The hackers who broke into Google two months ago have gone after more than 100 companies, according to an estimate by security vendor Isec Partners.
Researchers have been closing in on the unidentified criminals responsible for the attack over the past month. In the process, they have uncovered another 68 so-called command-and-control servers, used to control the hacked machines.
Investigators had already identified 34 hacked companies after examining the single command-and-control server used in the Google attack, and the discovery of another 68 servers could mean that many more companies were compromised than previously thought. “It’s easily over 100 companies,” said Alex Stamos a partner with Isec Partners.
In the weeks since Google went public with details of the hack, informal discussion lists have sprung up, including security experts and staffers from companies that have been compromised. In those discussions, “that list of control machines keeps getting longer and longer,” Stamos said.
The code used in the attacks, known in security circles as Aurora, has been in use for at least 18 months, Stamos said. But the security industry was unaware of Aurora until Google discovered the intrusion last December. That allowed hackers to get onto corporate networks undetected.
Other technology companies, including Intel, Adobe, and Symantec, have also been hit by the attack, which investigators have traced back to China.
To break into victim companies, the hackers sent carefully targeted e-mail or instant messages to victims, hoping to trick them into visiting Web pages or opening malicious documents that would then attack their computers.
The worst part of the attack is what happens once the initial victim has been compromised. The hackers then use a variety of techniques to acquire additional usernames and passwords and fan out across the targeted company’s network, downloading sensitive data, which is then moved offshore.
This type of targeted attack is not new, but it is dangerous because it is so good at circumventing traditional security measures, said Rob Lee, a computer forensics instructor with the SANS Institute. “We’ve been dealing with [these attacks] for five years,” he said. “They’re basically going around all the security appliances via email.”
Not all of these attacks have been linked to Aurora, but Lee said that “there have been hundreds of companies infiltrated.”
Stamos agreed that traditional security products such as antivirus and intrusion detection systems are not enough to stop the attack. “The interesting thing to me about these attackers is they’re very patient,” he said. “They’ll spend a lot of time writing custom malware to get around people’s antivirus.”
“They’ll use a social network to learn about one person in the company, and then will send emails or chats messages as that person’s friend,” he added.
ISec Partners has published technical recommendations for companies to follow in order to mitigate the Aurora risk.