Operation Aurora DISCOVERED_BY Google
Google detected the attack activity in its network.
Explicit Confidence 99% · Jack Rhysider EP 19 Details
“Google detected this activity and realized they were dealing with an attack”
Qualified triples from the transcripts. Origin, speaker, and evidence stay attached. These are not independently verified facts.
Operation Aurora DISCOVERED_BY Google
Google detected the attack activity in its network.
Explicit Confidence 99% · Jack Rhysider EP 19 Details
“Google detected this activity and realized they were dealing with an attack”
zero-day exploit EXPLOITS Adobe Flash vulnerability
The later zero-day exploits used by the suspected Elderwood group targeted Adobe Flash vulnerabilities.
Explicit Confidence 96% · Jack Rhysider EP 19 Details
“The next attack they conducted after Operation Aurora contained a zero-day exploit using Adobe Flash”
zero-day exploit EXPLOITS Internet Explorer vulnerability
The zero-day exploit exploited an Internet Explorer vulnerability unknown to Microsoft at the time.
Derived Confidence 96% · Jack Rhysider EP 19 Details
“The malware was not known by Microsoft so it was still able to exploit a fully-patched internet explorer”
Operation Aurora INITIAL_ACCESS_VIA phishing
The described initial access method was a targeted phishing email containing a link.
Explicit Confidence 98% · Jack Rhysider EP 19 Details
“The hackers knew who that person would e-mail normally and what those e-mails would look like so the hacker spoofed an e-mail”
Operation Aurora INVOLVES phishing
The attackers researched targets and sent carefully spoofed phishing emails.
Explicit Confidence 99% · Jack Rhysider EP 19 Details
“Then they would send a phishing e-mail to the target”
Operation Aurora INVOLVES zero-day exploit
The attack used a zero-day exploit that worked against a fully patched Internet Explorer.
Explicit Confidence 99% · Jack Rhysider EP 19 Details
“It was using what’s known as a zero-day exploit”
Operation Aurora INVOLVES Trojan
The attack downloaded and ran a newly made Trojan on victims’ computers.
Explicit Confidence 99% · Jack Rhysider EP 19 Details
“the program that was downloaded and ran was a Trojan”
Operation Aurora INVOLVES Perforce
Google stored its source code in Perforce, which the attackers entered using an unknown bug.
Explicit Confidence 99% · Jack Rhysider EP 19 Details
“The attackers knew exactly where the Perforce servers were and used yet another unknown bug to get into Perforce”
Operation Aurora INVOLVES Google source-code repositories
The attackers accessed Google’s source-code repositories and took some Google source code.
Explicit Confidence 98% · Jack Rhysider EP 19 Details
“they were able to easily access Perforce and take some of the source code from Google”
Operation Aurora INVOLVES McAfee
McAfee obtained and reverse-engineered the malware used in the attack and named the operation after its Aurora folder.
Explicit Confidence 99% · Jack Rhysider EP 19 Details
“When McAfee reverse-engineered the malware they found that when the hacker executed the attack they ran it out of a folder called Aurora”
Elderwood TARGETS General Dynamics
Elderwood appeared to be primarily interested in gaining access to defense companies including General Dynamics.
Uncertain Confidence 88% · Jack Rhysider EP 19 Details
“companies like Lockheed Martin, Raytheon, Boeing, and General Dynamics”
Elderwood appeared to be primarily interested in gaining access to defense companies including Raytheon.
Uncertain Confidence 88% · Jack Rhysider EP 19 Details
“companies like Lockheed Martin, Raytheon, Boeing, and General Dynamics”
Elderwood TARGETS Lockheed Martin
Elderwood appeared to be primarily interested in gaining access to defense companies including Lockheed Martin.
Uncertain Confidence 88% · Jack Rhysider EP 19 Details
“They seem to be mostly interested in gaining access to defense companies, companies like Lockheed Martin”
Elderwood TARGETS Amnesty International Hong Kong
The same group that was suspected of conducting Operation Aurora was also suspected of placing zero-day Flash exploits on Amnesty International Hong Kong’s website.
Uncertain Confidence 88% · Jack Rhysider EP 19 Details
“It’s suspected that the same group that did Operation Aurora in 2010 were also responsible for placing zero-day Flash exploits on the website for Amnesty International Hong Kong”
Elderwood appeared to be primarily interested in gaining access to defense companies including Boeing.
Uncertain Confidence 88% · Jack Rhysider EP 19 Details
“companies like Lockheed Martin, Raytheon, Boeing, and General Dynamics”
Trojan USES command and control tunnel
The Trojan opened a tunnel back to the attackers to control the victim’s computer, disguised as regular web traffic.
Explicit Confidence 99% · Jack Rhysider EP 19 Details
“This Trojan opened up a tunnel back to the hackers so they could control the victim’s computer”
Elderwood USES watering-hole attack
After Operation Aurora, Elderwood changed its initial-entry tactic to watering-hole attacks.
Attributed Confidence 95% · Jack Rhysider EP 19 Details
“Instead of getting people to click the phishing e-mail they used what’s known as a watering-hole attack”
Elderwood USES zero-day exploit
Elderwood was reported to use multiple zero-day exploits in later attack campaigns.
Attributed Confidence 93% · Jack Rhysider EP 19 Details
“In fact, they had five different zero-day exploits for Adobe Flash”
Elderwood USES supply-chain compromise
Elderwood was described as compromising suppliers and third parties so malicious software could reach defense contractors through the supply chain.
Explicit Confidence 98% · Jack Rhysider EP 19 Details
“if they can infect the supply chain and that software gets into the defense company, then it’s just as good as hacking into the defense company”
Sub7 AFFECTS Ultima Online
Sub7 was used to obtain and abuse Ultima Online account credentials.
Explicit Confidence 97% · Jack Rhysider EP 20 Details
“created to steal Ultima Online log ins”
clear-text credential storage AFFECTS Ultima Online
Ultima Online's saved-login feature stored usernames and passwords in a clear-text file.
Explicit Confidence 98% · Jack Rhysider EP 20 Details
“it actually saves your username and password in a clear text file called uo.cfg”
Sub7 ASSOCIATED_WITH remote-access tool
Mobman describes Sub7 as a remote-access tool and Trojan horse virus.
Explicit Confidence 98% · Mobman EP 20 Details
“It’s a remote-access tool. It was a Trojan horse virus”
Mobman attended DEF CON and says people there recognized him for Sub7; this is an association rather than proof of authorship.
Explicit Confidence 88% · Mobman EP 20 Details
“I’ll go to Defcon or whatnot and people come up to me; they’re like oh man, you’re Sub7”
AT&T west coast network outage ATTRIBUTED_TO Mobman
Mobman admits that his commands caused the outage, although the account is his own recollection.
Explicit Confidence 90% · Mobman EP 20 Details
“I’ll tell you why, if you fix my phone bill”
“I bragged to them; I sit there and I tell them what I did”
Ill Will AUTHORED article by Ill Will
Jack identifies Ill Will as the author of the article disputing Mobman's account.
Explicit Confidence 99% · Jack Rhysider EP 20 Details
“The article is written by a guy named Ill Will”