Operation Aurora: Google's Stolen Source Code and an IE Zero-Day

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

On January 12, 2010, Google disclosed that it had been attacked in mid-December 2009, though forensics traced the campaign back to mid-2009. More than 34 organizations were targeted, including Adobe, Akamai, Juniper Networks, Rackspace, Yahoo, Symantec, Northrop Grumman, Morgan Stanley and Dow Chemical. Dmitri Alperovitch of McAfee said the attackers wanted source code repositories, not financial data. They also went after the Gmail accounts of Chinese dissidents including artist Ai Weiwei, but saw only subject lines and creation dates for two accounts. McAfee CTO George Kurtz named the operation after the word Aurora, found in a file path in the malware.

The attackers, called the Elderwood Group by Symantec and also known as APT17 or the Beijing Group, used watering hole sites, zero-day flaws in Internet Explorer 6, 7 and 8, and weaknesses in the Perforce source control system, with backdoors disguised as SSL traffic reaching servers in Illinois, Texas and Taiwan. Google said it might stop censoring search in China even if that meant closing its offices there, Secretary of State Hillary Clinton condemned the attacks, and a guard in Beijing removed flowers left at Google's offices, calling them an illegal flower tribute. A WikiLeaks cable cited a Chinese source saying the Politburo ordered the intrusion, while Chinese officials called the account a U.S. fabrication. Germany, Australia and France told citizens to stop using Internet Explorer, and Microsoft, aware of the flaw since September 2009, patched it on January 21, 2010.

• The Guardian reported that a senior Politburo member had searched his own name on Google and found critical articles.
• The exploit was added to Metasploit, and Websense saw criminals using it in drive-by attacks on ordinary users.
• Traffic was traced to Shanghai Jiao Tong University and Lanxiang Vocational School, both of which denied involvement.
• Some command and control servers ran on stolen Rackspace customer accounts.
• In 2022 Google released Hacking Google, a six-part YouTube documentary series that revisits the attack.