Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

In the recent New York Times attacks, how did the attackers gain access to the server?

Additionally, is there any evidence that these attacks were launched by China, aside from the proxy?

share|improve this question

closed as too localized by AJ Henderson, Ninefingers, Iszi, this.josh, Rook Feb 6 '13 at 0:02

This question is unlikely to help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. For help making this question more broadly applicable, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

1  
A 1 minute google search will reveal that this information is not known. The blogosphere is choked to death by pundits who have opinions, but only the culprits know how they obtained access. –  Mark C. Wallace Feb 5 '13 at 18:32

1 Answer 1

The article you linked to gives as much information as is publicly known. So I'll just quote from there:

Investigators still do not know how hackers initially broke into The Times’s systems. They suspect the hackers used a so-called spear-phishing attack, in which they send e-mails to employees that contain malicious links or attachments. All it takes is one click on the e-mail by an employee for hackers to install “remote access tools” — or RATs.

And also:

The malware was identified by computer security experts as a specific strain associated with computer attacks originating in China.

Which means that this isn't software you're going to find on metasploit. It's something custom that they built.

They set up at least three back doors into users’ machines that they used as a digital base camp. From there they snooped around The Times’s systems for at least two weeks before they identified the domain controller that contains user names and hashed, or scrambled, passwords for every Times employee.

So, 3 employees workstations compromised with RATs (probably via email spear phishing) leveraged to gain access to the domain controller.

While hashes make hackers’ break-ins more difficult, hashed passwords can easily be cracked using so-called rainbow tables — readily available databases of hash values for nearly every alphanumeric character combination, up to a certain length.

Active Directory is known to use unsalted hashes for password storage. There are several methods AD uses for hashing passwords, none of them very secure ... except perhaps as compared to the previous ways Microsoft hashed passwords. Their security is based primarily on the assumption that Windows access controls will prevent the attacker from retrieving the hashes. But if the attacker uses a targeted phishing attack to compromise the workstation of someone who has the necessary access, then AD won't put up much further resistance, and the attacker can then learn everyone's password.

After cracking the passwords stored in AD, the attackers then have the necessary credentials to do whatever they want to do. In this case, read email.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.