Google says it stopped North Korea hacking Chrome
Two separate groups were targeting the same Google Chrome flaw
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Googlehas confirmed it has patched a serious security vulnerability in its Chrome internetbrowserwhich allowed malicious actors to spy on people and potentially take over their devices.
In ablog post, Adam Weidemann of Google’s Threat Analysis Group said the flaw was being used in the wild as early as January 4 by two separate cybercrime entities.
These two groups are known as Operation Dream Job and Operation AppleJeus, and both have, allegedly, strong ties to the government of North Korea.
We’re looking at how our readers use VPNs with different devices so we can improve our content and offer better advice. This survey shouldn’t take more than 60 seconds of your time. Thank you for taking part.
Click here to start the survey in a new window«
Cleaning out the clues
According to Google, the two groups were using the same vulnerability, but their approach, as well as targets, differ. The company says that while Operation Dream Job targeted individuals working at major news organizations, domain registrars, hosting providers, and software vendors, Operation AppleJeus targeted people in the cryptocurrency and fintech businesses.
Their methods were different, as well. The former assumed the identities of recruiters, sending fake inquiries for vacant job positions at Google, Oracle, or Disney, and distributing links to websites that imitated Indeed, ZipRecruiter, or DisneyCareers.
These sites were loaded with a hidden iframe which would exploit the flaw and allow for remote code execution.
The latter, on the other hand, did a similar thing by creating fake websites, but it was also compromising legitimate ones and installing the weaponized iframes on them, as well.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
North Korean malware could still pose major threat>Security researchers under attack from North Korea>Microsoft takes down 50 North Korean hacking sites
The researchers are also saying that the groups were good at hiding their traces, once the job was done. If they succeed in executing remote code, they’d seek to gain further access to the target endpoint, after which they’d try to remove all traces of their existence.
“Careful to protect their exploits, the attackers deployed multiple safeguards to make it difficult for security teams to recover any of the stages,” Weidemann writes.
Google says the attackers would have the iframes appear “only at specific times”, and that the victims would be getting unique links that expired once activated. Each step of the attack was encrypted with the AES algorithm, and if one of the steps failed, the entire operation would stop.
The vulnerability was patched on February 14.
Via:The Register
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
Dangerous Android banking malware looks to trick victims with fake money transfers
Sophos Firewall hack on government network used an all-new custom malware
Watch out, Nvidia - new benchmarks suggest Apple M4 Ultra could beat the mighty RTX 4090
