12 Years After Operation Aurora, How Has Data Security Changed?
In 2010, Operation Aurora was able to successfully breach Adobe, Dow Chemical, Google, Morgan Stanley and Yahoo. Though it was believed to have originated in Beijing, only Google levied the accusation against China — and consequently moved its servers out of the country. Since Operation Aurora, significant strides have been made in data security and management. But threats still remain.
What is Operation Aurora?
Operation Aurora was a cybersecurity attack thought to have originated in China, purportedly with the aim of stealing intellectual property from numerous large American businesses. At the time, the Google cyberattack prompted Google to reveal that advocates for humanitarian causes in China had their Gmail accounts, and potentially their locations and identities, breached. Google reacted swiftly.
But three years after Operation Aurora, many now believe that Operation Aurora was actually a counter-attack. Microsoft now believes that Chinese attackers were trying to determine whether the United States had uncovered the identities of Chinese agents operating within the country. In some ways, this would be more concerning than intellectual property theft, as it implicates the Chinese government.
Since the Operation Aurora attack, there have been many theories as to why the attack occurred. This highlights an interesting aspect of the post-mortem examinations of cybersecurity attacks.
Quite frequently, these attacks occur, and it is impossible to determine who caused it, why it was caused or what data was lost. In the case of the Operation Aurora attack, there may always be speculation regarding how involved the Chinese government was and what the true aims of the attack might have been.
What isn’t debatable is the fact that it was a large-scale attack that affected many US enterprises.
What Happened During Operation Aurora?
Multiple attack procedures were used by the “Elderwood” group, which Operation Aurora was traced back to. One attack procedure was to infiltrate a website that employees of a given target used. From there, the malware is distributed to employees and eventually reaches into the network.
Other aspects of the attack targeted what McAfee called a “zero-day vulnerability,” but was later revealed to have existed for several months. In short, one of the interesting aspects of the Operation Aurora attacks is that multiple threats were used to gain access to a large number of victims.
The Operation Aurora attack was sophisticated and spectacularly successful. But its ultimate consequences were left unclear. Not only is the reason for the attack debated, but the true consequences of the attack also remain a mystery. With companies intentionally vague about the intellectual property that may have been stolen (and new information being discovered even years after the attack), it may never be known whether it was an individual or state-sponsored attack.
The Consequences of the Operation Aurora Attack
Of course, who attacked the organizations involved may not be as important a question as how they were attacked — and what can be done to prevent such momentous attacks in the future.
The most visible impact of Operation Aurora was when Google shifted its enterprises away from Chinese servers, leaving only a localized server bank in Hong Kong.
Much like the federal defense attacks in 2020, the Operation Aurora attack was able to leverage third-party vulnerabilities. These were vulnerabilities in Internet Explorer, McAfee and an array of websites commonly used by the victims.
Since Operation Aurora, many systems have adopted a zero-trust parameter. Rather than blacklisting sites, they operate under a paradigm of whitelisting. Unless trust is firmly established, cybersecurity programs no one. This is a much simpler and much more refined system for a world in which so much more of a network is exposed.
Further, companies have learned to regard their third-party applications with far greater levels of scrutiny than before. Every element that is added to a network is a potential failure point. All network security is only as strong as its weakest link. The Operation Aurora attack was sobering insofar as it was able to hack some of the most secure networks in the world through persistence.
Operation Aurora occurred 12 years ago. In digital time, that’s ages. But many of the issues that led to Operation Aurora being so successful still remain. Many companies have networks that are filled to the brim with third-party applications. Many networks aren’t actively scanning for potential threats or actively updating their solutions.
If your organization needs a security audit, the time is now — not after a data breach has occurred. Contact Red River today to find out more about protecting your network from threats.
