This article is from the source 'nytimes' and was first published or seen on . It last changed over 40 days ago and won't be checked again for changes.

You can find the current article at its original source at http://www.nytimes.com/2014/10/29/technology/russian-government-linked-to-more-cybersecurity-breaches.html

The article has changed 2 times. There is an RSS feed of changes available.

Version 0 Version 1
Russian Government Linked to More Cybersecurity Breaches Online Security Experts Link More Breaches to Russian Government
(about 6 hours later)
SAN FRANCISCO — For the second time in four months, researchers at a computer security company are connecting the Russian government to electronic espionage efforts around the world. SAN FRANCISCO — For the second time in four months, researchers at a computer security company are connecting the Russian government to electronic espionage efforts around the world.
In a report released on Tuesday by FireEye, a Silicon Valley firm, researchers say hackers working for the Russian government have for seven years been using sophisticated techniques to break into an array of computer networks, including systems run by the government of Georgia, other Eastern European governments and militaries, the North Atlantic Treaty Organization and other European security organizations In a report released on Tuesday by FireEye, a Silicon Valley firm, researchers say hackers working for the Russian government have for seven years been using sophisticated techniques to break into computer networks, including systems run by the government of Georgia, other Eastern European governments and militaries, the North Atlantic Treaty Organization and other European security organizations
The report does not cite any direct evidence of Russian government involvement, such as a web server address or the individuals behind the attack, nor does it name the Russian agency responsible. But the researchers have made the government connection because the malicious software, so-called malware, used in the incidents was written during Moscow and St. Petersburg working hours on computers that use Russian language settings and because the targets so closely align with Russian intelligence interests. The report does not cite any direct evidence of Russian government involvement, such as a web server address or the individuals behind the attack, nor does it name the Russian agency responsible. The researchers have made the government connection because the malicious software used in the incidents was written during Moscow and St. Petersburg working hours on computers that use Russian language settings and because the targets closely align with Russian intelligence interests.
“This is state espionage,” Laura Galante, FireEye’s manager of threat intelligence, said in an interview on Tuesday. “This is Russia using its network operations to bolster their key political goals.”“This is state espionage,” Laura Galante, FireEye’s manager of threat intelligence, said in an interview on Tuesday. “This is Russia using its network operations to bolster their key political goals.”
Officials at the Russian Embassy in Washington could not be immediately reached for comment.Officials at the Russian Embassy in Washington could not be immediately reached for comment.
Last year, FireEye acquired Mandiant, the security firm that teamed up with The New York Times to identify the unit of China’s People’s Liberation Army responsible for thousands of cyberattacks on United States companies, government agencies and nongovernmental organizations.Last year, FireEye acquired Mandiant, the security firm that teamed up with The New York Times to identify the unit of China’s People’s Liberation Army responsible for thousands of cyberattacks on United States companies, government agencies and nongovernmental organizations.
FireEye is one of several security firms to tie the Russian government to hacking incidents. In July, three security firms, Symantec, F-Secure and CrowdStrike, also tied a string of coordinated attacks on Western oil and gas companies to Moscow.FireEye is one of several security firms to tie the Russian government to hacking incidents. In July, three security firms, Symantec, F-Secure and CrowdStrike, also tied a string of coordinated attacks on Western oil and gas companies to Moscow.
United States intelligence analysts have long cited Russia as a major concern. One top-secret 2009 National Security Agency intelligence estimate obtained by The New York Times last year named Russia as the most sophisticated adversary for the United States in cyberspace. But diplomatic efforts have predominantly been aimed at curbing digital threats from China.United States intelligence analysts have long cited Russia as a major concern. One top-secret 2009 National Security Agency intelligence estimate obtained by The New York Times last year named Russia as the most sophisticated adversary for the United States in cyberspace. But diplomatic efforts have predominantly been aimed at curbing digital threats from China.
Attacks from hackers in China are typically less sophisticated, but far more prolific than those originating in Russia.Attacks from hackers in China are typically less sophisticated, but far more prolific than those originating in Russia.
The FireEye report notes, however, that it is often difficult to discern between Russian government attacks and attacks conducted by Russian cybercriminals, because there is overlap between Moscow and Russian cybercriminals and patriotic hackers. The FireEye report notes, however, that it is often difficult to discern between Russian government attacks and attacks conducted by Russian cybercriminals.
“You only exist as a significant Russian cybercriminal if you abide by three rules,” said Tom Kellermann, chief cybersecurity officer at Trend Micro, a security firm based in Irving, Tex. “You are not allowed to hack anything within the sovereign boundary; if you find anything of interest to the regime you share it; and when called upon for ‘patriotic activities,’ you do so. In exchange you get ‘untouchable status.'  “ “You only exist as a significant Russian cybercriminal if you abide by three rules,” said Tom Kellermann, chief cybersecurity officer at Trend Micro, a security firm based in Irving, Tex. “You are not allowed to hack anything within the sovereign boundary; if you find anything of interest to the regime you share it; and when called upon for ‘patriotic activities,’ you do so. In exchange you get ‘untouchable status.’ ”
One top-secret 2009 N.S.A. report, for example, named the Russian Nashi, a pro-Kremlin youth group, as the culprit behind the powerful 2007 cyberattacks on Estonia that nearly crippled the Baltic nation.One top-secret 2009 N.S.A. report, for example, named the Russian Nashi, a pro-Kremlin youth group, as the culprit behind the powerful 2007 cyberattacks on Estonia that nearly crippled the Baltic nation.
American officials also said Russian hackers were responsible for a similar attack on Kyrgyzstan in January 2009 that, analysts suspected, was connect to efforts to persuade Kyrgyzstan’s president to evict an American military base there. Shortly after the attacks ceased, Kyrgyzstan announced plans to remove the military base and received $2 billion in aid and loans from Moscow.American officials also said Russian hackers were responsible for a similar attack on Kyrgyzstan in January 2009 that, analysts suspected, was connect to efforts to persuade Kyrgyzstan’s president to evict an American military base there. Shortly after the attacks ceased, Kyrgyzstan announced plans to remove the military base and received $2 billion in aid and loans from Moscow.
Those attacks were distributed denial-of-service, or so-called DDoS attacks, aimed at flooding foreign networks with web traffic to knock them offline. Over the last seven years, FireEye researchers say, Moscow has crafted and honed sophisticated malware tools and deployed them, in many cases undetected, on the networks of its neighbors and adversaries.Those attacks were distributed denial-of-service, or so-called DDoS attacks, aimed at flooding foreign networks with web traffic to knock them offline. Over the last seven years, FireEye researchers say, Moscow has crafted and honed sophisticated malware tools and deployed them, in many cases undetected, on the networks of its neighbors and adversaries.
The espionage campaign, called APT28 by researchers at FireEye, started in 2007. Security researchers say professional hackers have been infecting their targets with malware, using emails containing malicious links and attachments. This malware can change its characteristics over time, making it hard to detect. The espionage campaign, called APT28 by researchers at FireEye, started in 2007. Security researchers say professional hackers have been infecting their targets with malware, using emails containing malicious links and attachments. This malware can change its characteristics, making it hard to detect.
Researchers say the malware is particularly good for creating back doors into computer networks that allow hackers to come and go without being detected. The code is also designed to be flexible, allowing its builders to adjust it and add new features, and it uses encryption to evade security researchers. It was also built to stop running malicious programs the second it recognizes an attempt to reverse-engineer the code, which is a sign that it has been detected.Researchers say the malware is particularly good for creating back doors into computer networks that allow hackers to come and go without being detected. The code is also designed to be flexible, allowing its builders to adjust it and add new features, and it uses encryption to evade security researchers. It was also built to stop running malicious programs the second it recognizes an attempt to reverse-engineer the code, which is a sign that it has been detected.
Ms. Galante said FireEye’s researchers uncovered the campaign on computer networks of some of its clients. They were able to reverse-engineer the code enough to uncover many tools and signatures and unearth more about the people and operation behind it before the malicious programs stopped running.Ms. Galante said FireEye’s researchers uncovered the campaign on computer networks of some of its clients. They were able to reverse-engineer the code enough to uncover many tools and signatures and unearth more about the people and operation behind it before the malicious programs stopped running.
The FireEye research was reported by The Wall Street Journal.The FireEye research was reported by The Wall Street Journal.
The targets, FireEye’s researchers say, include the Ministry of Internal Affairs of Georgia and its Ministry of Defense, journalists writing on Caucasus issues, and the Kavkaz Center, an international news agency focused on issues in Chechnya, Russia, and Islam. Researchers have also tied the campaign to attacks on the governments of Poland and Hungary and an Eastern European government’s ministry of foreign affairs. European security organizations, including NATO, the Organization for Security and Co-operation in Europe and the Baltic Host, a military exercise, have also been targets.The targets, FireEye’s researchers say, include the Ministry of Internal Affairs of Georgia and its Ministry of Defense, journalists writing on Caucasus issues, and the Kavkaz Center, an international news agency focused on issues in Chechnya, Russia, and Islam. Researchers have also tied the campaign to attacks on the governments of Poland and Hungary and an Eastern European government’s ministry of foreign affairs. European security organizations, including NATO, the Organization for Security and Co-operation in Europe and the Baltic Host, a military exercise, have also been targets.
The firm’s researchers also note that the same group has spied on governments and organizations that are not deemed immediate Russian threats, including the Chilean military, the government of Mexico, and the Al-Wayi news organization, a Russian-language magazine aimed at readers in the Middle East. The firm’s researchers also note that the same group has spied on governments and organizations that are not deemed immediate Russian threats, including the Chilean military, the government of Mexico, and the Al-Wayi news organization, a Russian-language magazine for readers in the Middle East.
Those targets are not necessarily outliers, Ms. Galante said, because they would be of interest to any government. What convinced FireEye’s researchers that the campaign was the work of the Russian government, she said, was the malware.Those targets are not necessarily outliers, Ms. Galante said, because they would be of interest to any government. What convinced FireEye’s researchers that the campaign was the work of the Russian government, she said, was the malware.
“The malware indicates a seven-year espionage effort, operating and developed over time,” Ms. Galante said. “This is a professional, well-resourced effort that has been going on for years.”“The malware indicates a seven-year espionage effort, operating and developed over time,” Ms. Galante said. “This is a professional, well-resourced effort that has been going on for years.”