What you need to know about the biggest hack of the US government in years
A vast trove of US government emails has been targeted in a hack thought to have been carried out by Russia, American officials revealed on Monday.
The stunningly large and sophisticated operation reportedly targeted federal government networks and marks the biggest cyber-raid against US officials in years. The treasury and commerce departments were both affected and others may have been breached.
Hackers gained entry into networks by getting more than 18,000 private and government users to download a tainted software update. Once inside, they were able to monitor internal emails at some of the top agencies in the US.
Here’s what you need to know, and what comes next.
What happened?
The hack began as early as March, when malicious code was sneaked into updates to popular software called Orion, made by the company SolarWinds, which monitors the computer networks of businesses and governments for outages.
That malware gave elite hackers remote access to an organization’s networks so they could steal information.
Doing so may not have been difficult. Vinoth Kumar, a security researcher, told Reuters that, last year, he alerted the company that anyone could access SolarWinds’update server by using the password “solarwinds123”.
The breach was not discovered until the prominent cybersecurity company FireEye, which itself also uses SolarWinds, determined it had experienced a breach by way of the software. FireEye has not publicly blamed its own breach on the SolarWinds hack, but it reportedly confirmed that was the case to the tech site Krebs On Security on Tuesday.
The apparent months-long timeline gave the hackers ample time to extract information from many targets. Government officials have not yet stated which agencies were affected but the Centers for Disease Control and Prevention, the state department, and the justice department all use the software in question.
Charles Carmakal, a FireEye executive, said the company was aware of “dozens of incredibly high-value targets” compromised by the hackers and was helping “a number of organizations respond to their intrusions”. He would not name any but said he expected many more to learn in coming days that they, too, had been infiltrated.
Who has been affected, and how bad is it?
The scale of the hack is potentially global and, because the affected software touches many parts of a business, potentially devastating for organizations.
SolarWinds, of Austin, Texas, provides network-monitoring and other technical services to hundreds of thousands of organizations around the world, including most Fortune 500 companies and government agencies in North America, Europe, Asia and the Middle East.
Its compromised product, Orion, accounts for nearly half of SolarWinds’ annual revenue (the company has brought in more than $750m this year). Orion’s centralized monitoring looks for problems in an organization’s computer networks, which means that breaking in gave the attackers a “God view” of those networks.
“These types of tools are allowed deep access to systems,” said Brandon Hoffman, the chief information security officer at the California-based IT provider Netenrich. “The reason these systems are good targets is because they’re deeply embedded in systems operations and administration.”
SolarWinds said it sent an advisory to about 33,000 of its Orion customers who might have been affected, though it estimated a smaller number of customers – fewer than 18,000 – had actually installed the compromised product update earlier this year.
Neither SolarWinds nor US cybersecurity authorities have publicly identified which organizations were breached. Just because a company or agency uses SolarWinds as a vendor doesn’t necessarily mean it was vulnerable to the hacking.
FireEye described the malware’s dizzying capabilities – from initially lying dormant up to two weeks to hiding in plain sight by masquerading its reconnaissance forays as Orion activity. SolarWinds is working with FireEye as well as the FBI, the intelligence community, and other law enforcement to investigate the breach, said Kevin Thompson, the CEO and president of SolarWinds.
Because this software monitors entire networks, a large share of what companies and organizations do online is at risk of a breach. The hackers may have been monitoring email and other internal communications.
Who is behind the hack?
SolarWinds said it was advised that an “outside nation-state” had infiltrated its systems with malware. Neither the US government nor the affected companies have publicly said which nationstate they think is responsible.
A US official, speaking on condition of anonymity because of an ongoing investigation, told the Associated Press on Monday that Russian hackers were suspected. Russia said Monday it had “nothing to do with” the hacking.
“Once again, I can reject these accusations,” the Kremlin spokesman Dmitry Peskov told reporters. “If for many months the Americans couldn’t do anything about it, then, probably, one shouldn’t unfoundedly blame the Russians for everything.”
The infiltration tactic involved, known as the “supply-chain” method, recalled the technique Russian military hackers used in 2016 to infect companies that do business in Ukraine with the hard-drive-wiping NotPetya virus – the most damaging cyber-attack to date.
“We believe that this vulnerability is the result of a highly-sophisticated, targeted and manual supply chain attack by a nation-state,” SolarWind’s Thompson said.
Why do hacks like this matter, and what could happen next?
Espionage does not itself violate international law – and cyber-defense is hard. But retaliation against governments responsible for egregious hacks happens. Diplomats can be expelled. Sanctions can be imposed.
The Obama administration expelled Russian diplomats in retaliation for Kremlin military hackers’ meddling in Donald Trump’s favor in the 2016 election.
Cybersecurity “has not been a presidential priority” during the Trump administration and the outgoing president has been unable or unwilling to hold Russia to account for aggressive action in cyberspace, said Chris Painter, who coordinated cyber policy in the state department during the Obama administration.
“I think that contributes to Russia’s bravado,” he said. The Biden national security team has indicated it will be less tolerant and is expected to restore the position of the White House cybersecurity coordinator, eliminated by Trump.
The greater White House cybersecurity focus will be crucial, industry experts say.
An advisory issued by Microsoft, which assisted FireEye in the hack response, said it had “delivered more than 13,000 notifications to customers attacked by nation-states over the past two years and observed a rapid increase in [their] sophistication and operational security capabilities”.
SolarWinds may face legal action from private customers and government entities affected by the breach. The company filed a report with the Securities and Exchange Commission on Tuesday detailing the hack.
In it, the company said total revenue from affected products was about $343m, or roughly 45% of the firm’s total revenue. SolarWinds’ stock price has fallen 25% since news of the breach first broke.