News World U.S. Homeland Security, many businesses scramble after suspected Russian hack

U.S. Homeland Security, many businesses scramble after suspected Russian hack

The U.S. Department of Homeland Security and thousands of businesses scrambled on Monday to investigate and respond to a sweeping hacking campaign that officials suspect was directed by the Russian government.

Emails sent by officials at DHS, which oversees border security and defence against hacking, were monitored by the hackers as part of the sophisticated series of breaches, three people familiar with the matter told Reuters.

The attacks also hit the U.S. departments of Treasury and Commerce.

Parts of the Defence Department were breached, the New York Times reported late Monday night, while the Washington Post reported that the State Department and National Institutes of Health were hacked.

“For operational security reasons the DoD will not comment on specific mitigation measures or specify systems that may have been impacted,” a Pentagon spokesman said.

Technology company SolarWinds, which was the key steppingstone used by the hackers, said up to 18,000 of its customers had downloaded a compromised software update that allowed hackers to spy unnoticed on businesses and agencies for almost nine months.

The United States issued an emergency warning on Sunday, ordering government users to disconnect SolarWinds software which it said had been compromised by “malicious actors.”

That warning came after Reuters reported suspected Russian hackers had used hijacked SolarWinds software updates to break into multiple American government agencies. Moscow denied having any connection to the attacks.

One of the people familiar with the hacking campaign said the critical network that DHS’ cybersecurity division uses to protect infrastructure, including the recent elections, had not been breached.

DHS said it was aware of the reports, without directly confirming them or saying how badly it was affected.

DHS is a massive bureaucracy among other things responsible for securing the distribution of the COVID-19 vaccine.

The cybersecurity unit there, known as CISA, has been upended by President Donald Trump’s firing of head Chris Krebs after Krebs called the presidential election the most secure in American history. His deputy and the elections chief have also left.

SolarWinds said in a regulatory disclosure it believed the attack was the work of an “outside nation state” that inserted malicious code into updates of its Orion network management software issued between March and June this year.

“SolarWinds currently believes the actual number of customers that may have had an installation of the Orion products that contained this vulnerability to be fewer than 18,000,” it said.

The company did not respond to requests for comment about the exact number of compromised customers or the extent of any breaches at those organisations.

It said it was not aware of vulnerabilities in any of its other products and it was now investigating with help from U.S. law enforcement and outside cybersecurity experts.

SolarWinds boasts 300,000 customers globally, including the majority of the United States’ Fortune 500 companies and some of the most sensitive parts of the U.S. and British governments – such as the White House, defence departments and both countries’ signals intelligence agencies.

Because the attackers could use SolarWinds to get inside a network and then create a new backdoor, merely disconnecting the network management program is not enough to boot the hackers out, experts said.

For that reason, thousands of customers are looking for signs of the hackers’ presence and trying to hunt down and disable those extra tools.

Investigators around the world are now scrambling to find out who was hit.

A British government spokesman said the United Kingdom was not currently aware of any impact from the hack but was still investigating.

Three people familiar with the investigation into the hack told Reuters that any organisation running a compromised version of the Orion software would have had a “backdoor” installed in their computer systems by the attackers.

“After that, it’s just a question of whether the attackers decide to exploit that access further,” said one of the sources.

Early indications suggest that the hackers were discriminating about who they chose to break into, according to two people familiar with the wave of corporate cyber security investigations being launched Monday morning.

“What we see is far fewer than all the possibilities,” said one person. “They are using this like a scalpel.”

FireEye, a prominent cyber security company that was breached in connection with the incident, said in a blog post that other targets included “government, consulting, technology, telecom and extractive entities in North America, Europe, Asia and the Middle East.”

“If it is cyber espionage, then it one of the most effective cyber espionage campaigns we’ve seen in quite some time,” said John Hultquist, FireEye’s director of intelligence analysis.

(Reuters)

Top Stories

Access to Troodos controlled by Police

The Police announced that on the basis of the Health Ministry decrees aiming to contain the outbreak of the pandemic, tomorrow Sunday, access to...

129 new cases, four deaths announced on Saturday

The Health Ministry announced the death of four persons due to COVID-19. This raises the death toll from the virus in Cyprus to 183,...

Crowding at Troodos; lots of fines by police

Lots of traffic was today seen at Troodos. In order to maintain order but also to monitor that people respected the measures aiming to...

Where to get antigen rapid tests on Sunday 24 January

The Health Ministry announced the following antigen rapid test sites for Sunday, 24 January 2021:   LIMASSOL Parking place Lidl supermarket, Limassol 08:30-16:30 Glafkos Clerides Park, Germasoyia 08:30-16:30 Municipal...

Larry King dies at 87

Larry King dies at 87. Photo taken at his concert at Hard Rock Live in Hollywood, Florida on January 25, 2012. (Reuters)

Taste

Squash soup

Ingredients: 1 kg pumpkin, cut into small cubes, approximately 5 cups 2 medium (400g) sweet potatoes, cut into cubes, approximately 2 ½ cups 1 chopped leek, only...

Mezedes

No visit to Cyprus is complete without enjoying the traditional meal of many small dishes known as ‘meze’. This large feast, which has been a...

Prawns with fried cheese, barley shaped pasta

Put the barley shaped pasta into a small pan with salted water, bring to a boil and when tender, drain. Peal the prawns leaving...

Salmon and shrimp sheftalies

Mix all ingredients for tabbouli in a bowl and keep to one side so flavours can combine. Prepare the sheftalies: wash and soak the casing...