/find@mail

Articles, write-ups, and musings concerning the world of cybersecurity and technology.

Espionage and Trespass: How Do You Know an Attack Is Spying?

Case Studies  · 795 words · 4 min read · by QiO:~$ ·

Espionage and Trespass: How Do You Know an Attack Is Spying?

One breach used a zero-day. The other used SQL injection, one of the oldest tricks on the web. Both are read as cyber espionage, but for very different reasons.

CrowdStrike defines cyber espionage (spying) as a type of cyberattack in which an unauthorized user tries to access sensitive or classified data, or intellectual property, for any number of reasons, from economic gain and competitive advantage to political motivation. While a range of actors and groups have carried it out, it is most commonly conducted using sophisticated APTs, which often signal nation-state involvement.

Attacks

Operation Aurora. In January 2010, Google disclosed that in mid-December it had detected a highly sophisticated attack on its corporate infrastructure, originating from China, that resulted in the theft of Google's intellectual property. Google also said a primary goal of the attackers appeared to be the Gmail accounts of Chinese human rights activists. It believed that goal failed: only two accounts appeared to have been accessed, and only account details and subject lines were exposed, not the content of emails.

Google wasn't alone. It said at least twenty other large companies across the internet, finance, technology, media and chemical sectors had been similarly targeted, and other prominent names, Adobe and Yahoo among them, were reported as victims. The attackers used JavaScript on a malicious web page to exploit a zero-day vulnerability in Internet Explorer, specifically CVE-2010-0249. A user only had to visit the page. The exploit then downloaded a remote access Trojan that let the attackers view, create and modify information on the compromised machine. Microsoft issued an advisory and later patched the flaw.

COVID-19 research. Since April 2020, intrusion activity targeting coronavirus research has been reported against U.S., U.K., Spanish, South Korean, Japanese and Australian laboratories, on the part of Russian, Iranian, Chinese and North Korean actors. In the second half of 2020, CrowdStrike's Falcon OverWatch team uncovered a targeted intrusion against an academic institution involved in developing COVID-19 testing capabilities. CrowdStrike attributed it to a China-nexus actor, who gained initial access through SQL injection against a vulnerable web server. Once the server was compromised, the actor compiled and launched a web shell and began information gathering and collection.

Reading the Evidence

Both of these attacks seem to point to cyber espionage as the threat, but the evidence isn't equal.

In the case of Operation Aurora, uncovering a zero-day and aiming it at large companies like Google, Yahoo and Adobe takes a level of sophistication that suggests nation-state involvement. Security researchers later linked the campaign to a group they call Elderwood, which some analyses tie to China's People's Liberation Army. That is analyst attribution, not a courtroom finding. The targeting of Chinese human rights activists is also very telling, since they may have suffered greatly had the attackers succeeded. Even here, motive is debated: Darknet Diaries noted that some of those same accounts were already subject to U.S. law enforcement requests, which left people guessing about what the attackers were really after. For the large companies, the damage was stolen intellectual property, including source code, and the risk of reputational harm.

In the case of the COVID-19 research attack, an SQL injection alone isn't enough evidence to determine the specific type of threat. Criminals use it every day. That said, the target, a research facility, suggests the attack was aimed at collecting sensitive data and intellectual property with global implications during a time of crisis. CrowdStrike adds a stronger clue than the target: after getting in, the actor enumerated a directory housing health-related files, which suggests they likely knew what they were looking for. What the attacker does after the entry point is often more revealing than how they got in.

Takeaway

These attacks remind us that there are very determined adversaries with deep resources and the patience to develop bleeding-edge exploits. Those of us in the cybersecurity field will face them, and the job is stewardship: patching the browser before a zero-day becomes a commodity, validating the input that lets SQL injection through, and watching for the web shell that shows up after a single mistake. It also means being honest about attribution. Sophistication and target choice can point to a state, but the strongest evidence is what the intruder does once inside.

Sources

Read next

Heartland Data: Compliant, but Breached