US Presidential Election Hacks Revealed

A leaked top-secret National Security Agency document indicates that Russian hacking efforts around the US presidential election were much broader and more pervasive than originally known, and certainly state-sponsored.

The intelligence document was published by online news outlet The Intercept, just hours before the Justice Department announced charges against a 25-year-old government contractor named Reality Winner for leaking the information.

The document, which was heavily redacted during the process of the Intercept verifying its authenticity with the DoJ, indicates that Russian Military Intelligence executed several spear-phishing attempts against at least 100 state and local voting officials in the week prior to Election Day. It also mounted a cyber-attack on at least one US voting software supplier.

Officials speaking on background to the Intercept noted that there is no evidence that actual election outcomes were affected by the meddling.

However, the document concludes that the situation "raises the possibility that Russian hacking may have breached at least some elements of the voting system, with disconcertingly uncertain results."

The report said that the Russian plan was to gain access to systems at an e-voting vendor, in order to gather information needed to convincingly pose as a representative from that company.

From there, the hackers would send spoof emails purporting to be from the vendor, in an attempt to trick voting officials into opening infected Microsoft Word documents. Those documents in turn would execute malware that would have given the hackers control over the local voting division’s network.

The Report reads:

“Russian General Staff Main Intelligence Directorate actors … executed cyber espionage operations against a named US company in August 2016, evidently to obtain information on elections-related software and hardware solutions. … The actors likely used data obtained from that operation to … launch a voter registration-themed spear-phishing campaign targeting US local government organisations.”

The news comes shortly after Russian President Vladimir Putin suggested that “patriotically minded” private Russian hackers may have been behind the election-season hacking. However, the CIA and other organizations have said that it’s clear that the Kremlin was directly involved, a claim the NSA document backs up.

“The insider threat landscape usually breaks down into three pieces: Malicious insiders, negligent insiders and compromised insiders,” said Morgan Gerhart, vice president at Imperva, via email. “To mitigate the risk, corporations should ask themselves where their sensitive data lies, and invest in solutions that directly monitor who accesses it and how.”

Winner, meanwhile, was arrested in her home recently. The NSA contractor admitted to printing out the document and mailing it to the Intercept. She was easy to track down, being just one of six individuals who had printed the document. She faces a single charge of "gathering, transmitting or losing defense information."

“According to reports, the leaker was identified because of strong audit trails of who accessed what,” said Gerhart. “They can invest in solutions that help them pinpoint critical anomalies that indicate misuse of enterprise data stored in databases, file servers and cloud apps and that also help them to quickly quarantine risky users in order to proactively prevent and contain data breaches. This approach works across careless, compromised and malicious insiders.”

InfoSecurity:

You Might Also Read:

Vladimir Putin & Donald Trump: Relationship Counselling:

Both US Presidential Campaigns Hacked:

 

« US Blames North Korea For Hacking
WannaCry Prompts Microsoft Updates … And A Warning »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

Social-Engineer

Social-Engineer

Social-Engineer is a team of outside–the–box thinkers that share a common focus on human-to-human social engineering.

Exodus Intelligence

Exodus Intelligence

Exodus Intelligence are an industry leading provider of exclusive zero-day vulnerability intelligence, exploits, defensive guidance, and vulnerability research trends.

iLand

iLand

iland is a global cloud service provider of secure and compliant hosting for infrastructure (IaaS), disaster recovery (DRaaS), and backup as a service (BaaS).

Latvian Information & Communications Technology Association (LIKTA)

Latvian Information & Communications Technology Association (LIKTA)

LIKTA brings together leading Latvian companies, organizations and professionals in the field of Information & Communications Technology

Logsign

Logsign

Logsign is a Security Orchestration, Automation and Response (SOAR) platform with next-gen Security Information and Event Management (SIEM) solution.

Medigate

Medigate

Medigate is a dedicated medical device security platform protecting all of the connected medical devices on health care provider networks.

CyberGuru

CyberGuru

CyberGuru is a service provided by CyberSecurity Malaysia specializing in cyber security professional training and development.

Internet Infrastructure Investigation

Internet Infrastructure Investigation

Internet Infrastructure Investigation offers a bespoke Internet Governance Solution to your brands online infringement problems.

Absa Cybersecurity Academy

Absa Cybersecurity Academy

Absa Cybersecurity Academy is an initiative aimed at empowering marginalised South African youths to become certified cybersecurity specialists.

Samurai Digital Consulting

Samurai Digital Consulting

Samurai Digital Security are a cyber and Information security services provider, specialising in penetration testing, incident response, user awareness and information governance solutions.

Qohash

Qohash

With a focus on data security, Qohash supports security, compliance and optimization use cases enhancing your risk management process.

Beacon Technology

Beacon Technology

Beacon Technology offers a comprehensive platform consisting of XDR, VMDR, and Breach and Attack simulation tools.

Myrror Security

Myrror Security

Myrror Security is a software supply chain security solution that aids lean security teams in safeguarding their software against breaches.

Waterleaf International

Waterleaf International

Waterleaf provide advanced network and cybersecurity solutions - informed by data sciences. Transforming Connectivity, Security and Information for Municipalities, Government & Enterprise.

Cybersecurity Elastic Laboratory (CEL)

Cybersecurity Elastic Laboratory (CEL)

CEL specialize in providing top-tier services in vulnerability diagnosis and penetration testing, offering a comprehensive suite of solutions to mitigate cyber risks.

Cyber Dagger

Cyber Dagger

Cyber Dagger is a cybersecurity company driven by a mission to protect digital infrastructures and close the cybersecurity skills gap.