Russia targeting network infrastructure, US and UK officials warn
Connecting state and local government leaders
For more than a year, Russia-aligned cyber entities have been using a series of exploits to target millions of network devices.
Russia has been conducting a coordinated campaign to target and compromise network infrastructure devices -- including routers, switches and other network infrastructure devices -- in home offices, government agencies and critical infrastructure around the globe, officials from the United States and Great Britain said.
The campaign, officials said, involved a range of Russia-aligned cyber entities using a series of exploits to target millions of devices. This “sustained targeting” has been ongoing for more than a year, White House Cyber Coordinator and acting Homeland Security Advisor Rob Joyce said. Targets have included Internet Service Providers, government networks, private-sector firms and critical infrastructure providers.
Although the broad critical infrastructure sector was targeted, officials said they have not witnessed any specific effort to go after election officials or the systems they use.
Activity like this "isn't always to steal information,” said Joyce. “Sometimes [such efforts] are used to facilitate other operations that the Russians can do against high value targets worldwide.”
The full scope and impact of the operation is not fully known, and officials from White House and Department of Homeland Security said they were releasing the information now in the hopes that businesses and other affected entities come forward if they have witnessed similar suspicious activity. While millions of devices were targeted, Jeanette Manfra, assistant secretary for DHS' Office of Cybersecurity and Communications, said only a small number were actually hacked.
“What we can see is targeting and some compromise," Manfra said, "but we need the owners and operators of those devices and systems to work with us to determine the extent of the actual compromise.”
The announcement, made during an April 16 briefing call with reporters, was paired with a joint technical alert issued the same day by the DHS and the UK’s National Cyber Security Centre detailing the devices targeted and avenues for mitigation. Ciaran Martin, chief executive of the UK’s National Cyber Security Centre, said his country has been tracking the activity for close to a year and can independently verify the campaign and its attribution to the Russian government.
Officials said the goals for the operation were varied, including espionage and intellectual property theft, but that it also would give attackers control of the sort of basic infrastructure that might allow them to launch dedicated denial of service attacks, steal intellectual property or lie dormant to facilitate future attacks.
“For this reason, we can’t rule out the possibility Russia may intend to use these set of compromises for future offensive cyber operations as well,” Joyce said.
The announcement comes more than a month after DHS made public a 2016 report and binding operational directive warning government employees that nation states were targeting vulnerable routers and switches as agencies hardened their defenses around computers, laptops and other devices. In a 2016 letter to federal employees, then-DHS Secretary Jeh Johnson noted that “for several years now, network infrastructure devices have been the attack vector of choice” for government-sponsored hacking groups.
Manfra and others said vulnerable network devices are ideal targets because these devices are often not patched or maintained properly, and a compromise gives attackers access to most Internet traffic within an organization and the organizations it communicates with.
“Once you own the router, you own the traffic that’s traversing the router,” said Manfra.
The announcement was characterized as just one step in a series of actions planned by the U.S. and British government.
“We are looking at cybersecurity as something where we need to use asymmetric tools to respond to cyber intrusions, and that means all elements of our national power,” said Joyce. “Whether it is the ability to do deterrence by denial … whether it’s indictments, whether it’s sanctions or whether it is using our capabilities in the offensive [cyber] world.”
This article was first posted to FCW, a sibling site to GCN.