Operation Aurora
Disclosed 12 January 2010
In January 2010 Google disclosed that in mid-December 2009 it had detected a highly sophisticated, targeted attack on its corporate infrastructure that resulted in theft of intellectual property, and that a primary goal appeared to be accessing the Gmail accounts of Chinese human rights activists. The campaign used a then-unpatched Internet Explorer vulnerability, which Microsoft fixed in bulletin MS10-002.
- Victim
- Google and, according to Google, at least twenty other large companies
- Sector
- Technology and other industries
- Public attribution
- Google said the attack originated from China; no government attribution is cited here.
Impact
Theft of intellectual property from Google and attacks on many other companies (Google). It pushed many organisations to treat targeted state espionage as a business risk.
Root cause
A zero-day browser exploit delivered to selected employees, followed by movement inside the corporate network to reach source code and account systems.
Lessons learned: the controls it teaches
- Assume targeted attackers will reach some endpoints; detect lateral movement and access to crown-jewel systems.
- Patch browsers quickly and reduce exposure with isolation and exploit protection.
- Protect source code repositories with strong access control and monitoring.