Cyber criminals get sloppy in recent attacks
Connecting state and local government leaders
Cyber crime and espionage are growing problems, but we can take some heart in the fact that the bad guys are not supervillains, says columnist William Jackson.
Cyber crime is bad and getting worse. Security company McAfee received more than 34 million samples of malicious code in 2009 and is on track to eclipse that number this year, Dave DeWalt, the company’s chief executive officer, said recently in Washington.
DeWalt called the possibility of terrorists exploiting the proliferation of IP-addressable devices in critical infrastructures “probably the single biggest weakness the world has now.” One high-profile example of cyber espionage is the recent Aurora attacks, in which anywhere from 100 to 150 companies were breached last year.
Operation Aurora is an example of an advanced persistent threat, which can sit in place for long periods of time, quietly observing and gathering information from a compromised system without drawing attention to itself. The breaches began as early as April 2009 and continued, apparently undetected, until December. Google broke the story in January, and details of the attacks continue to surface.
DeWalt called the attacks alarming because of the length of time the malware remained in place and because the target apparently was valuable intellectual property, such as source code.
But one bright spot in Operation Aurora is that the perpetrators — still unidentified, although Google has blamed China — might be clever, but they are not super villains. DeWalt said the attacks were sophisticated and highly coordinated but that “it wasn’t the most perfectly executed attack.” In fact, “it was pretty sloppy.”
Related stories
Lessons from Google attacks could help U.S. bolster cyber defense
Google attacks began with an employee’s click, reports say
Like a careless criminal leaving his fingerprints at the scene of an otherwise well-thought-out crime, the Aurora attackers left prints all over the servers they compromised. “We could learn a lot from it, and we did,” DeWalt said.
Operation Aurora apparently used social engineering to target individuals likely to have access to valuable intellectual property within their organizations. The malware exploited a vulnerability in Microsoft’s Internet Explorer browser to open a back door through which the bad guys were able to browse through valuable files and send copies home. But although the attacks were stealthy, the attackers did not remove the evidence when they were finished, DeWalt said. Samples of the malware were left behind, and some of the servers receiving the stolen material were identified.
McAfee has been involved in the investigation of Operation Aurora, and the details of what it has learned are hidden under nondisclosure agreements with its customers. A few details have leaked out, and according to reports, two Chinese schools, Shanghai Jiaotong University and the Lanxiang Vocational School, have been implicated in the attacks, although both have denied involvement.
Regardless of where the finger is being pointed, it is important to remember that these guys are not necessarily evil geniuses. They were smart, they knew the kind of information they wanted, they knew how to go after it, and they were successful. But eventually they were discovered, and their DNA was left behind. Ultimately, the success of the attacks had as much to do with the judgment of the victims who opened malicious files or followed malicious links as with the cleverness of the villains.
Microsoft has issued patches for the vulnerabilities, but the code still is in circulation, and it most likely remains undiscovered on some systems, quietly gathering data. Eventually, it will be scrubbed, and Aurora will be over. But it will be followed by something else until we start doing a better job with the security practices we already should be using.
Ultimately, the fault is in ourselves.