Google: Hackers Targeted Chinese And Vietnamese

The cyberattack that Google disclosed in January, subsequently dubbed "Operation Aurora" by McAfee, turns out to have been two separate, unrelated attacks.

Initially, Google described the attack as "a highly sophisticated and targeted attack on our corporate infrastructure originating from China that resulted in the theft of intellectual property from Google." The company also noted that in the course of investigating this attack, it had discovered that dozens of Gmail accounts belonging to human rights activists had been compromised and accessed by unauthorized parties.

These e-mail break-ins, Google, believes, followed from successful phishing attacks or malware on the victim's computer.

In a blog post on Tuesday, Google security team member Neel Mehta explained that Google had found evidence of a separate, less sophisticated cyber attack directed at a different community of users -- Vietnamese activists.

Mehta said that the malware targeted Vietnamese computer users and may have affected tens of thousands of people, despite the fact that it isn't as sophisticated as the malware associated with the attack that came from China.

"These infected machines have been used both to spy on their owners as well as participate in distributed denial of service (DDoS) attacks against blogs containing messages of political dissent," said Mehta. "Specifically, these attacks have tried to squelch opposition to bauxite mining efforts in Vietnam, an important and emotionally charged issue in the country."

McAfee in a separate blog post acknowledged revising its appraisal of the Operation Aurora attack. "While originally some of these domains and files had been reported to be associated with Operation Aurora, we have since come to believe that this malware is unrelated to Aurora and uses a different set of Command & Control servers," CTO George Kurtz.

According to McAfee the attackers created their botnet using a malicious keyboard driver that replaces the VPSKeys driver used in the Vietnamese version of Windows.

The security company observes that politically motivated hacking, or hacktivism, is on the rise. Reports published on Wednesday by The New York Times and the Associated Press appear to support that claim. They note that the Yahoo Mail accounts of more than a dozen academics and journalists who cover China and Taiwan have been accessed by unknown parties.

A Yahoo spokesperson declined to comment on the attacks beyond offering a general condemnation of hacking for any reason and noting, "Yahoo! sold its China business in 2005 to a Chinese company called Alibaba, and while maintaining a 39% investment in Alibaba, we no longer have operational control or day-to-day management over the Yahoo! China business."