How Google attacks changed the security game

As worldwide chief technology officer for security company McAfee, George Kurtz took part in the investigation — called Operation Aurora — earlier this year of the attacks against Google and a number of other companies that apparently targeted high-value sensitive information. He said the attacks illustrate the threat from motivated, well-resourced hackers who use social engineering to compromise information technology systems.

“We certainly learned some valuable lessons from Operation Aurora, and what we see as the next frontier in attacking systems in corporations is the mobile devices that are in use today,” Kurtz said. “We’re going to see the next wave of malware and attacks target specific devices.”

GCN: What is Operation Aurora?

KURTZ: Operation Aurora refers to the research we did on the Google hacking incident that was reported in January. This was a watershed event because you had someone of the stature of Google come out and say, "We’ve had a security incident," which is a big deal, and, by the way, 30 other companies had a security incident as well and we believe it was [the fault of] the Chinese government. Our research looked at the malware samples, and we were able to conclude that there was a zero-day vulnerability in Internet Explorer that was being used to target specific companies and, in some cases, exfiltrate data out of those companies to servers in Taiwan.

 Related stories:

Lessons from Google attacks could help bolster US cyber defense

6 reasons to worry about cybersecurity

It shed some light on the targeted and focused nature of these attacks, which highlighted the fact that advanced persistent threats, a term that may be overused now, is a reality and something that government customers have been dealing with for a long time.

Why did these attacks get so much attention in the security community?

What makes it stand out is the public nature of it. These sorts of attacks happen, but there are a couple of things that are interesting about this particular case. No. 1 is you have someone like Google actually going public and talking about it. For someone of their stature to come out publicly and talk about the fact of a security incident is a big deal because many times companies don’t talk about this.

No. 2 is the fact that it was targeted in its nature. When we looked at it, we saw that the malware was uniquely compiled or created for each of the companies we looked at.

And finally, these sorts of attacks happen all of the time from government to government. There is a lot of speculation that it was China, and if you believe that was the case, you have a situation here in which you have attacks from government into corporate entities. That was one of the big game-changers that we saw.

Aurora has been cited as a very sophisticated, targeted attack. Does that assessment hold up under examination?

I believe so. While the malware was sophisticated, it wasn’t the most sophisticated we’ve seen, but the targeted and persistent nature of it was the most important feature that we focused on. There were people behind the keyboard who were driving this malware once it was embedded in these corporations. It was very organized, and if you look at the times involved, it was almost like a workday for somebody, as if that was their job.

Is the investigation continuing, or has it been exhausted?

In these sorts of attacks, it is difficult to gain attribution — who actually did it. Are there people comparing that malware versus other malware and trying to draw conclusions? Absolutely. I don’t think anyone knows for sure where it came from, I don’t know if anyone will know for sure in any definitive way whether it was China or not, and that is the big question remaining.

What lessons have been learned from this investigation?

The first lesson is that if something like this can happen to Google, which is a very sophisticated organization with very good security, it can happen to many companies that are out there. Layer 8 tends to be the biggest problem that we have. In the networking stack, there are seven layers, and Layer 8 is the human element. The social engineering nature of what was happening with people clicking on links and getting infected hasn’t changed. We have to educate people, but at the same time, these attacks are so sophisticated that it becomes hard for even a seasoned security professional to understand whether a link is a good one or a bad one. Many companies looked at their policies and procedures, and they realized that education is one component, but we also need an additional level of zero-day protection. Many of these companies were told by Google that they had an attack. They didn’t even know it. And there is data-loss prevention that would identify sensitive information if it was being exfiltrated from the organization.

What was the long-term damage from these attacks, if any?

It’s very difficult to assess because, when you’re talking about source code compromises, does that mean someone is going to build a competing product? Does it mean that someone will look at the code and try to find additional vulnerabilities and use it to leverage access somewhere else? It is difficult to put a number on it. There is a clean-up number perhaps; certainly, some of the companies have paid in the seven figures to get the mess cleaned up. But in terms of what the actual long-term monetary damage is, it is hard to put a number to it. It is a big number, and it is variable depending on the company.

Operation Aurora has focused attention on advanced persistent threats. Are these new phenomena, or are they just stealthy zero-day attacks?

Now everything seems to be an APT. If they don’t know what it is, it’s an APT. While the attacks aren’t new — they have happened in the government world for a long time — the realization of what is going on is new. It can be difficult for an organization to sort out whether it is just a zero-day malware or if the organization is being specifically targeted. In the conventional world, if somebody launches a missile, you can pretty much understand what the intent is and you can attribute it. In the cyber world, if someone launches an attack, you might not be sure who is behind it and you don’t know what the intent is. In the military world, they make a distinction between information gathering and an actual attack.

Is there a good definition for APT?

I don’t know that there is a good definition. I can only talk about my perception of it. You’ve got a very sophisticated attacker who can create the malware. They have the ability not only to penetrate the organization but remain undetected in a sleeper cell capacity for long periods of time, and from a threat perspective, they are specifically focused on an area. And it’s not just about infecting a system and putting it into a botnet.

What are the most serious threats we face today?

There is a good example from a couple of weeks ago with malware that was targeting Siemens data systems that were controlling systems in energy plants leveraging a zero-day vulnerability within the Microsoft environment. Those scenarios that are targeting our infrastructure are the things that keep me up at night. It is very difficult to protect systems that are well-maintained, but if you look at the infrastructure, many of these systems are not updated regularly. They are designed to run, and in fact, people get scared to update them because they don’t want the update to cause more problems. That’s one of the biggest fears I have.

Is the security posture of our critical infrastructure improving?

I don’t know that it is getting better. The only positive I see at this point is that there is attention on it. The first thing is always to understand you have the problem and recognize it, and then you can take some action. We’re in the phase of accepting that we do have an issue, and now we have to work through how we secure these systems. How do you create a grid that has some resiliency to it? The positive is that attention is being paid to it, and now we have to turn that attention into action and come up with a way to secure these systems that is in line with the cost structure of running them and doesn’t disrupt the capability to deliver service.