Operation Aurora DISCOVERED_BY Google
Google detected the attack activity in its network.
Explicit Confidence 99% · Jack Rhysider EP 19 Details
“Google detected this activity and realized they were dealing with an attack”
Incident
incident:operation_aurora
Also: Aurora attack, Project Aurora
Cyber-espionage campaign that compromised Google and numerous other companies using targeted phishing, zero-day exploits, and a Trojan.
Cyber-espionage campaign that compromised Google and numerous other companies using targeted phishing, zero-day exploits, and a Trojan.
“McAfee called this attacked Operation Aurora.”
“In 2009 around Christmastime something terrible was lurking in the network at Google.”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | DISCOVERED_BY | Explicit | 19 | |
| outgoing | COMPROMISES | Explicit | 19 | |
| outgoing | COMPROMISES | Adobe | Explicit | 19 |
| outgoing | COMPROMISES | Yahoo | Explicit | 19 |
| outgoing | COMPROMISES | Rackspace | Explicit | 19 |
| outgoing | COMPROMISES | Microsoft | Explicit | 19 |
| outgoing | COMPROMISES | Juniper Networks | Explicit | 19 |
| outgoing | COMPROMISES | Dow Chemicals | Explicit | 19 |
| outgoing | INVOLVES | phishing | Explicit | 19 |
| outgoing | INITIAL_ACCESS_VIA | phishing | Explicit | 19 |
| outgoing | INVOLVES | zero-day exploit | Explicit | 19 |
| outgoing | INVOLVES | Trojan | Explicit | 19 |
| outgoing | INVOLVES | Google source-code repositories | Explicit | 19 |
| outgoing | COMPROMISES | Google source-code repositories | Explicit | 19 |
| outgoing | INVOLVES | Perforce | Explicit | 19 |
| outgoing | ATTRIBUTED_TO | China | Attributed | 19 |
| outgoing | ASSOCIATED_WITH | Elderwood | Attributed | 19 |
| outgoing | INVOLVES | McAfee | Explicit | 19 |
Operation Aurora DISCOVERED_BY Google
Google detected the attack activity in its network.
Explicit Confidence 99% · Jack Rhysider EP 19 Details
“Google detected this activity and realized they were dealing with an attack”
Operation Aurora COMPROMISES Google
The attackers compromised numerous Google systems and burrowed into Google’s servers.
Explicit Confidence 99% · Jack Rhysider EP 19 Details
“They compromised numerous systems and burrowed their way deep into Google’s servers”
Operation Aurora COMPROMISES Adobe
Adobe said it had also been hacked during the winter holidays.
Explicit Confidence 99% · Jack Rhysider EP 19 Details
“Adobe admitted that they too, got hacked over the winter holidays”
Operation Aurora COMPROMISES Yahoo
Yahoo was among the companies hit by the attack.
Explicit Confidence 97% · Jack Rhysider EP 19 Details
“Yahoo, Rackspace, Microsoft, Juniper Networks, and Dow Chemicals”
Operation Aurora COMPROMISES Rackspace
Rackspace was among the companies hit by the attack.
Explicit Confidence 97% · Jack Rhysider EP 19 Details
“Yahoo, Rackspace, Microsoft, Juniper Networks, and Dow Chemicals”
Operation Aurora COMPROMISES Microsoft
Microsoft was among the companies hit by the attack.
Explicit Confidence 97% · Jack Rhysider EP 19 Details
“Yahoo, Rackspace, Microsoft, Juniper Networks, and Dow Chemicals”
Operation Aurora COMPROMISES Juniper Networks
Juniper Networks was among the companies hit by the attack.
Explicit Confidence 97% · Jack Rhysider EP 19 Details
“Yahoo, Rackspace, Microsoft, Juniper Networks, and Dow Chemicals”
Operation Aurora COMPROMISES Dow Chemicals
Dow Chemicals was among the companies hit by the attack.
Explicit Confidence 97% · Jack Rhysider EP 19 Details
“Yahoo, Rackspace, Microsoft, Juniper Networks, and Dow Chemicals”
Operation Aurora INVOLVES phishing
The attackers researched targets and sent carefully spoofed phishing emails.
Explicit Confidence 99% · Jack Rhysider EP 19 Details
“Then they would send a phishing e-mail to the target”
Operation Aurora INITIAL_ACCESS_VIA phishing
The described initial access method was a targeted phishing email containing a link.
Explicit Confidence 98% · Jack Rhysider EP 19 Details
“The hackers knew who that person would e-mail normally and what those e-mails would look like so the hacker spoofed an e-mail”
Operation Aurora INVOLVES zero-day exploit
The attack used a zero-day exploit that worked against a fully patched Internet Explorer.
Explicit Confidence 99% · Jack Rhysider EP 19 Details
“It was using what’s known as a zero-day exploit”
Operation Aurora INVOLVES Trojan
The attack downloaded and ran a newly made Trojan on victims’ computers.
Explicit Confidence 99% · Jack Rhysider EP 19 Details
“the program that was downloaded and ran was a Trojan”
Operation Aurora INVOLVES Google source-code repositories
The attackers accessed Google’s source-code repositories and took some Google source code.
Explicit Confidence 98% · Jack Rhysider EP 19 Details
“they were able to easily access Perforce and take some of the source code from Google”
Operation Aurora INVOLVES Perforce
Google stored its source code in Perforce, which the attackers entered using an unknown bug.
Explicit Confidence 99% · Jack Rhysider EP 19 Details
“The attackers knew exactly where the Perforce servers were and used yet another unknown bug to get into Perforce”
Operation Aurora COMPROMISES Google source-code repositories
The attackers compromised or accessed Google’s source-code repository environment.
Explicit Confidence 95% · Jack Rhysider EP 19 Details
“take some of the source code from Google, possibly the source code for the Chrome browser”
Operation Aurora ATTRIBUTED_TO China
Google believed the campaign originated in China; this attribution was presented by Hillary Clinton as an allegation under investigation.
Attributed Confidence 90% · Hillary Clinton EP 19 Details
“a campaign that the company believes originated in China”
Operation Aurora ASSOCIATED_WITH Elderwood
Security researchers associated the attack with the group later called Elderwood; Symantec derived the name from a variable in the malware code.
Attributed Confidence 94% · Jack Rhysider EP 19 Details
“When Symantec investigated the malware further they found the code frequently used a variable with the name Elderwood so they called this hacking group Elderwood”
Operation Aurora INVOLVES McAfee
McAfee obtained and reverse-engineered the malware used in the attack and named the operation after its Aurora folder.
Explicit Confidence 99% · Jack Rhysider EP 19 Details
“When McAfee reverse-engineered the malware they found that when the hacker executed the attack they ran it out of a folder called Aurora”