Budapest Post

Cum Deo pro Patria et Libertate
Budapest, Europe and world news

US Spent Billions On System To Detect Hacks. The Russians Outsmarted It.

US Spent Billions On System To Detect Hacks. The Russians Outsmarted It.

The Russians, whose operation was discovered this month by a cybersecurity firm that they hacked, were good.
When Russian hackers first slipped their digital Trojan horses into federal government computer systems, probably in the spring, they sat dormant for days, doing nothing but hiding. Then the malicious code sprang into action and began communicating with the outside world.

At that moment - when the Russian malware began sending transmissions from federal servers to command-and-control computers operated by the hackers - an opportunity for detection arose, much as human spies behind enemy lines are particularly vulnerable when they radio home to report what they've found.

Why, then, when computer networks at the State Department and other federal agencies started signaling to Russian servers, did nobody in the U.S. government notice that something odd was afoot?

The answer is part Russian skill, part federal government blind spot.

The Russians, whose operation was discovered this month by a cybersecurity firm that they hacked, were good. After initiating the hacks by corrupting patches of widely used network monitoring software, the hackers hid well, wiped away their tracks and communicated through IP addresses in the United States rather than ones in, say, Moscow, to minimize suspicions.

The hackers also used novel bits of malicious code that apparently evaded the U.S. government's multibillion-dollar detection system, Einstein, which focuses on finding new uses of known malware and detecting connections to parts of the Internet used in previous hacks.

But Einstein, operated by the Department of Homeland Security (DHS), was not equipped to find novel malware or Internet connections, despite a 2018 report from the Government Accountability Office suggesting that building such capability might be a wise investment. Some private cybersecurity firms do this type of "hunting" for suspicious communications - maybe an IP address to which a server has never before connected - but Einstein does not.

"It's fair to say that Einstein wasn't designed properly," said Thomas Bossert, a top cybersecurity official in both the George W. Bush and Trump administrations. "But that's a management failure."

The DHS did not respond to a request for comment.

Russia has denied involvement in the intrusions.

The federal government has invested heavily in securing its myriad computers, especially since the extent of the devastating Chinese hack of the Office of Personnel Management was discovered in 2015, when more than 20 million federal employees and others had their personal information, including Social Security numbers, compromised.

But this year's months-long hack of federal networks, discovered in recent days, has revealed new weaknesses and underscored some previously known ones, including the federal government's reliance on widely used commercial software that provides potential attack vectors for nation-state hackers.

The Russians reportedly found their way into federal systems by first hacking SolarWinds, a Texas-based maker of network-monitoring software, and then slipped the malware into automatic updates that network administrators, in the federal government and elsewhere, routinely install to keep their systems current. The company reported that nearly 18,000 of its customers may have been affected worldwide.

More broadly, the hack highlighted the struggles of the government's network-monitoring systems to detect threats delivered through newly written malicious code communicating to servers not previously affiliated with known cyberattacks. This is something advanced nation-state hackers, including from Russia, sometimes do - presumably because it makes intrusions harder to detect.

The full scope of the hack remains unknown, though it's clear that a growing number of agencies have been penetrated, including the departments of State, Treasury, Homeland Security and Commerce and the National Institutes of Health. They are among victims that include consulting, technology, telecom, and oil and gas companies in North America, Europe, Asia and the Middle East.

The Pentagon was assessing Tuesday whether there had been intrusions at the sprawling department and what impact they may have had, a spokesman said.

The FBI and Department of Homeland Security are investigating the scope and nature of the breaches, which intelligence officials say were carried out by the Russian Foreign Intelligence Service, the SVR. The U.S. government has not publicly attributed the hacks to anyone.

Emails were one target of the hackers, officials said. Although it's not yet clear what the Russians may be intending to do with the information, their victims, including a variety of State Department bureaus, suggest a range of motives.

At the State Department, they may want to know what policymakers' plans are with respect to regions and issues that affect Russia's strategic interests. At the Treasury, they may have sought insights into potential Russian targets of U.S. sanctions. At the National Institutes of Health (NIH), they may be interested in information related to coronavirus vaccine research.

As the investigative work continues, some lawmakers are focused on probing why and how federal cybersecurity efforts have fallen short despite years of damaging hacks by Russian and Chinese spies and major federal investments in defensive technologies.

Einstein, which was developed by the DHS and is operated by the department's Cybersecurity and Infrastructure Security Agency (CISA), was made to be a backbone of federal protection of civilian agency computers, but the 2018 GAO report found significant weaknesses.

The capability to "identify any anomalies that may indicate a cybersecurity compromise" was planned for deployment by 2022, the report said. It also said network monitoring by individual agencies is spotty. Of 23 federal agencies surveyed, five "were not monitoring inbound or outbound direct connections to outside entities," and 11 "were not persistently monitoring inbound encrypted traffic." Eight "were not persistently monitoring outbound encrypted traffic."

"DHS spent billions of taxpayer dollars on cyber defenses and all it got in return was a lemon with a catchy name," said Sen. Ron Wyden, D-Ore., a member of the Senate Intelligence Committee. "Despite warnings by government watchdogs, this administration failed to promptly deploy technology necessary to identify suspicious traffic and catch hackers using new tools and new servers."

It was not just this administration.

Bossert, who worked on the original Einstein concept in the George W. Bush administration, said the idea was to place active sensors at an agency's Internet gateway that could recognize and neutralize malicious command-and-control traffic. "But the Bush, Obama and Trump administrations," he said, "never designed Einstein to meet its full potential."

CISA officials told congressional staff on a Monday evening call that the system did not have the capacity to flag the malware that was signaling back to its Russian masters.

The officials said federal agencies had not given CISA the information necessary to identify agency servers that should not be communicating with the outside world, said one congressional aide, who spoke on the condition of anonymity to discuss a sensitive matter.

"To CISA, all internal agency computers look the same, and so Einstein only flags samples of known malware or connections to 'known bad' IP addresses," the aide said.

Other cybersecurity experts say the breaches highlight the "desperate" need for a government board that can conduct a deep investigation of an incident such as SolarWind's, whose corrupted patches enabled the compromises - and crucially, make the report public.

"We need people to read the report, and say, 'Oh, wow, we need to secure our [information technology] pipeline,' " said Alex Stamos, head of the Stanford Internet Observatory, a research group. He previously was chief security officer at Facebook and Yahoo.

He said there are "hundreds or thousands of companies" in this space that may have security flaws without knowing. These firms do network monitoring, IT management and log aggregation. "Enterprise IT is a $2 trillion market," Stamos said. "There's no agency in charge of ensuring its security."
AI Disclaimer: An advanced artificial intelligence (AI) system generated the content of this page on its own. This innovative technology conducts extensive research from a variety of reliable sources, performs rigorous fact-checking and verification, cleans up and balances biased or manipulated content, and presents a minimal factual summary that is just enough yet essential for you to function as an informed and educated citizen. Please keep in mind, however, that this system is an evolving technology, and as a result, the article may contain accidental inaccuracies or errors. We urge you to help us improve our site by reporting any inaccuracies you find using the "Contact Us" link at the bottom of this page. Your helpful feedback helps us improve our system and deliver more precise content. When you find an article of interest here, please look for the full and extensive coverage of this topic in traditional news sources, as they are written by professional journalists that we try to support, not replace. We appreciate your understanding and assistance.
Newsletter

Related Articles

0:00
0:00
Close
IMF Upgrades Global Growth Forecast as Weaker Dollar Supports Outlook
House Republicans Move to Defund OECD Over Global Tax Dispute
France Opens Criminal Investigation into X Over Algorithm Manipulation Allegations
Trump Steamrolls EU in Landmark Trade Win: US–EU Trade Deal Imposes 15% Tariff on European Imports
ChatGPT CEO Sam Altman says people share personal info with ChatGPT but don’t know chats can be used as court evidence in legal cases.
Intel Reports Revenue Beats but Sees 81% Rise in Losses
Politics is a good business: Barack Obama’s Reported Net Worth Growth, 1990–2025
UN's Top Court Declares Environmental Protection a Legal Obligation Under International Law
"Crazy Thing": OpenAI's Sam Altman Warns Of AI Voice Fraud Crisis In Banking
The Podcaster Who Accidentally Revealed He Earns Over $10 Million a Year
UK Government Considers Dropping Demand for Apple Encryption Backdoor
Japanese Man Discovers Family Connection Through DNA Testing After Decades of Separation
Russia Signals Openness to Ukraine Peace Talks Amid Escalating Drone Warfare
Switzerland Implements Ban on Mammography Screening
Pogacar Extends Dominance with Stage Fifteen Triumph at Tour de France
President Trump Diagnosed with Chronic Venous Insufficiency After Leg Swelling
CEO Resigns Amid Controversy Over Relationship with HR Executive
NVIDIA Achieves $4 Trillion Valuation Amid AI Demand
Tulsi Gabbard Unveils Evidence Alleging Political Manipulation of Intelligence During Trump Administration
Centrist Criticism of von der Leyen Resurfaces as she Survives EU Confidence Vote
Trump Announces Coca-Cola to Shift to Cane Sugar in U.S. Production
FIFA Pressured to Rethink World Cup Calendar Due to Climate Change
Zelensky Reshuffles Cabinet to Win Support at Home and in Washington
"Can You Hit Moscow?" Trump Asked Zelensky To Make Putin "Feel The Pain"
Church of England Removes 1991 Sexuality Guidelines from Clergy Selection
Superman Franchise Achieves Success with Latest Release
Hungary's Viktor Orban Rejects Agreements on Illegal Migration
Air India Pilot’s Mental Health Records Under Scrutiny
Jamie Dimon Warns Europe Is Losing Global Competitiveness and Flags Market Complacency
Moonshot AI Unveils Kimi K2: A New Open-Source AI Model
Martha Wells Says Humanity Still Far from True Artificial Intelligence
Nvidia Becomes World’s First Four‑Trillion‑Dollar Company Amid AI Boom
EU Delays Retaliatory Tariffs Amid New U.S. Threats on Imports
Trump Proposes Supplying Arms to Ukraine Through NATO Allies
US Opens First Rare Earth Mine in Over 70 Years in Wyoming
Bitcoin Reaches New Milestone of $116,000
Severe Heatwave Claims 2,300 Lives Across Europe
Declining Beer Consumption Signals Cultural Shift in Germany
Emails Leaked: How Passenger Luggage Became a Side Income for Airport Workers
Polish MEP: “Dear Leftists - China is laughing at you, Russia is laughing, India is laughing”
Western Europe Records Hottest June on Record
BRICS Expands Membership with Indonesia and Ten New Partner Countries
Elon Musk Founds a Party Following a Poll on X: "You Wanted It – You Got It!"
China’s Central Bank Consults European Peers on Low-Rate Strategies
France Requests Airlines to Cut Flights at Paris Airports Amid Planned Air Traffic Controller Strike
Poland Implements Border Checks Amid Growing Migration Tensions
Emirates Airline Expands Market Share with New $20 Million Campaign
Amazon Reaches Milestone with Deployment of One Millionth Robot
Yulia Putintseva Calls for Spectator Ejection at Wimbledon Over Safety Concerns
House Oversight Committee Subpoenas Former Jill Biden Aide Amid Investigation into Alleged Concealment of President Biden's Cognitive Health
×