Operation Aurora INVOLVES zero-day exploit
The attack used a zero-day exploit that worked against a fully patched Internet Explorer.
Explicit Confidence 99% · Jack Rhysider EP 19 Details
“It was using what’s known as a zero-day exploit”
Exploit
exploit:zero_day_exploit
Also: 0-day, zero day, zero-day
Previously unknown exploit used to compromise fully patched Internet Explorer and later Adobe Flash installations.
Previously unknown exploit used to compromise fully patched Internet Explorer and later Adobe Flash installations.
“It was using what’s known as a zero-day exploit.”
“The next attack they conducted after Operation Aurora contained a zero-day exploit using Adobe Flash.”
An exploit for a previously unknown or unpatched vulnerability, mentioned hypothetically in the episode’s discussion of intelligence work.
“we know NSA hoards zero-days”
Exploit used in the attack against the European Commission before the relevant weakness was known or protected against.
“It was a sophisticated attack using a zero-day exploit.”
Working exploitation of an unknown software vulnerability, retained privately by its finder and recipients before vendor awareness or patching.
“A zero-day exploit is basically a vulnerability in software that the makers of that software don’t know exists yet.”
Exploit for a vulnerability unknown to the affected software maker and wider community at the time of discovery.
“which is called a zero-day exploit”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | EXPLOITS | Internet Explorer vulnerability | Derived | 19 |
| outgoing | EXPLOITS | Adobe Flash vulnerability | Explicit | 19 |
| outgoing | EXPLOITS | software vulnerability | Explicit | 98 |
| outgoing | AFFECTS | iOS | Explicit | 98 |
| incoming | INVOLVES | Operation Aurora | Explicit | 19 |
| incoming | USES | Elderwood | Attributed | 19 |
| incoming | ASSOCIATED_WITH | Crowdfense | Explicit | 98 |
| incoming | USES | National Security Agency | Explicit | 98 |
| incoming | USES | Missile Defense Agency | Attributed | 98 |
| incoming | USES | Central Intelligence Agency | Attributed | 98 |
| incoming | USES | NotPetya | Explicit | 98 |
Operation Aurora INVOLVES zero-day exploit
The attack used a zero-day exploit that worked against a fully patched Internet Explorer.
Explicit Confidence 99% · Jack Rhysider EP 19 Details
“It was using what’s known as a zero-day exploit”
zero-day exploit EXPLOITS Internet Explorer vulnerability
The zero-day exploit exploited an Internet Explorer vulnerability unknown to Microsoft at the time.
Derived Confidence 96% · Jack Rhysider EP 19 Details
“The malware was not known by Microsoft so it was still able to exploit a fully-patched internet explorer”
Elderwood USES zero-day exploit
Elderwood was reported to use multiple zero-day exploits in later attack campaigns.
Attributed Confidence 93% · Jack Rhysider EP 19 Details
“In fact, they had five different zero-day exploits for Adobe Flash”
zero-day exploit EXPLOITS Adobe Flash vulnerability
The later zero-day exploits used by the suspected Elderwood group targeted Adobe Flash vulnerabilities.
Explicit Confidence 96% · Jack Rhysider EP 19 Details
“The next attack they conducted after Operation Aurora contained a zero-day exploit using Adobe Flash”
zero-day exploit EXPLOITS software vulnerability
Jack defines a zero-day exploit as a working exploit involving a software vulnerability unknown to the software maker.
Explicit Confidence 98% · Jack Rhysider EP 98 Details
“A zero-day exploit is basically a vulnerability in software that the makers of that software don’t know exists yet.”
zero-day exploit AFFECTS iOS
Nicole reports that the going rate for a zero-day exploit capable of remotely entering iOS software was $2.5 million or more.
Explicit Confidence 97% · Nicole Perlroth EP 98 Details
“the going rate for a zero-day exploit that gets you into an iPhone’s IOS software remotely is $2.5 million”
Crowdfense ASSOCIATED_WITH zero-day exploit
Crowdfense is described as a broker offering millions of dollars for a zero-day capability targeting iOS remotely.
Explicit Confidence 95% · Nicole Perlroth EP 98 Details
“I found one broker in researching the book called Crowdfense that now offers even more than that; they offered $3 million for that same capability”
National Security Agency USES zero-day exploit
The NSA later added budget to buy exploit capabilities from outside sources and is said to have purchased vulnerabilities externally.
Explicit Confidence 96% · Nicole Perlroth EP 98 Details
“there was a line item added to their black budget, and it wasn’t very big; it was something like $25.1 million to buy these capabilities in 2013. We know that they have purchased these vulnerabilities from the outside.”
Missile Defense Agency USES zero-day exploit
A zero-day seller told Nicole that the Missile Defense Agency bought zero-day exploits.
Attributed Confidence 91% · Nicole Perlroth EP 98 Details
“the Missile Defense Agency I learned played in this market. I had never heard of the Missile Defense Agency until someone who sells zero-day exploits told me that they sold to the Missile Defense Agency”
Central Intelligence Agency USES zero-day exploit
The CIA is listed among agencies participating in the market for privately developed zero-day exploits.
Attributed Confidence 87% · Nicole Perlroth EP 98 Details
“agencies like the CIA ... were trying to play the NSA’s game but didn’t have the same talent pool in-house”
NotPetya USES zero-day exploit
The NotPetya attack used the exploit code that had been held by the NSA and later dumped online by the Shadowbrokers.
Explicit Confidence 94% · Nicole Perlroth EP 98 Details
“It was used in a NotPetya attack”