Introduction to Cyber-Warfare - Proiect SEMPER FIDELIS

CYBER WAR THROUGH INTELLECTUAL PROPERTY THEFT: OPERATION AURORA145Second, the investigators obtained a document describing how to use Yahoo! Mail to remotecontrol-infected computers. This document also contained an e-mail address which when investigatedby the researchers led to several advertisements for apartment rentals—also located inChengdu. The Information Warfare Monitor researchers point out that a Technical ReconnaissanceBrigade (TRB) of the Chinese government (traditionally tasked with SIGINT collectionand believed to be involved in cyber espionage) is located in Chengdu. Unfortunately, thereis not much more analysis that can link the attacks to the Chengdu TRB. However, it seems plausiblethat the Shadow Network, an international cyber espionage ring, is the type of operationthat would fall within the TRB’s traditional role—intelligence collection through SIGINT.The stories of Gh0stNet and the Shadow Network illustrate how cyber espionage operatorsmonitored target systems over a long period of time for intelligence collection purposes. Thetargets of these cyber espionage operations included Tibetan dissidents and governmentalorganizations from countries that China may have a substantial interest in. In the next section,we examine another attack largely attributed to the Peoples’ Republic in China—OperationAurora. The level of sophistication increases yet again in this cyber espionage operation, butthis time the targets are mainly part of the industry sector.CYBER WAR THROUGH INTELLECTUAL PROPERTY THEFT:OPERATION AURORAOn January 12, 2010, Google announced shocking news. The firm published on its officialblog that it had been the victim of a cyber warfare originating from China. According to theblog, the purpose of the operation was to access the Gmail e-mail accounts of Chinese humanrights activists. 74 As a result of this cyber espionage operation, Google announced that itwould no longer censor results on its flagship search engine in China—google.cn—a movethat caused consternation with the PRC. The company stated that if they could not run theirsearch engine uncensored, they would be willing to close operations in China.Literally, minutes after the announcement from Google, Adobe—another major softwarevendor—announced that their corporate systems had also been hacked. 75 It turns out thatboth Google and Adobe were targets of the same adversary—an adversary that conductedthe very same operation against 32 more companies. These firms included Dow Chemical,Northrop Grumman, Symantec, and Yahoo. 76 It seems the purpose of the operation was toexfiltrate not only information about Chinese human rights activists but also intellectualproperty—namely, source code of commercially developed software. 77This operation—known as “Operation Aurora”—is the topic of this section. It leveragedsocial engineering along with an advanced Trojan known as Hydraq to steal intellectual property.Several analysts strongly suspect PRC involvement. Here, we review the attack, reviewthe evidence of PRC involvement, and discuss the implications of intellectual property theftfrom corporations.Trojan.HydraqThe act of cyber espionage dubbed “Operation Aurora” employed an exploit in MicrosoftInternet Explorer that was exploited by software referred to as Trojan.Hydraq by the security