“This is the largest and most sophisticated cyberattack we have seen in years targeted at specific corporations,” said McAfee Worldwide Chief Technology Officer George Kurtz. “It is a watershed moment in cybersecurity because of the targeted and coordinated nature of the attack. As a result, the world has changed; organizations globally will have to change their threat models to account for this new class of highly sophisticated attack that goes after high value intellectual property.”
“Operation Aurora” was a coordinated attack which included a piece of computer code that exploits a vulnerability in Internet Explorer to gain access to computer systems. This exploit is then extended to download and activate malware within the systems. The attack, which was initiated surreptitiously when targeted users accessed a malicious Web page (likely because they believed it to be reputable), ultimately connected those computer systems to a remote server. That connection was used to steal company intellectual property and, according to Google, additionally gain access to user accounts.
Here's the Microsoft Security Advisory:
http://www.microsoft.com/technet/security/advisory/979352.mspx
Detailed guidance from McAfee is available at:
http://www.mcafee.com/us/threat_center/operation_aurora.html
How can I tell if my systems were infected?
If you are a McAfee VirusScan Engine customer, verify that you are using .DAT 5862 released on January 15, 2010 and perform a full scan on all machines within your enterprise, starting with most sensitive servers. If you detect the following signatures triggered: Exploit-Cornele, Roarur.dr or Roarur.dll, you very likely have an infected Aurora host
You can also check for outbound past or present Web communication or DNS resolutions of the following domains* known to be associated with the malware activity:
ftpaccess[dot]cc
google[dot]homeunix[dot]com
tyuqwer[dot]dyndns[dot]org
blogspot[dot]blogsite[dot]org
voanews[dot]ath[dot]cx
360[dot]homeunix[dot]com
ymail[dot]ath[dot]cx
yahoo[dot]8866[dot]org
sl1[dot]homelinux[dot]org
members[dot]linode[dot]com
ftp2[dot]homeunix[dot]com
update[dot]ourhobby[dot]com
filoups[dot]info
*In the names above, “[dot]” is substituted for “.” to protect users from accidentally clicking and launching malicious domains.
