Ransomware attacks take on urgency ahead of vote
A Texas company that sells software that cities and states use to display results on election night was hit by ransomware last week, the latest of nearly 1,000 such attacks over the past year against small towns, big cities and the contractors who run their voting systems.
Many of the attacks are conducted by Russian criminal groups, some with shady ties to President Vladimir Putin’s intelligence services. But the attack on Tyler Technologies, which continued Friday with efforts by outsiders to log into its clients’ systems around the country, was particularly rattling less than 40 days before the election.
While Tyler does not actually tally votes, it is used by election of
ficials to aggregate and report them in at least 20 places around the country — making it exactly the kind of soft target that the Department of Homeland Security, the FBI and U.S. Cyber Command
worry could be struck by anyone trying to sow chaos and uncertainty on election night.
Tyler would not describe the attack in detail. It initially appeared to be an ordinary ransomware attack in which data is made inaccessible unless the victim pays the ransom, usually in harder-to-trace cryptocurrencies. But then some of Tyler’s clients — the company would not say which ones — saw outsiders trying to gain access to their systems Friday, raising fears that the attackers might be out for something more than just a quick profit.
That has been the fear haunting federal officials for a year now: that in the days leading up to the election, or in its aftermath, ransomware groups will try to freeze voter registration data, election poll books or the computer systems of the secretaries of the state who certify election results.
With only 37 days before the election, federal investigators still do not have a clear picture of whether the ransomware attacks clobbering U.S. networks are purely criminal acts seeking a quick payday or Trojan horses for more nefarious Russian interference. But they have not had much success in stopping them. In just the first two weeks of September, another seven U.S. government entities have been hit with ransomware and their data stolen.
“The chance of a local government not being hit while attempting to manage the upcoming and already ridiculously messy election would seem to be very slim,” said Brett Callow, a threat analyst at Emsisoft, a security firm.
The proliferation of ransomware attacks that result in data theft is an evolution in Russian tactics beyond the kind of “hack and leak” events engineered against the Democratic National Committee and Hillary Clinton’s campaign chair, JohnPodesta, in 2016. By design, whether the attacks are criminal or state-sponsored is not
clear, and the attacker does not always have to be successful everywhere. Just a few well-placed ransomware attacks in key battleground states could create the impression that voters everywhere would not be able to cast their ballots or that the ballots could not be accurately counted — what the cybersecurity world calls a “perception hack.”
“We have been hardening these systems since last summer,” Christopher Krebs, who runs the Cybersecurity and Infrastructure Security Agency for the Department of Homeland Security, said this month. He noted that the agency was trying to make sure local election officials printed out their electronic poll books, which are used to check in voters, so that they had a backup.
The United States has made “tremendous progress” in the effort, Krebs added, by “getting on this problem early.”
Still, some officials worry that President Donald Trump’s repeated assertion about the election that “we’re not going to lose this except if they cheat” may be the 2020 equivalent of “Russia, if you’re listening” — seen as a signal to hackers to create just enough incidents to bolster his unfounded claims of widespread fraud.
So far Trump has focused on mail-in ballots and new balloting systems, but on election night there would be no faster way to create turmoil than altering the reporting of the vote — even if the vote itself was free of fraud.
That would be a classic perception hack: If Trump was erroneously declared a winner, for example, and then the vote totals appeared to change, it would be easy to claim someone was fiddling with the numbers.
The Russians tried this and almost got away with it in Ukraine’s presidential election six years ago. That is one reason the FBI warned last week that the days after the election could result in “disinformation that includes reports of voter suppression, cyberattacks targeting election infrastructure, voter or ballot fraud, and other problems intended to convince the public of the elections’ illegitimacy.”
The FBI warning made no mention of Trump’s own declarations that if Biden wins, the election must be illegitimate, or his baseless attacks on the use of mail-in ballots. But Saturday, at a rally in Pennsylvania, the president openly speculated how an uncertain outcome could throw the election into the courts or Congress, both places where he believes he has an advantage.
That is why the surge in ransomware has become such a rising concern. Should an attack be welltimed enough to make it difficult to count votes or certify tallies, it would add to the uncertainty — just what the Russians, and perhaps Trumphimself, are seeking.
Over the past 18 months, cybercriminals — primarily based in Russia and Eastern Europe — have hit the U.S. public sector with more ransomware attacks than in any other period on record, according to Emsisoft, which tracks the incursions. Arecord 966 ransomware attacks hit the U.S. public sector last year — two-thirds of them targeting state or local governments.
Among them: a Texas county that voted for Clinton in 2016 as well as counties that helped determine the 2016 election in Ohio, Pennsylvania, Florida and Georgiaand other cities and counties that will most likely play a critical role in deciding close Senate races in South Carolina, Kentucky, Colorado and Maine in November.
The FBI concluded that ransomware “will likely threaten the availability of data on interconnected election servers” in November, according to a bureau analysis leaked this summer. The agency cited two recent examples: a ransomware attack in Oregon that locked up county computers and crippled backup data and another in Louisiana in which cybercriminals hacked the secretary of state’s offices, then waited three months to detonate their ransomware the week of Louisiana’s statewide elections for governor and legislative seats last November.
The Louisiana election proceeded unscathed because officials had the foresight to separate voter rolls from internal networks. Still, some analysts feared the attack was a dry run for Nov. 3.
Sometimes victims pay — as a small town in Florida did. Sometimes they refuse, as Atlanta did — though it ended up spending more than the ransom demand reconstructing its systems.
The latest victim, Tyler Technologies, has been vague about the details of its attack. Citing a continuing investigation, the company declined to elaborate on the ransom demands, say whether it paid or offer any details about the attackers. And while the company claimed that none of its products “support voting or election systems,” its Socrata dashboard software is used by some election officials to aggregate and share election results.
That display software is precisely the kind of soft target that intelligence agencies warned could be subject to foreign manipulation on Election Day. In the Ukraine case in 2014, Russian hackers got into the software that reported the country’s election results to the media, altering it to falsely claim victory for a far-right candidate. Ukrainians caught the hack just in time and reported the correct results on television that night. Tellingly, Russian state media still reported that the far-right candidate had won the presidency.
It was a classic perception hack because even if the actual ballots are untouched, an attack that delayed the vote or cast doubt on the ultimate results could create enough uncertainty in voters’ minds that somehow the election was illegitimate.
The Republican-led Senate Intelligence Committee report into the 2016 election even warned against the kind of proclamations Trump is making about “rigged” elections from the White House press room and at rallies.
“Sitting officials and candidates should use the absolute greatest amount of restraint and caution if they are considering publicly calling the validity of an upcoming election into question,” the report said, noting that doing so would only be “exacerbating the already damaging messaging efforts of foreign intelligence services.”
Christopher Wray, the FBI director, countered the president’s claims Thursday, telling lawmakers that his agency had “not seen, historically, any kind of coordinated national voter fraud effort in a major election, whether it’s by mail or otherwise.” Hewas immediately attacked by the White House chief of staff, Mark Meadows. “With all due respect to Director Wray, he has a hard time finding emails in his own FBI,” Meadows said on Fox News.
Still, U.S. officials are walking a thin line. They are trying not to ramp up too many fears about ransomware for fear of amplifying the uncertainty.
But at the same time, security researchers have noted with growing alarm that the ransomware attacks hitting U.S. systems are evolving in disturbing ways. Attackers are not just locking up data; they are stealing it, dumping it online in some cases, and selling access to victims’ data on the dark web and privately to nationstate groups. Researchers at Intel471, a threat intelligence firm, recently discovered that Russian cybercriminals had been selling access to victims’ data to North Korean hackers, and Russian cybercriminals have a long track record of working hand in hand with the Kremlin.
“The chance of a local government not being hit while attempting to manage the upcoming and already ridiculously messy election would seem to be very slim.”
Brett Callow, threat analyst at security firm Emsisoft