Operation Aurora: The 2010 Attack on Google and Other Companies

On 12 January 2010, Google published a blog post that surprised the technology world. The company said it had detected a highly sophisticated attack on its corporate infrastructure, originating in China, and that at least twenty other large companies had also been targeted. Security vendor McAfee later gave the campaign the name Operation Aurora, and it became one of the first widely discussed examples of what the industry calls an advanced persistent threat.

What Google said

Google's announcement made three main points. First, the attackers had stolen intellectual property from the company. Second, they appeared to have been trying to access the Gmail accounts of Chinese human rights activists, and the company said that two accounts appeared to have been accessed, but that the activity was limited to account information, such as creation dates, and email subject lines rather than message content. Third, Google said it was no longer willing to continue censoring search results in China and would review its operations there.

Other companies named in press reports as targets included Adobe, which confirmed that it had been investigating an incident. Many others did not confirm their involvement.

How the attack worked

The attack followed a pattern that is now familiar:

1. A targeted message. Employees received messages that appeared to come from a trusted contact and contained a link.
2. A booby-trapped web page. Clicking the link loaded a page that exploited a previously unknown vulnerability in Internet Explorer.
3. A foothold. The exploit installed malware, which opened a connection back to the attackers' servers.
4. Quiet movement. From that first computer, the attackers explored the network and looked for systems holding source code and account information.

The Internet Explorer flaw was a zero-day, meaning the vendor had not yet issued a fix. Microsoft released an emergency security update later in January 2010. The German and French governments advised people to consider using a different browser while the flaw remained open, which was a significant public statement at the time.

Why it was a turning point

Before Aurora, many companies treated targeted, state-linked attacks as something that happened to defence contractors and governments. Aurora showed that commercial technology, finance and chemical companies were also being targeted for their intellectual property. It pushed many boards to take security seriously and encouraged companies to share more about the attacks they faced.

Google reacted by rethinking its internal security approach, moving towards models in which no device or user is trusted automatically. In March 2010 it redirected its Chinese search service to servers in Hong Kong, ending self-censorship on the mainland site.

Attribution: handle with care

Google said the attack originated in China. Beyond that, public claims about exactly who was behind it varied, and not all were backed by evidence that could be independently checked. It is better to stick to what was publicly documented than to repeat detailed claims that have never been confirmed.

What small sites can take from this

You may not run a company that a government would target, but the techniques involved are the same ones used in everyday attacks on small business sites:

• Phishing works on smart people. A message that looks like it comes from a colleague or supplier is hard to dismiss.
• Browsers and plugins are an entry point. Outdated software on the computer you use to manage your website is a risk to the website.
• Stolen credentials are the real prize. Once attackers have a login, they do not need an exploit at all.

The long-term effects

The Aurora disclosures had effects beyond the immediate incident. Google later introduced stronger default protections for Gmail, including making encrypted connections the default for all users, a change it announced in the same month as the attack. Over the following years, the company published more detail about attempts to compromise accounts and began warning users when it suspected a state-sponsored attempt on their account.

The incident also gave security teams new vocabulary. Terms such as advanced persistent threat and zero-day moved from specialist circles into boardrooms. It encouraged investment in tools that look for unusual behaviour inside a network, rather than only blocking known threats at the edge. The shift from "keep attackers out" to "assume they may get in and detect them quickly" is one of the lasting changes from this period.

For smaller organisations, this shift translates into simple actions: keep logs, notice when something changes that you did not change yourself, and have a plan for what to do when it does.

The practical lesson for site owners

Keep your browser and operating system up to date on the machine you use to administer your site, enable two-factor authentication on your hosting panel, email and CMS, and be suspicious of unexpected links, even from known senders. Limit who has administrator access and review that list regularly, removing former staff and freelancers as soon as they leave.

Our security page explains the protection layers available on our hosting plans, and our knowledge base covers setting up stronger logins in Plesk.