Do you know what OS the user clicked on was? Was it linux, Windows, OS X, or some other OS?
I believe Google has a lot of Linux in their envirnment. And if it was an inside job they would have known about the version and patch level of Linux.
Just becasue they used messenger to send the link doesn’t mean messenger was the vulnerability.
And if it was Windows (or any OS for that matter) was it a known vulnerability with a fix already available and Google didn’t push it to all their desktops? If so, that is a real concern as Google isn’t properly maintaining their inside environment with current security patches.
Google’s source repository is probably on some variant of Unix - perhaps Linux, perhaps something else. Most all serious s/w shops use some variant of Unix for their servers and their SCM repositories.
Here’s more information on the widespread source-code filching operation out of China:
http://www.wired.com/threatlevel/2010/01/google-hack-attack
The Windows machine penetrated most likely had a SCM client installed, so there was no need to penetrate the Linux/Unix/whatever machine that holds the SCM repository. If you penetrate an authorized client machine, you just invoke the client s/w and use scammed passwords to get in. You really don’t care what the other end of the SCM pipe is - or where it is.
There are known keystroke loggers on Windows XP that MSFT has yet to fix. There are many root kits for Windows you can buy off the shelf once you find a hole - and finding a hole in the Windows platform or third party s/w (in this case, Adobe’s s/w) on Windows isn’t difficult. The phrase “shooting fish in bucket with a shotgun” comes to mind.
This was a classic phishing attack. The user was duped into clicking on a link that took them to a hostile website that took advantage of a BROWSER flaw. While the browser issue is problematic, it wouldn’t have been an issue if the user was more vigilant. It’s very hard to defend against social-engineering attacks since they involve trusted people doing secure things.
Your point about patches is a good one. The browser should have been up-to-date. I doubt Google fell prey to a zero-day attack.