Forest Global Training Partners

Cyber Risks · Krebs on Security

New Clues Draw Stronger Chinese Ties to ‘Aurora’ Attacks

Summary: SecureWorks malware research director Joe Stewart published forensic work tying the Hydraq backdoor Trojan used in the Operation Aurora attacks to source code documented in a Chinese-language white paper on mathematical algorithms. Stewart found a code snippet in the Trojan matched the white paper sample, and a Google search for one key text string returned almost exclusively Chinese-language pages, leading him to conclude someone comfortable reading simplified Chinese authored the Aurora codebase.

Key Takeaway: Stewart's attribution rests on a reused code snippet and search results, and commenters on the piece note the variable name he searched for does not appear in the compiled binary, so the Chinese link remains circumstantial rather than conclusive. Nearly 60 percent of Chinese computer users still browsed with Internet Explorer 6, the version most exposed to the unpatched flaw, and the Aurora exploit was already seeding Trojans on popular Chinese sites.

Read the original at Krebs on Security ↗

Topics
Malware
Related