What is the method used in the New York Times attack? [closed]

Question

In the recent New York Times attacks, how did the attackers gain access to the server?

Additionally, is there any evidence that these attacks were launched by China, aside from the proxy?

Answer 1

The article you linked to gives as much information as is publicly known. So I'll just quote from there:

Investigators still do not know how hackers initially broke into The Times’s systems. They suspect the hackers used a so-called spear-phishing attack, in which they send e-mails to employees that contain malicious links or attachments. All it takes is one click on the e-mail by an employee for hackers to install “remote access tools” — or RATs.

And also:

The malware was identified by computer security experts as a specific strain associated with computer attacks originating in China.

Which means that this isn't software you're going to find on metasploit. It's something custom that they built.

They set up at least three back doors into users’ machines that they used as a digital base camp. From there they snooped around The Times’s systems for at least two weeks before they identified the domain controller that contains user names and hashed, or scrambled, passwords for every Times employee.

So, 3 employees workstations compromised with RATs (probably via email spear phishing) leveraged to gain access to the domain controller.

While hashes make hackers’ break-ins more difficult, hashed passwords can easily be cracked using so-called rainbow tables — readily available databases of hash values for nearly every alphanumeric character combination, up to a certain length.

Active Directory is known to use unsalted hashes for password storage. There are several methods AD uses for hashing passwords, none of them very secure ... except perhaps as compared to the previous ways Microsoft hashed passwords. Their security is based primarily on the assumption that Windows access controls will prevent the attacker from retrieving the hashes. But if the attacker uses a targeted phishing attack to compromise the workstation of someone who has the necessary access, then AD won't put up much further resistance, and the attacker can then learn everyone's password.

After cracking the passwords stored in AD, the attackers then have the necessary credentials to do whatever they want to do. In this case, read email.