Skip the navigation
)
News

Hackers used IE zero-day, not PDF, in China-Google attacks

McAfee blames unpatched IE bug; Microsoft to release security advisory later today

January 14, 2010 04:00 PM ET

Computerworld - Hackers exploited an unpatched vulnerability in Microsoft's Internet Explorer (IE) browser to break into some of the firms targeted in a widespread attack that compromised Google's and Adobe's corporate networks, McAfee said today.

According to Dmitri Alperovitch, vice president of threat research at McAfee, the unpatched vulnerability in IE was the only exploit used to hack into several of the companies attacked in December and early January. McAfee did not collaborate with all victims of the attacks -- researchers from VeriSign iDefense have put the total at 33 -- but in all its cases the evidence was the same.

"There could be other forms of attacks," Alperovitch said, "but in all we investigated, it was the same kind of attack, and the same exploit of IE, which was the only exploit we have found in all the malware we have examined."

Alperovitch said that Microsoft would release additional information about the IE vulnerability in a later security advisory. Other sources, who asked to remain anonymous because they were not officially allowed to comment, said that Microsoft would release its advisory today.

A Microsoft spokesman declined to confirm that the company would issue an advisory Thursday, saying only that "Microsoft is investigating these reports and will provide more information when it is available."

The nuts and bolts of the attacks have been of interest because of Google's announcement Tuesday that attacks last month made off with intellectual property from its corporate network, and also tried to access the Gmail accounts of Chinese human rights activists. Google said it had proof that the attacks originated in China. As a result, Google said it was reevaluating its business in the country, and might pull out of the market.

That same day, Adobe admitted that its company's computers had also been hacked, and said that the attack that hit it Jan. 2 was related to the Google attack.

Computerworld reported earlier this week that Google and Adobe, the only two companies to have stepped forward thus far to acknowledge the attacks, were hacked using malicious PDF files that exploited a zero-day vulnerability in Adobe's popular Reader software.

According to Mikko Hypponen, the chief technology officer of F-Secure, the exploited flaw was the one of eight that Adobe patched Tuesday. That bug had been public knowledge since mid-December, and had been exploited in targeted attacks -- the very kind that broke into Google, Adobe and others -- since sometime in November.

Alperovitch, however, rejected the idea that a rogue PDF was at the root of the attacks. "We have not seen, in all the organizations we've worked with on this, and there were multiple, any PDF files associated with the attack," he said.



What is Tech Briefcase?
TechBriefcase is a new, free service where IT Professionals can Search, Store and Share IT white papers and content like this. Learn more
Bookmark content
Speed up your research efforts with content across the web.
Search and Store
Find the white papers you need. Create folders for any topic.
View Anywhere
Open your briefcase on your iPhone, tablet or desktop. Share with colleagues.
Don't have an account yet?
Additional Resources
Security KnowledgeVault
WHITE PAPER
Security is not an option. This KnowledgeVault Series offers professional advice how to be proactive in the fight against cybercrimes and multi-layered security threats; how to adopt a holistic approach to protecting and managing data; and how to hire a qualified security assessor. Make security your Number 1 priority.

Read now.

Cut Communications Costs Once and for All
WHITE PAPER
New IP-based communications systems are being deployed by small and midsized businesses at a rapid rate. Learn how these organizations are enabling faster responsiveness, creating better customer experiences, speeding office or mobile interactions, and dramatically reducing existing communications costs.

Read now.

Cybercrime and Hacking White Papers
Practice Management: Double Billing Rate and Improve Patient Services
Would you like to double your billing rate and achieve faster payment for services?

Download this customer success story to see how One Health...
Mission Critical Data Explosion and Customer Case Study
Would you like to double your tier 1 storage capacity while simultaneously reducing your storage footprint?

Download this customer success story to see how...
Protecting Against Database Attacks and Insider Threats: Top 5 Scenarios
Read this new eBook to learn the top five scenarios and essential best practices for preventing database attacks and insider threats.
Database Activity Monitoring Is Evolving
Read the analyst report and learn how you can leverage the core capabilities of a DAP solution for better database security.
Establishing a Strategy for Database Security is No Longer Optional
The options for securing increasingly valuable databases are very broad and deep, and can be confusing. This research provides an overview of three...
All Cybercrime and Hacking White Papers
Cybercrime and Hacking Webcasts
Distributed Database Security with Real-time Monitoring
View this demo and learn how IBM InfoSphere Guardium database activity monitoring can help protect your sensitive data in distributed DBMS environments with...
InfoSphere Warehouse Packs Demo
These flash modules make warehousing more tangible and relevant to business users through detailed explanations of the InfoSphere Warehouse Packs.
Delivery Management -- Extending Lifecycle Management
Date: Wednesday, June 20, 2012, 1:00 PM EDT

Siloed organizations continue doing the wrong things and doing things wrong, leading to increased costs,...
Leverage automation today to reduce IT complexity
Date: Tuesday, June 5, 2012, 2:00 PM EDT

Whether your B2B complexity is caused by multiple technologies due to M&A, business or application specific...
Redefine Expectations in the Data Center
Need to do more with less? Watch this video to learn how HP ProLiant Gen8 servers can help your business deploy servers three...
All Cybercrime and Hacking Webcasts
Newsletter Sign-Up

Receive the latest news test, reviews and trends on your favorite technology topics

Choose a newsletter
  1. View all newsletters | Privacy Policy
IT Jobs