Many of the companies that were attacked used the same source-code management system made by Perforce, a California-based company that makes products used by many large companies. McAfee’s white paper focuses on the insecurities in the Perforce system and provides suggestions for securing it, but McAfee said it will look at other source-code management systems in the future. The paper doesn’t indicate which companies were using Perforce or had vulnerable configurations installed.
As previously reported, the attackers gained initial access by conducting a spear-phishing attack against specific targets within the company. The targets received an e-mail or instant message that appeared to come from someone they knew and trusted. The communication contained a link to a website hosted in Taiwan that downloaded and executed a malicious JavaScript, with a zero-day exploit that attacked a vulnerability in the user’s Internet Explorer browser.
A binary disguised as a JPEG file then downloaded to the user’s system and opened a backdoor onto the computer and set up a connection to the attackers’ command-and-control servers, also hosted in Taiwan.
From that initial access point, the attackers obtained access to the source-code management system or burrowed deeper into the corporate network to gain a persistent hold.
As a security professional I wish to see everyone working for Google's Security department fired. Now.
This attack was a very very retarded attack, and against a competent security setup (Or one at all). This would not have done anything. The attack only exists on Internet Explorer 6, and only on systems prior to Windows Vista (or vista with UAC disabled). This means that the company was retarded enough to use outdated software, and hadn't bothered to upgrade still. Why was Google using Internet Explorer 6, if they are the creators of Google chrome? I'm pretty use they use Google Chrome, and thus the attack was because of an Open Source Software failure (Probably just read the code and was like. Hahahaha this exploit isn't patched).
The next point of failure comes from the company employees themselves. Receiving emails and clicking links to Twain is the biggest fail you could ever accomplish. Its extremely easy to not fall for these hacks. And a single session of security training could have taught all of their employees to not click a email that has a link to Twain. Sadly this attack is the most popular, and it relies on the user to be utterly retarded.
The next step comes from their failure at securing their servers in any method at all. Any were source code is stored, security should be at its highest. There is no reason for a source code server to be completely unsecured, and unencrypted. It makes me cry. Whenever your a company that is as big as Google, even your janitors computer should be 100% protected with the best practices.
In short. Google and several other companies got owned because of their own incompetence. Adobe even got hacked by an exploit in their Adobe Reader program. Its sad to see how many incompetent baboons are in charge of security.
Look at the vulnerability in software employed by thousands of companies.
Perforce runs its software as “system” under Windows, giving malware the ability to inject itself into system-level processes and providing an attacker access to all administrative functions on the system. Although the Perforce documentation for UNIX tells the reader not to run the server service as root, it doesn’t suggest making the same alteration to the Windows service. As a result, the default installation on Windows runs as a local system, or as root.
By default, unauthenticated anonymous users are allowed to create users in Perforce, and no user password is required to create a user.
All information, including source code, that is communicated between the client system and the Perforce server is unencrypted and therefore easily sniffed and compromised by someone on the network.
The Perforce tools use weak authentication, allowing any user to replay a request with a cookie value that is easy to guess and obtain authenticated access to the system to perform “powerful operations” on the Perforce server.
The Perforce client and server store all files in cleartext, allowing easy compromise of all the code in the local cache or on the server.
/facepalm X4908209847290734782973904872
Discuss security failures
