| Information |  | |
Derechos | Equipo Nizkor
| ||
| Information | | |
Derechos | Equipo Nizkor
| ||
13Oct14
Russian hackers use 'zero-day' to hack NATO, Ukraine in cyber-spy campaign
A Russian hacking group probably working for the government has been exploiting a previously unknown flaw in Microsoft's Windows operating system to spy on NATO, the Ukrainian government, a U.S. university researcher and other national security targets, according to a new report.
The group has been active since at least 2009, according to research by iSight Partners, a cybersecurity firm. Its targets in the recent campaign also included a Polish energy firm, a Western European government agency and a French telecommunications firm.
"This is consistent with espionage activity," said iSight Senior Director Stephen Ward. "All indicators from a targeting and lures perspective would indicate espionage with Russian national interests."
There is no indication that the group was behind a recent spate of intrusions into U.S. banks, including JPMorgan Chase, Ward said.
The Russian government has denied similar allegations of cyberespionage in the past. Current and former U.S. intelligence officials, nonetheless, say the capabilities of Russian hackers are on par with those of the United States and Israel.
"It's possible they've become more active in response to the Ukrainian situation," said a former intelligence official. "And when you become more active, you increase your likelihood of getting caught."
ISight dubbed the recently detected hacking group SandWorm because of references embedded in its code to the science-fiction novel "Dune." There were various mentions in Russian to the fictional desert planet of Arrakis, for instance.
The firm began monitoring the hackers' activity in late 2013 and discovered the vulnerability -- known as a "zero-day" -- in August, Ward said. The flaw is pres-ent in every Windows operating system from Vista to 8.1, he said, except Windows XP.
The Ukrainian government was targeted in late August, in the lead-up to the NATO summit in Wales, where member states discussed Russia's actions in Ukraine. Using a technique called spearphishing, SandWorm sent e-mails to targets that appeared to come from legitimate sources but included attachments that, when opened, enabled the hackers to gain access to their computers, Ward said.
Some of the spearphishing e-mails appeared to concern a global security forum on Russia and a purported list of Russian sympathizers or "terrorists," the firm said.
ISight technical analyst Drew Robinson said the firm attributed the campaign to Russia partly because of the targets and partly because the command server, located in Germany, had not been properly secured. The server was inadvertently exposing Russian-language computer files that had been uploaded by the hackers.
"They could have closed it off, and they didn't," he said of the server. "It was poor operational security."
ISight was not able to determine how successful the hackers might have been in obtaining information. But Robinson said that by analyzing the malware files, iSight was able to determine that certain targets -- including Ukrainian government servers -- had been compromised.
SandWorm apparently adapted malware previously used by cybercriminals, probably as a way "to mask" its espionage intents, Ward said.
Microsoft plans to release a patch for the vulnerability Tuesday, as part of the security industry's monthly "Patch Tuesday" -- a coordinated release of fixes to vulnerabilities in software.
A Microsoft spokeswoman said the firm's patch will be released in security bulletin MS14-060.
[Source: By Ellen Nakashima, The Washington Post, 13Oct14]
Privacy and counterintelligence
 | This document has been published on 15Oct14 by the Equipo Nizkor and Derechos Human Rights. In accordance with Title 17 U.S.C. Section 107, this material is distributed without profit to those who have expressed a prior interest in receiving the included information for research and educational purposes. |