • Ulteriori tre vulnerabilità sono state scoperte nel prodotto Ecava IntegraXor, di cui due di tipo remote code-execution e una terza di tipo directory-traversal. “Ambetre” le vulnerabilità di questo prodotto possono essere utilizzate da un malintenzionato per eseguire codice arbitrario o accedere a informazioni sensibili ivi contenute.

Purtroppo la situazione è ulteriormente complicata dal fatto che una architettura SCADA non deve fare i conti con le sole proprie vulnerabilità intrinseche ma è costretta a portarsi dietro anche il pesante fardello delle vulnerabilità ereditate dai sistemi operativi ospitanti (sovente Microsoft) o dal middleware e database utilizzato per l’applicazione SCADA.

L’applicazione pratica di una vulnerabilità SCADA in una infrastrutture critica è presto detta, ed il caso di Stuxnet ne è emblematico: i sistemi di controllo industriale (di cui SCADA costituisce un esempio) sono utilizzati all’interno delle infrastrutture critiche per controllare i processi operativi quotidiani. In particolare sono essenziali per controllare e processare le informazioni inviate dai sensori ed attuare di conseguenza le necessarie azioni e comandi di risposta. A questo compito si aggiungono il monitoraggio degli ambienti operativi per verificare che le attività vengono sempre effettuate all’interno dei parametri di sicurezza (sono quindi in grado di prevenire condizioni pericolose per l’uomo quali: surriscaldamento, aumento dei livelli di tossicità, incendi o potenziali sovraccarichi).

Un sistema di controllo compromesso da un malware potrebbe non essere in grado di riconoscere le condizioni di pericolosità o anche di non contrastarle efficacemente, se non addirittura di sabotare deliberatamente e in maniera subdola l’infrastruttura come nel caso di Stuxnet. Le conseguenze potrebbero essere disastrose e portare ad eventi come quello (involontario) della città di Lake Havasu rimasta a secco per un guasto nel sistema di monitoraggio delle pompe d’acqua (Luglio 2010).

E quindi?

E quindi Symantec suggerisce di limitare l’esposizione delle reti che ospitano sistemi SCADA, possibilmente  isolandole dal resto del Globo. Nel caso in cui ciò non fosse possibile, il traffico verso il mondo esterno andrebbe limitato ai soli protocolli richiesti non disdegnando di proteggere ulteriormente gli accessi individuali mediante VPN IPSec autenticate ed eventualmente integrando la difesa con tecnologie di protezione di tipo endpoint sui sistemi operativi ospitanti (che comunque andrebbero sempre aggiornate) e con sistemi di Intrusion Detection & Prevention per le minacce di rete.

Dal punto di vista infrastrutturale la sicurezza di una infrastruttura SCADA è ulteriormente minata dal fatto che spesso, a causa della complessità, non è possibile creare un ambiente di test. Inoltre le interruzioni di servizio andrebbero limitate al minimo indispensabile poiché spesso sono costose se non addirittura distruttive. Suggeriti invece i test che possono essere fatti in linea, senza interrompere l’operatività quali passive asset discovery e vulnerability scanning, mentre tutte le operazioni di aggiornamento (Antivirus e pezze patch di sistema operativo) dovrebbero essere effettuate con la massima cura e con il massimo supporto dei produttori dei sistemi di controllo per minimizzare rischi e tempi di down.

Last But Not Least, non trascurare le attività di audit e policy compliance…


Get every new post delivered to your Inbox.

Join 3,710 other followers