Pierluigi Paganini July 26, 2016

New evidence collected by investigators suggests that hackers that attacked DNC penetrated deeper than previously thought.

In June, the security research firm CrowdStrike reported on a cyber breach of the Democratic National Committee (DNS).  CrowdStrike’s incident response time discovered not one, but two hacking groups that it considers “some of the best adversaries out of the all the numerous nation-state” groups the company encounters daily – COZY BEAR and FANCY BEAR.  According to the Washington Post, the Russian hackers managed to steal an entire database of opposition research on the presumptive Republican nominee for President Donald Trump.

The breach of DNC servers is just one of many in a long list of attacks against government and political organization around the world.  In February of this year, Director of National Intelligence James Clapper told congress that intelligence officials were already seeing targeting of the 2016 presidential campaigns.  Brian P. Hale, director of public affairs for the agency said, ““We’re aware that campaigns and related organizations and individuals are targeted by actors with a variety of motivations — from philosophical differences to espionage — and capabilities — from defacements to intrusions.” reported the Washington Post.

Now new evidence collected by investigators suggests DNC hackers accessed more information than previously thought.

The alleged state-sponsored hackers that breached a Democratic National Committee consultant’s personal Yahoo Mail account likely accessed private communications in the attempting to defeat Republican nominee Donald Trump.

Yahoo news confirmed the story, reporting that the DNC consultant Alexandra Chalupa received a notification warning from the Yahoo security experts that “strongly suspect that your account has been the target of state-sponsored actors.”

A few weeks after the DNC officials announced the security breach caused by Russian state-sponsored hackers more than 19,000 private DNC messages were leaked online by WikiLeaks. Some messages were sent by DNC officials to deride Democratic candidate Bernie Sanders, their disclosure led to the resignation of Chair Debra Wasserman Schultz.

But investigators believe hackers also compromised personal email account and stoled data from DNC officials’ smartphones.

“But Chalupa’s message, which had not been previously reported, stands out: It is the first indication that the reach of the hackers who penetrated the DNC has extended beyond the official email accounts of committee officials to include their private email and potentially the content on their smartphones.”  reported Yahoo. “After Chalupa sent the email to Miranda (which mentions that she had invited this reporter to a meeting with Ukrainian journalists in Washington), it triggered high-level concerns within the DNC, given the sensitive nature of her work.” “That’s when we knew it was the Russians,” said a Democratic Party source who has knowledge of the internal probe into the hacked emails. In order to stem the damage, the source said, “we told her to stop her research.”

The investigation conducted by the security firm CrowdStrike suggests that Russian government was behind the espionage campaign.

“Two sources familiar with the breach said that the hackers’ reach was far more widespread than initially thought and includes personal data about big party contributors and internal “vetting” evaluations that include embarrassing comments about their business dealings (as well as gossipy internal emails about the private affairs of DNC staffers).” continues the post published by Yahoo. “There are also signs that the hackers have penetrated the personal email of some Clinton campaign staffers—at least those who were in communication with senior DNC staff members.” 

How Wikileaks obtained the information from the alleged Russian hackers?

Some media speculate that the WikiLeaks founder Julian Assange has in the past hosted a talk show on RT, which is the Russian television network.

Whoever is behind the attack, the case demonstrates the potential influence of hackers on the politic of one of the most important governments of the world.

But probably a better security posture of DNC politicians would have protected them from such kind of attacks.

Pierluigi Paganini

(Security Affairs – DNC, Russian hackers)

[adrotate banner=”5″]

[adrotate banner=”13″]