Select your localized edition:

Close ×

More Ways to Connect

Discover one of our 28 local entrepreneurial communities »

Be the first to know as we launch in new countries and markets around the globe.

Interested in bringing MIT Technology Review to your local market?

MIT Technology ReviewMIT Technology Review - logo

 

Unsupported browser: Your browser does not meet modern web standards. See how it scores »

George Kurtz, CTO of McAfee Security, revealed new details of the recent attack on Google and other companies in a blog post this afternoon. A “zero-day” bug–a previously undiscovered vulnerability–in Microsoft’s Internet Explorer browser seems to have been a key part of the attack.

The attack on Google’s infrastructure, which Kurtz calls “Operation Aurora,” was able to steal some of the Web giant’s intellectual property, apparently in the process of pursuing access to the e-mail accounts of Chinese human-rights activists. Google has said that the same attack hit at least 20 other large companies.

Yesterday, I reported that the attackers likely used social engineering techniques to get into Google’s infrastructure, and Kurtz’s post confirms this–attackers tricked company employees into clicking malicious links in an e-mail. But once those links were clicked, they activated malware that exploited Internet Explorer.

Kurtz writes:

Our investigation has shown that Internet Explorer is vulnerable on all of Microsoft’s most recent operating system releases, including Windows 7. … While we have identified the Internet Explorer vulnerability as one of the vectors of attack in this incident, many of these targeted attacks often involve a cocktail of zero-day vulnerabilities combined with sophisticated social engineering scenarios. So there very well may be other attack vectors that are not known to us at this time. That said, contrary to some reports our findings to date have not shown a vulnerability in Adobe Reader being a factor in these attacks.

Kurtz doesn’t specify which of the affected companies were infiltrated through the bug in Internet Explorer, but I’m hoping Google wasn’t one of them. Wouldn’t Google’s employees have been using its own Chrome browser?

Microsoft is expected to release more information at this location.

Hear more from Google at EmTech 2014.

Register today

1 comment. Share your thoughts »

Tagged: Google, security, China, surveillance, Internet Explorer

Reprints and Permissions | Send feedback to the editor

From the Archives

Close

Introducing MIT Technology Review Insider.

Already a Magazine subscriber?

You're automatically an Insider. It's easy to activate or upgrade your account.

Activate Your Account

Become an Insider

It's the new way to subscribe. Get even more of the tech news, research, and discoveries you crave.

Sign Up

Learn More

Find out why MIT Technology Review Insider is for you and explore your options.

Show Me
×

A Place of Inspiration

Understand the technologies that are changing business and driving the new global economy.

September 23-25, 2014
Register »