Elite hacker gang has unlimited supply of zero-day bugs
Cox called the group one of the "more elite" hacker teams, and even cited what she called their "professionalism."
"The manner in which they've structure the work, dividing it among themselves, shows a certain professionalism," Cox said. "They have a development platform in place, so they just need to pull all these components together to launch a new attack. With the group's sophistication, they can quickly and easily pull together a new attack."
This year, for example, the Elderwood group shifted gears several times, quickly returning to the attack with an exploit of a new zero-day each time its predecessor was sniffed out by security researchers.
"This year, they used a Flash zero-day in April, then a couple of weeks later one in IE, then two or three weeks after that, another, one after the other," said Cox.
Some of the zero-days attributed to Elderwood have been among the highest-profile bugs uncovered and patched this year. The vulnerability exploited by Elderwood in late May, CVE-2012-1889, was in Microsoft XML Core Services (MSXML). Attacks circulated widely enough that other security firms noticed, prodding Microsoft to patch the vulnerability in its July security update slate.
The speed with which the hackers regroup after the patching of a vulnerability told Cox that they were extremely skilled. "I would suspect, based on the speed of their attacks, that they have some sort of stockpile of zero-days," he said. "I have to assume that they have more in their arsenal than we've found."
As always when researchers pull aside the curtain on a hard-working hacker gang, the immediate assumption by many is that the attackers are backed by a government. That's not necessarily the case, according to Cox, who said Symantec had no hard evidence.
"But this is a full-time job," she said, and requires a large team to dig up vulnerabilities, build exploits, bundle them into malware, launch attacks and then digest the information they've stolen. "The work they do is both skilled and time consuming. They would have to work at it full time, so someone is paying them to do this."
She said it's likely that the group is working on a contractual basis, and attacking targets identified for them by their backer. "The analysis has shown that certain organizations have been hit in different ways, indicating that they're of particular interest to [their paymasters]," Cox added.
While there's little chance an average computer user will fall victim to the targeted attacks launched by Elderwood -- generally conducted using emails aimed at specific individuals -- the gang also uses the "watering hole" strategy to infect PCs.
In a watering hole campaign, hackers identify likely targets, even to the individual level, then scout out which websites they frequently visit. Next the attackers compromise one or more of those sites, plant malware on them, and like a lion waits at a watering hole for victims, wait for unwary users to surf there.
In those cases, the general public can be, as Cox put it, "collateral damage."
Symantec's analysis of the Elderwood Project can be downloaded from its website (download PDF).
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, on Google+ or subscribe to Gregg's RSS feed . His email address is firstname.lastname@example.org.
- Syrian Electronic Army shanghais Microsoft's Twitter account, blog
- Is French outrage against U.S. spying misplaced?
- Lawmakers seek answers on Obamacare Data Hub security
- China-based hacking group behind hundreds of attacks on U.S. companies
- How to Prepare for a Potential Syrian Counterattack on the U.S. Power Grid
- New York Times site outage caused by attack on domain registrar, company says
- Cyber drills like Quantum Dawn 2 vital to security in financial sector
- Quantum Dawn 2 will test Wall Street's cyber readiness
- Pentagon accuses China of cyberattacks on U.S military, business targets
- Spamhaus attacks expose huge open DNS server dangers
Read more about Malware and Vulnerabilities in Computerworld's Malware and Vulnerabilities Topic Center.
- Best iPhone, iPad Business Apps for 2014
- 14 Tech Conventions You Should Attend in 2014
- 10 Desktop Apps to Power Your Windows PC
- How to Add New Job Skills Without Going Back to School
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The Threat Landscape Hardly a day goes by without the discovery of a new cyberthreat somewhere in the world! But how do you keep up with...
- Security for Virtualization In the rush to implement virtualization, security has become second. So while the business benefits are clear, the risks are less well documented...
Red Hat Enterprise Linux - The Original Cloud Operating System
Linux adoption is growing against a number of measures, such as the
number of supercomputers that run Linux and the size of the contributing...
- OpenStack Hype vs. Reality: CIO Quick Pulse Open-source architecture can enable IT departments to build infrastructure-as-a-service (IaaS) clouds running on standard hardware.
- Webinar: Building a Big Data solution that's production-ready Big data solutions are no longer just a nice-to-have.
- Meg Whitman presents Unlocking IT with Big Data During this Web Event you will hear Meg Whitman, President and CEO, HP discuss HAVEn - the #1 Big Data platform, as well... All Malware and Vulnerabilities White Papers | Webcasts