Microsoft said on Thursday that a security vulnerability in its Internet Explorer browser was used in cyberattacks that prompted Google to threaten to shut down its operations in China.
Meanwhile, Web security firm MaAfee Inc said the attacks on Google and other companies showed a level of sophistication beyond that of cyber criminals and more typical of a nation-state.
Revealing the attacks on Tuesday, Google said they originated from China and targeted the e-mail accounts of Chinese human rights activists around the world, but did not explicitly accuse the Chinese government of responsibility.
Dmitri Alperovitch, vice president of threat research for McAfee, said that while McAfee had “no proof that the Chinese are behind this particular attack, I think there are indications though that a nation-state is behind it.”
Google said more than 20 other unidentified firms were targeted in the “highly sophisticated” attacks. while other reports have put the number of companies attacked at more than 30.
Google said that following the attacks it had decided to no longer censor its Internet search engine in China and was prepared to close its operations there entirely if it could not reach an agreement with the Chinese authorities.
Only one other company, Adobe, has come forward so far and acknowledged that it was a target of the attacks, which exploited a previously unknown security flaw in Internet Explorer.
“Internet Explorer was one of the vectors used in targeted and sophisticated attacks targeted against Google and other corporate networks,” Mike Reavey, the director of Microsoft’s Security Response Center, said in a blog post on Thursday.
Reavey stressed that Microsoft “has not seen widespread customer impact, rather only targeted and limited attacks exploiting [Internet Explorer 6.]”
Changing security settings to “high” would protect users from the vulnerability, he said.
Microsoft chief executive Steve Ballmer said meanwhile that the US software giant takes cyberattacks “seriously” but has no plans to pull out of China.
“We’ve been quite clear that we’re going to operate in China,” Ballmer told CNBC television. “We’re going to abide by the law.”
“We need to take all cyberattacks seriously, not just this one,” he said.
Alperovitch said the attacks on Google and other companies, which he was not allowed to identify, were unusual in their sophistication.
“We have seen attacks like this before but only in the government space, in the defense-industrial space,” Alperovitch said. “We have never seen that level of sophistication, level of planning and reconnaissance and attention to detail in attacks on commercial entities. Primarily the threat to commercial entities is from cyber-crime individuals after financial data. They’re typically sloppy.”
“This exploit was highly sophisticated,” he said. “It used multiple levels of obfuscation and encryption, more so than in any other types of exploits that we have seen previously.”
Such sophistication is “typically an attribute of a nation-state type of attack — and that’s exactly what we see here,” the McAfee researcher said.
Alperovitch said that the attackers used e-mail or some other lure to get employees of a targeted company to click on a link and visit a specially crafted Web site using Internet Explorer.
“Malware would then be downloaded that has the capability to essentially install a ‘back door’ in the machine,” he said. “This allows the attacker to log into the machine and essentially take it over as if they were sitting at the keyboard manipulating that machine.”
“What that does is it gives the attacker a beachhead into the organization from which point they can start exploring, identifying valuable pieces of data and other vulnerable services,” he said.
TYPHOON: The storm’s path indicates a high possibility of Krathon making landfall in Pingtung County, depending on when the storm turns north, the CWA said Typhoon Krathon is strengthening and is more likely to make landfall in Taiwan, the Central Weather Administration (CWA) said in a forecast released yesterday afternoon. As of 2pm yesterday, the CWA’s updated sea warning for Krathon showed that the storm was about 430km southeast of Oluanpi (鵝鑾鼻), Taiwan’s southernmost point. It was moving in west-northwest at 9kph, with maximum sustained winds of 119kph and gusts of up to 155kph, CWA data showed. Krathon is expected to move further west before turning north tomorrow, CWA forecaster Wu Wan-hua (伍婉華) said. The CWA’s latest forecast and other countries’ projections of the storm’s path indicate a higher
SLOW-MOVING STORM: The typhoon has started moving north, but at a very slow pace, adding uncertainty to the extent of its impact on the nation Work and classes have been canceled across the nation today because of Typhoon Krathon, with residents in the south advised to brace for winds that could reach force 17 on the Beaufort scale as the Central Weather Administration (CWA) forecast that the storm would make landfall there. Force 17 wind with speeds of 56.1 to 61.2 meters per second, the highest number on the Beaufort scale, rarely occur and could cause serious damage. Krathon could be the second typhoon to land in southwestern Taiwan, following typhoon Elsie in 1996, CWA records showed. As of 8pm yesterday, the typhoon’s center was 180km
TYPHOON DAY: Taitung, Pingtung, Tainan, Chiayi, Hualien and Kaohsiung canceled work and classes today. The storm is to start moving north this afternoon The outer rim of Typhoon Krathon made landfall in Taitung County and the Hengchun Peninsula (恆春半島) at about noon yesterday, the Central Weather Administration (CWA) said, adding that the eye of the storm was expected to hit land tomorrow. The CWA at 2:30pm yesterday issued a land alert for Krathon after issuing a sea alert on Sunday. It also expanded the scope of the sea alert to include waters north of Taiwan Strait, in addition to its south, from the Bashi Channel to the Pratas Islands (Dongsha Islands, 東沙群島). As of 6pm yesterday, the typhoon’s center was 160km south of
SECURITY: The New Zealand and Australian navies also sailed military vessels through the Strait yesterday to assert the right of freedom of navigation The Japan Maritime Self-Defense Force on Wednesday made its first-ever transit through the Taiwan Strait in response to the intrusion by a Chinese reconnaissance aircraft into Japan’s sovereign airspace last month, Yomiuri Shimbun reported yesterday. The Japanese news platform reported that the destroyer JS Sazanamisailed down through the Taiwan Strait on Wednesday, citing sources in the Japanese government with knowledge of the matter. Japanese Chief Cabinet Secretary Yoshimasa Hayashi declined to comment on the reports at a regular briefing because they concern military operations. Military vessels from New Zealand and Australia also sailed through the Strait on the same day, Wellington’s defense ministry
RSS