Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Group Behind 'Aurora' Attack on Google Still Active

Soulskill posted more than 2 years ago | from the three-years-of-experience-will-get-you-a-good-entry-level-gig dept.

Security 21

New submitter trokez writes "Symantec has monitored the activities of a group using a specific trojan (Hydraq/Aurora) since 2009. The particular group has been connected (by Symantec) to the attack on Gmail in China, but also other high-profile attacks. 'These attackers have used a large number of zero-day exploits against not just the intended target organization, but also on the supply chain manufacturers that service the company in their cross hairs. These attackers are systematic and re-use components of an infrastructure we have termed the "Elderwood Platform." The term "Elderwood" comes from the exploit communication used in some of the attacks. This attack platform enables them to quickly deploy zero-day exploits.' The attacks seems to focus on industry espionage, with the defense industry and its suppliers at the focus."

Sorry! There are no comments related to the filter you selected.

Are these the dudes... (1, Funny)

Anonymous Coward | more than 2 years ago | (#41267515)

...who hacked the gibson?

Re:Are these the dudes... (2)

farrellj (563) | more than 2 years ago | (#41268147)

+1 for obscure "Hackers" Movie reference.

Strange Symbol (2)

puddingebola (2036796) | more than 2 years ago | (#41267597)

Mysteriously, the attackers left the symbol for lucky dragon behind in all the systems they compromised.

Are these the guys (2)

ozduo (2043408) | more than 2 years ago | (#41267753)

that hacked into Symantec and couldn't be booted out?

Re:Are these the guys (0)

Anonymous Coward | more than 2 years ago | (#41268947)

that hacked into Symantec and could not uninstall live installer

RSA Hack (2, Interesting)

Anonymous Coward | more than 2 years ago | (#41267815)

Yea, we saw this with the RSA hack, basically it's going up the supply chain to exploit suppliers of big companies/the government. In the RSA hack they actually made it look like it was coming from an RSA supplier, and spoofed an email with the THIRD version of an excel spreadsheet that contained a zero day exploit. The Chinese, they're good at this.

Perfect (2)

ThatsNotPudding (1045640) | more than 2 years ago | (#41267819)

Yes; let's rely on the same folks that can reduce any computer to a glacial, zombified, disk-grinding nightmare.

Sleep tight.

Re:Perfect (0)

Anonymous Coward | more than 2 years ago | (#41268383)

it's actually different people entirely.

Re:Perfect (1)

abirdman (557790) | more than 2 years ago | (#41268759)

I thought the same thing. Adobe, Symantec, Microsoft write the most hole-riddled, performance hogging, and attack-vector-filled software there is. It comes with the territory-- it's where good software and evil software meet. It fries me that anti-virus software is only marginally less annoying than the viruses they protect us from.

Complimentary Egg Roll (1)

puddingebola (2036796) | more than 2 years ago | (#41267945)

The attackers also left a coupon for a complimentary egg roll, good until the end of the month.

Re:Complimentary Egg Roll (1)

farrellj (563) | more than 2 years ago | (#41268157)

Unfortunately, it turned out to be for *last* month...

Watering Hole Attack. (4, Funny)

Tackhead (54550) | more than 2 years ago | (#41268087)

From TFA:

One of the vectors of infection we're seeing a substantial increase in, called a âoewatering holeâ attack, is a clear shift in the attacking group's method of operations. The concept of the attack is similar to a predator waiting at a watering hole in a desert. The predator knows that victims will eventually have to come to the watering hole, so rather than go hunting, he waits for his victims to come to him. Similarly, attackers find a Web site that caters to a particular audience, which includes the target the attackers are interested in. Having identified this website, the attackers hack into it using a variety of means.

All well and good. The good folk at Symantec, a site that definitely caters to an audience of people who would be interested in this particular exploit, then goes on to link to their research paper:

We have published a research paper [] that details the links between various exploits used by this attacking group, their method of targeting organizations, and the Elderwood Platform. It puts into perspective the continuing evolution and sheer resilience of entities behind targeted attacks.

That's right. The link to the research paper is, presumably by order of some marketroid who wants to get some metrics about this high-profile story (or are they?) is a goddamn link redirector that goes directly to a PDF, and can be expected to spawn precisely one of the sorts of vectors that the attackers have been exploiting for years.

Peter Norton is still alive, but if he weren't, he'd be rolling in his grave. As it stands, he's merely rolling in a big pile of money.

Re:Watering Hole Attack. (0)

Anonymous Coward | more than 2 years ago | (#41270289)

The link goes to []

Or, you too can be a marketroid for the day: []

Re:Watering Hole Attack. (0)

Anonymous Coward | more than 2 years ago | (#41274029)

The link goes to

Yes, but it's grossly irresponsible for a security company to make its own content indistinguishable from a watering hole attack, and ironic to do so with the very content that warns of this novel attack vector, and several light-years beyond irony then put the content in the form of another attack vector, when some static HTML and images would have sufficed.

Microsoft Windows only .. (3, Interesting)

dgharmon (2564621) | more than 2 years ago | (#41268127)

"The PDF file attached to the email exploits the Adobe Reader 'CoolType.dll' TTF Font Remote Code Execution Vulnerability (BID 43057). It uses a technique known as return-oriented programming (ROP) to bypass Data Execution Prevention (DEP), using code in the icucnv36.dll [] module."

Re:Microsoft Windows only .. (2)

nazsco (695026) | more than 2 years ago | (#41270911)

So you can only get infected if you do have an Symantec antivirus?

Ahem... (0)

Anonymous Coward | more than 2 years ago | (#41268237)

"All your bases are belong to us." - It finally came true.

"Elderwood" really? (1)

hawkingradiation (1526209) | more than 2 years ago | (#41269891)

Naming a particular exploit instead of assigning it a number like ExTrojA.1234 is like trying to name a particular day for something. Like having all the days of the year with names like "Hot air balloon to work day", "Stop light appreciation day", or "Mother's muffins day". We are already doing this and the attack against Google was bigger but attacks like this are occurring on a daily basis. BTW was the term "Elderwood platform" a poor Chinese translation that was translated back to mean the "Microsoft Windows platform"?

Re:"Elderwood" really? (1)

hawkingradiation (1526209) | more than 2 years ago | (#41269913)

Viruses and attack vectors are changing every day and it is a cat and mouse game.

Re:"Elderwood" really? (1)

TheCarp (96830) | more than 2 years ago | (#41272411)

Of course, the name is the only reason I checked out the comments, as I have been looking to grow some elder trees in my yard, and the berries are currently in season (mmmm). Of course, trying to get some from my pagan friends turned out to be too much hassle (important tree, need some rituals or some such).... so we just ordered some seeds, got them yesterday actually.

Well the thing is names make it easier to distinguish and actually talk about them. If I compared ExTrojA.1234 with CERT-2001-19 you probably have no clue what I am refering to. In this case that probably works to my favor, since if I tried to compare this to code red, I would instantly look foolish.

Where I do agree is when it can corrupt a deliberative process and make hash of people's arguments. What I am thinking of is congress. Remember the "clean air act" that reduced air pollution standards? What kind of thing is that? Leaving people in favor of clean air trying to argue against the clean air act?

Or the truly low move of naming a bill after a murdered kid. I can think of few things so small and yet so corrosive to the very spirit of a deliberative process to force a person who disagrees with a policy to make him argue against something so unfairly titled.

However, since worm and trojan names don't enter into such deliberative processes and public opinion of them is irrelevant.... I say let them have the names.

Oh.... and keep this one out of your mouth.... elderwood is poisonous.

oh noes (1)

nazsco (695026) | more than 2 years ago | (#41270899)

Let's just hope they don't steal the secrets to milliliter wave scanners!

Nobody would be safe if terrorists had such power under their control!

Check for New Comments
Slashdot Login

Need an Account?

Forgot your password?