It Became Apparent That Number Of US Federal Agencies Had Been Hacked As Part Of One Of “Worst Ever” Cyber Attacks In History.
Over the weekend of 12-13 December 2020, It Became Apparent That A Number Of US Federal Agencies And Departments Had Been Hacked As Part Of One Of The “Worst Ever” Cyber Attacks In History. The intention of the attack appears to have been to conduct a “high-end espionage operation”, with the goal of stealing government and military secrets. The true scale and significance of the breach remains unknown. However,
The attack has shaken governments around the world, exposing the fact that their defences are not strong enough, and that the security of software suppliers is an issue of vital importance.
What Exactly Was Attacked?
Those responsible for this attack used network support technology provided by a company called SolarWinds as a vehicle to infiltrate government networks, including a vast number of emails. The specific SolarWinds piece of software that was attacked – Orion – is designed to look for problems in an organisation’s computer networks.
Such software was being used by countless government bodies and businesses to run network updates, meaning that users were made vulnerable to supposed network software updates that were in fact malicious attacks. This particular vector enabled the hackers to view classified departmental computer networks.
This copying and theft of data began as early as March. The attackers reportedly inserted their own code into SolarWinds software, which gave the hackers remote access to government networks. The hackers used encryption to cover their tracks, masquerading their activities as reconnaissance operations normally undertaken by the Orion service – one of the reasons it took months to discover what they had done.
The exact content hackers sought, and how successful they were in obtaining it, remains unclear. However, there has been speculation that intelligence surrounding areas such as COVID-19 vaccine data and next-generation weapons systems are some examples of what may have been compromised.
Who Has Been Affected?
In terms of the types of organisations affected, a little under half are software and security companies, the other half being government bodies, think tanks, and contractors providing government security and defence services. Roughly 18,000 users proceeded to install the software update. This number may seem small, but the precious content accessed during this attack represents a sizeable security threat.
Those US government bodies affected include the US Treasury, Department of State, Energy, Commerce, Homeland Security, Transport and the National Institutes of Health. Thousands of SolarWinds clients all over the world, including most Fortune 500 companies, and government agencies in Asia and the Middle East, use their network monitoring software tools. Certain tech companies have also reported being hacked, including FireEye and Microsoft.
Microsoft has revealed that as a result of their attack alone, clients in the US, UK, Belgium, Spain, Canada, Israel and the UAE have been impacted, and that the breadth of countries affected would most likely continue to grow. FireEye, itself a prominent cybersecurity company that also uses SolarWinds service, were the first to become aware of the breach, having themselves been victim of this attack. FireEye said in a statement, “they used a novel combination of techniques not witnessed by us or our partners in the past” launching “a global campaign”.
Who Has Been Deemed Responsible?
Although in the early days following the attack, officials were reluctant to reveal their views on who was responsible. Various US cyber security experts and politicians have since attributed it to Russian state hackers, US Secretary of State, Mike Pompeo, being one of the most recent to do so. Officials are tentatively accusing the well-known group known as Cozy Bear or APT29, who have in the past been accused of attempts to steal COVID-19 vaccine intelligence from Western researchers, and of hacking the White House and Democratic party servers in 2014 and 2015.
What Has Been the Reaction?
In a statement made on December 17th, President-elect Joe Biden said, “My administration . . . will elevate cyber security as an imperative across the government, further strengthen partnerships with the private sector, and expand our investment in the infrastructure and people we need to defend against malicious cyber attacks. But a good defense isn’t enough; we need to disrupt and deter our adversaries from undertaking significant cyber attacks in the first place.”
Silent on the issue for almost a week, on December 19th Donald Trump tweeted: “The Cyber Hack is far greater in the Fake News Media than in actuality. I have been fully briefed and everything is well under control”, going on to argue that it could perhaps be Russia that bears responsibility.
What Are the Attack’s Biggest Implications?
The global ramifications of this attack have exposed the vulnerabilities within the modern technology supply chain. In this case, the chain is controlled by several private technology companies, who in turn control huge swathes of network security systems across the different continents. These systems are in place to protect the public and private sector, which mean if these security networks were to be breached, the ensuing damage would be far reaching and profound.
This situation has arisen because government budgets do not compare to those of big tech companies, causing most governments to be reliant on a small number of external software providers, thus leaving them vulnerable to external hackers.
The supply chain element was indeed the exact feature exploited in the 2016 Russian harddrive-wiping Notpetya virus, the most damaging cyber attack to date. The fact that no effective solution has been reached to eliminate this vulnerability, and that it has been once again exploited, means that future attacks of a similar nature are likely.
That government departments so vital for economic, national and personal security were the target, emphasizes the vital threat posed by cyber espionage today, one that governments must be prepared to meet. It remains to be seen whether this attack will result in US government retaliation of any kind. Although Trump did not launch any such actions during his last weeks in office, diplomatic sanction imposition is not an unheard of response. Indeed, Biden’s above statement may very well have set the stage for such action.
Previously, Obama expelled Russian diplomats after Kremlin military hacking during the 2016 election. It is not inconceivable that Biden could take a leaf out of Obama’s book, having recently pledged a $10 billion spending budget on cyber and Information Technology. The administration is showing clear signs they intend to take offensive cyber seriously.
Such an attack also carries very real potential for increasing tensions between the US and Russia in the future. The consequences of such escalation could be serious in today’s world of silent, hybrid cold warfare and heightened cyber espionage.
Finally, one of the most significant legacies of this attack could be the realisation that cyber must no longer be treated by governments as something unique or separate. Instead, cyber should be treated as a consequential part of wider tensions with Russia and China. The early signs given by the Biden-Harris administration bode well for such a move.
This news was originally published at Global Risk Insights.