Google reveals sophisticated Windows and Android hacking operation | ZDNet
The attackers used a combination of Android, Chrome, and Windows vulnerabilities, including both zero-days and n-days exploits.
Catalin Cimpanu
By Catalin Cimpanu for Zero Day | January 12, 2021 -- 19:59 GMT (19:59 GMT) | Topic: Security
google-android-windows-hacking-campaign.png
Image: Google Project Zero
Google published a six-part report today detailing a sophisticated hacking operation that the company detected in early 2020 and which targeted owners of both Android and Windows devices.
Windows 10 security: 'So good, it can block zero-days without being patched'
Windows 10 security: 'So good, it can block zero-days without being patched'
Systems running the Windows 10 Anniversary Update were shielded from two exploits even before Microsoft had issued patches for them, its researchers have found.
Read More
The attacks were carried out via two exploit servers delivering different exploit chains via watering hole attacks, Google said.
Also: Best VPNs
"One server targeted Windows users, the other targeted Android," Project Zero, one of Google's security teams, said in the first of six blog posts.
Google said that both exploit servers used Google Chrome vulnerabilities to gain an initial foothold on victim devices. Once an initial entry point was established in the user's browsers, attackers deployed an OS-level exploit to gain more control of the victim's devices.
The exploit chains included a combination of both zero-day and n-day vulnerabilities, where zero-day refers to bugs unknown to the software makers, and n-day refers to bugs that have been patched but are still being exploited in the wild.
All in all, Google said the exploit servers contained:
Four "renderer" bugs in Google Chrome, one of which was still a 0-day at the time of its discovery.
Two sandbox escape exploits abusing three 0-day vulnerabilities in the Windows OS.
And a "privilege escalation kit" composed of publicly known n-day exploits for older versions of the Android OS.
The four zero-days, all of which were patched in the spring of 2020, were as follows:
CVE-2020-6418 - Chrome Vulnerability in TurboFan (fixed February 2020)
CVE-2020-0938 - Font Vulnerability on Windows (fixed April 2020)
CVE-2020-1020 - Font Vulnerability on Windows (fixed April 2020)
CVE-2020-1027 - Windows CSRSS Vulnerability (fixed April 2020)
Google said that while they did not find any evidence of Android zero-day exploits hosted on the exploit servers, its security researchers believe that the threat actor most likely had access to Android zero-days as well, but most likely weren't hosting them on the servers when its researchers discovered it.
GOOGLE: EXPLOIT CHAINS WERE COMPLEX AND WELL-ENGINEERED
Overall, Google described the exploit chains as "designed for efficiency & flexibility through their modularity."
"They are well-engineered, complex code with a variety of novel exploitation methods, mature logging, sophisticated and calculated post-exploitation techniques, and high volumes of anti-analysis and targeting checks," Google said.
"We believe that teams of experts have designed and developed these exploit chains," but Google stopped short of providing any other details about the attackers or the type of victims they targeted.
Together with its introductory blog post, Google has also published reports detailing a Chrome "infinity bug" used in the attacks, the Chrome exploit chains, the Android exploit chains, post-exploitation steps on Android devices, and the Windows exploit chains.
The provided details should allow other security vendors to identify attacks on their customers and track down victims and other similar attacks carried out by the same threat actor.
Article title updated shortly after publication, changing the term "massive" to "sophisticated" as there is no information on the scale of this operation to support the initial wording.
Catalin Cimpanu
By Catalin Cimpanu for Zero Day | January 12, 2021 -- 19:59 GMT (19:59 GMT) | Topic: Security
google-android-windows-hacking-campaign.png
Image: Google Project Zero
Google published a six-part report today detailing a sophisticated hacking operation that the company detected in early 2020 and which targeted owners of both Android and Windows devices.
Windows 10 security: 'So good, it can block zero-days without being patched'
Windows 10 security: 'So good, it can block zero-days without being patched'
Systems running the Windows 10 Anniversary Update were shielded from two exploits even before Microsoft had issued patches for them, its researchers have found.
Read More
The attacks were carried out via two exploit servers delivering different exploit chains via watering hole attacks, Google said.
Also: Best VPNs
"One server targeted Windows users, the other targeted Android," Project Zero, one of Google's security teams, said in the first of six blog posts.
Google said that both exploit servers used Google Chrome vulnerabilities to gain an initial foothold on victim devices. Once an initial entry point was established in the user's browsers, attackers deployed an OS-level exploit to gain more control of the victim's devices.
The exploit chains included a combination of both zero-day and n-day vulnerabilities, where zero-day refers to bugs unknown to the software makers, and n-day refers to bugs that have been patched but are still being exploited in the wild.
All in all, Google said the exploit servers contained:
Four "renderer" bugs in Google Chrome, one of which was still a 0-day at the time of its discovery.
Two sandbox escape exploits abusing three 0-day vulnerabilities in the Windows OS.
And a "privilege escalation kit" composed of publicly known n-day exploits for older versions of the Android OS.
The four zero-days, all of which were patched in the spring of 2020, were as follows:
CVE-2020-6418 - Chrome Vulnerability in TurboFan (fixed February 2020)
CVE-2020-0938 - Font Vulnerability on Windows (fixed April 2020)
CVE-2020-1020 - Font Vulnerability on Windows (fixed April 2020)
CVE-2020-1027 - Windows CSRSS Vulnerability (fixed April 2020)
Google said that while they did not find any evidence of Android zero-day exploits hosted on the exploit servers, its security researchers believe that the threat actor most likely had access to Android zero-days as well, but most likely weren't hosting them on the servers when its researchers discovered it.
GOOGLE: EXPLOIT CHAINS WERE COMPLEX AND WELL-ENGINEERED
Overall, Google described the exploit chains as "designed for efficiency & flexibility through their modularity."
"They are well-engineered, complex code with a variety of novel exploitation methods, mature logging, sophisticated and calculated post-exploitation techniques, and high volumes of anti-analysis and targeting checks," Google said.
"We believe that teams of experts have designed and developed these exploit chains," but Google stopped short of providing any other details about the attackers or the type of victims they targeted.
Together with its introductory blog post, Google has also published reports detailing a Chrome "infinity bug" used in the attacks, the Chrome exploit chains, the Android exploit chains, post-exploitation steps on Android devices, and the Windows exploit chains.
The provided details should allow other security vendors to identify attacks on their customers and track down victims and other similar attacks carried out by the same threat actor.
Article title updated shortly after publication, changing the term "massive" to "sophisticated" as there is no information on the scale of this operation to support the initial wording.
