How The Hackers Took Google: A Theory

AUSTIN, TX -- Fred Chang has a theory about how hackers affiliated with the Chinese government hacked into Google and at least two dozen other major American companies. Chang  is a professor of computer science at the University of Texas -- so we should listen to him. But he is also the former director of research for the National Security Agency, so he has a pretty good idea of what hackers can do -- and whether these things can be picked up by the government or industry.

Chang says he has no inside or special knowledge, but here is his theory: the hack was much more of a sophisticated intelligence operation than many believed. The first step was espionage and data collection. 

The second step was the hack itself.  Chang believes that the Chinese hackers figured out the identities of the system administrators for various computer networks.  Then, the hackers figured out, using publicly availably Facebook data, the social networks that these systems administrators were part of.

Then, masquerading as these friends, they sent e-mails to the targets with compromised links. E-mails from a trusted source? Ah, but they were spoofed, using a vulnerability in an outdated version of Internet Explorer. 

Unbeknownst to the system administrator, once they clicked on the link, the malware deposited an SSL -- a secure sockets layer -- essentially an encrypted tunnel --  between the host computer and a computer controlled by the hackers. From that point, searching around for passwords and proprietary information was easy.

"This is a huge event in the history of cybersecurity," Chang said, "We'll be talking about this one 30 years from now."

Google suspects that at least a half dozen of its employees were complicit -- or turned by the hackers -- at some point in the process. And, as The Washington Post reported, it has partnered with the National Security Agency to figure out once and for all, from start to finish, how its systems were hacked.