This article reposted from today’s news on arstechnica
A hack on the Democratic National Committee has given attackers access to a massive trove of data, including all opposition research into presidential candidate Donald Trump and almost a year’s worth of private e-mail and chat messages, according to a published report.
In an article published Wednesday, The Washington Post reported that researchers with CrowdStrike, the security firm DNC officials hired to investigate and contain the breach, determined the intrusions were carried out by two separate hacker groups that both worked for the Russian government. One, dubbed Cozy Bear, gained access last summer and has been monitoring committee members’ e-mail and chat communications. The other is known as Fancy Bear and is believed to have broken into the network in late April. It was the latter intrusion that obtained the entire database of Trump opposition and later tipped off IT team members the network may have been breached.
The DNC intrusion is just one of several targeting US political organizations, the WaPo said, with the networks of Trump, rival presidential candidate Hillary Clinton, and some republican political action committees also being targeted by Russian spies. Details about those campaigns weren’t available. The hackers who penetrated the DNC network were expelled last weekend. No financial and donor information appears to have been taken, leaving analysts to suspect the attack was a case of traditional espionage and not the work of criminal hackers. According to Wednesday’s report:
The intrusions are an example of Russia’s interest in the U.S. political system and its desire to understand the policies, strengths and weaknesses of a potential future president—much as American spies gather similar information on foreign candidates and leaders.
The depth of the penetration reflects the skill and determination of the United States’ top cyber adversary as Russia goes after strategic targets, from the White House and State Department to political campaign organizations.
“It’s the job of every foreign intelligence service to collect intelligence against their adversaries,” said Shawn Henry, president of CrowdStrike, the cyber firm called in to handle the DNC breach and a former head of the FBI’s cyber division. He noted that it is extremely difficult for a civilian organization to protect itself from a skilled and determined state such as Russia.
“We’re perceived as an adversary of Russia,” he said. “Their job when they wake up every day is to gather intelligence against the policies, practices and strategies of the U.S. government. There are a variety of ways. [Hacking] is one of the more valuable because it gives you a treasure trove of information.”
Russian President Vladimir Putin has spoken favorably about Trump, who has called for better relations with Russia and expressed skepticism about NATO. But unlike Clinton, whom the Russians probably have long had in their spy sights, Trump has not been a politician for very long, so foreign agencies are playing catch-up, analysts say.
“The purpose of such intelligence gathering is to understand the target’s proclivities,” said Robert Deitz, former senior councillor to the CIA director and a former general counsel at the National Security Agency. “Trump’s foreign investments, for example, would be relevant to understanding how he would deal with countries where he has those investments” should he be elected, Deitz said. “They may provide tips for understanding his style of negotiating. In short, this sort of intelligence could be used by Russia, for example, to indicate where it can get away with foreign adventurism.”
In a blog post, CrowdStrike co-founder and CTO Dmitri Alperovitch said the two groups identified as being behind the attacks were capable of carrying out attacks that could remain undetected for months or years at a time. He wrote:
In fact, our team considers them some of the best adversaries out of all the numerous nation-state, criminal and hacktivist/terrorist groups we encounter on a daily basis. Their tradecraft is superb, operational security second to none and the extensive usage of ‘living-off-the-land’ techniques enables them to easily bypass many security solutions they encounter. In particular, we identified advanced methods consistent with nation-state level capabilities including deliberate targeting and ‘access management’ tradecraft – both groups were constantly going back into the environment to change out their implants, modify persistent methods, move to new Command & Control channels and perform other tasks to try to stay ahead of being detected. Both adversaries engage in extensive political and economic espionage for the benefit of the government of the Russian Federation and are believed to be closely linked to the Russian government’s powerful and highly capable intelligence services.
Cozy Bear, he said, was the same group that in 2014 successfully infiltrated unclassified networks used by the White House, the State Department, and the Joint Chiefs of Staff. They reportedly have also hacked numerous corporations and businesses in the defense, energy, manufacturing and other industries. He went on to say that Fancy Bear has been in operation since 2000.
“We have identified no collaboration between the two actors, or even an awareness of one by the other,” Alperovitch wrote. “Instead, we observed the two Russian espionage groups compromise the same systems and engage separately in the theft of identical credentials. While you would virtually never see Western intelligence agencies going after the same target without de-confliction for fear of compromising each other’s operations, in Russia this is not an uncommon scenario.”
The CrowdStrike post provided many other technical details, including some of the code used in the attack, the way the groups’ hacking tools communicated over the breached DNC network, and cryptographic hashes, which provide a fingerprint of the various tools.
It’s not the first time, and almost certainly won’t be the last, that hackers have targeted major figures in a US presidential election. In 2008, both computer systems for both the Obama and McCain campaigns were reportedly victims of a sophisticated attack by a then unknown “foreign entity.” The two hacking groups identified by CrowdStrike didn’t appear to work together or to coordinate their attacks.
CrowdStrike said analysts still aren’t sure how the intruders gained access. A leading suspicion is that they targeted DNC employees with spearphishing e-mails that appeared to come from known and trusted people that contained malicious links or attachments. Demonstrating just how advanced such campaigns have become, researchers with security firm Palo Alto Networks said earlier on Wednesday that a Russian hacking group it calls Sofacy sent an unnamed US government agency spearphishing e-mails that appeared to come directly from the compromised account belonging to the Ministry of Foreign Affairs of another government.