Nicole Perlroth

On Nov. 14, the documents say, dozens of DNC email addresses were on the receiving end of a spearphishing campaign by one of two Russian organizations believed to be responsible for hacking into the committee’s computers during the 2016 presidential election. There is no evidence that the most recent attack was successful.

The documents, filed in federal court in New York, were part of an amended complaint in a lawsuit filed in April that claimed the committee was the victim of a conspiracy by Russian intelligence agents, President Donald Trump’s 2016 campaign and WikiLeaks to damage Hillary Clinton’s presidential run.

The new court filings say the time stamps and contents of the spearphishing emails received in November were consistent with separate cyberattacks around the same time tied to the Russian hacking group known as Cozy Bear, one of the two Russian groups suspected of breaching DNC computers in 2016.

Security researchers believe the hacking attempt against the DNC in November was part of a broader campaign that used decoy emails that appeared to come from the State Department.

That campaign had more than a dozen targets, according to a report by cybersecurity firm FireEye. Researchers believe the goal was to ferret out U.S. foreign policy, particularly on issues related to Africa; Democratic policy positions; and the platforms of 2020 Democratic presidential hopefuls.

FireEye said the attempted hacking of the DNC in November resembled other recent attacks attributed to Cozy Bear, including its “deliberate reuse” of old phishing tactics and reliance on a similar list of victims. But there were a few new wrinkles, including new decoy email addresses and different obfuscation techniques.

The hackers sent some targets of the broader campaign three phishing emails at most. In other instances, they were more aggressive, sending as many as 136 emails to a single organization. In some cases, the malware-laced emails were successful. And once they gained access to a computer network, it was only a matter of hours before they were deploying stealthier hacking tools.

This article originally appeared in <a href="https://www.nytimes.com/2019/01/18/technology/dnc-russian-hacking.html" id="ee851400-427c-3cb9-a2b5-2fb4a63dfe6e">The New York Times</a>.

SAN FRANCISCO — The Democratic National Committee believes it was targeted in a hacking attempt by a Russian group in the weeks after the midterm elections last year, according to court documents filed late Thursday.

DNC Says It Was Targeted Again by Russian Hackers After '18 Election

On Nov. 14, the documents say, dozens of DNC email addresses were on the receiving end of a spearphishing campaign by one of two Russian organizations believed to be responsible for hacking into the committee’s computers during the 2016 presidential race. There is no evidence that the most recent attack was successful.

That campaign had more than a dozen targets, including government agencies, think tanks, law enforcement officials, journalists, military personnel, defense contractors, pharmaceutical companies and transportation officials, according to a report by cybersecurity firm FireEye. Researchers believe the goal was to ferret out U.S. foreign policy, particularly on issues related to Africa; Democratic policy positions; and the platforms of 2020 Democratic presidential hopefuls.

The attackers in November compromised a hospital email server to launch their phishing emails, a common tactic of the Cozy Bear group, said Nick Carr, a senior manager at FireEye.

Cozy Bear hackers are skilled at rummaging through a network without drawing attention, said Matthew Dunwoody, a FireEye security researcher. Once in, they often swap out their phishing tools for malware that can be hard to detect, he said.

FireEye said although Cozy Bear was the likeliest culprit, the firm could not firmly establish who was responsible for the 2018 campaign against the DNC and other targets. CrowdStrike, another cybersecurity firm, also noted an uptick in hacking activity in November, but it could not say definitively that Cozy Bear was to blame.

Cozy Bear, also known by security firms as APT 29 or the Dukes, was one of two Russian groups involved in the 2016 hacking of the DNC. It has not attracted the same scrutiny as the other group, Fancy Bear, or APT 28, which has been linked to a string of cyberattacks against the DNC, the International Olympic Committee and other international organizations.

Cozy Bear has been active since 2016, security researchers say, and has been linked to a coordinated wave of hacking attacks on Democratic Party officials.

The DNC says in the amended complaint that the November campaign was consistent with a continuing push by Russian hackers to target Democratic candidates and party leaders. In 2017, Russian hackers are believed to have attempted a hack of the computer network of former Sen. Claire McCaskill, D-Mo., and the networks of at least two other candidates in the midterm elections.

Trump has long denied any collusion with Russia, and in December several defendants named in the DNC’s lawsuit argued that it should be dismissed because the committee was using it to try to “explain away” the Democratic “candidate’s defeat in the 2016 presidential campaign.”

On Friday, Geoffrey A. Graber, a DNC lawyer, said the committee expected defendants named in the case to file another motion for dismissal soon.

The Russian government has consistently denied hacking the DNC. In a “statement of immunity” from Russia’s Ministry of Justice, Russian authorities argued that even if it were responsible for the hacking, such a “sovereign act” would be considered a “military action” protected by a 1976 law that offers some immunity from lawsuits regarding foreign governments’ actions in the United States.

The FEC made its advisory opinion one month after lawyers for the commission advised it to block a request by the company, Area 1 Security, which had sought to provide services to 2020 presidential candidates at a discount. The FEC lawyers said that Area 1 would be violating campaign finance laws that prohibit corporations from offering free or discounted services to federal candidates. The same law also prevents political parties from offering candidates cybersecurity assistance because it is considered an “in-kind donation.”

The FEC’s green light clears one major administrative roadblock that 2020 candidates faced as they sought assistance from Area 1 in defending against the attacks and disinformation campaigns that plagued 2016. The decision is limited to Area 1 because it already offered similar services to other organizations at the same cost.

Cybersecurity and election specialists say time is running out for campaigns to develop the defenses capable of warding off attacks from sophisticated nation-state actors like Russia and others. In April, Christopher A. Wray, the FBI director, warned that Russian election interference continued to pose a “significant counterintelligence threat” and that Russian efforts in the 2016 and 2018 elections were just “a dress rehearsal for the big show in 2020.”

The 2020 campaigns themselves are unlikely to have the expertise to track disinformation campaigns or to build sophisticated defenses needed to ward off hackers. In most cases, they cannot afford to pay outside experts market rates for such services, as required by federal election laws.

The FEC opinion issued Thursday said Area 1 could provide anti-phishing services to candidates because the company was not offering the campaigns special, discounted pricing, but simply offering the same lower-tier cost that was offered to other organizations of similar size and financial resources. Lawyers for the FEC initially worried that a ruling in favor of Area 1 would create loopholes for other companies looking to offer discounted services to candidates.

Cybersecurity experts say that before the 2020 voting, awareness of hacking threats and disinformation campaigns has increased, but so too has the sophistication of attacks and influence networks online over the past three years.

Ed Felten, an election security expert and computer science professor at Princeton University, said this week that campaigns and voting equipment were unlikely to be prepared to deflect another nation-state cyberattack in the 2020 cycle.

“The bad guys have had more time to spend on this, and more time to develop new tricks,” he said.

At the same time, Felten and others say, the security of election systems is no better off than four years ago.

Sen. Mitch McConnell, the Senate majority leader, has declined to bring election security bills to the Senate floor. That includes a bill introduced last May by Sen. Kamala Harris, D-Calif., a 2020 presidential hopeful, that aimed to mandate new cybersecurity standards, including hand-marked paper ballots, for all federal elections.

This week, a Texas county said it would use paperless voting systems for 2020, a move that some experts have criticized as insecure. Officials in Taylor County defended the move on Monday, saying there were no state or federal mandates that counties use paper backups. They added that the new machines were “highly secure” and had “no remote access.”

Felten and other security experts said weak points in those systems could easily be exploited. Many companies that maintain such machines, and manage software upgrades to them, are mom-and-pop shops that lack the sophistication to monitor or deflect serious threats.

Such attacks are not just hypothetical. Americans still lack a clear understanding of the impact successful Russian attacks had on the 2016 election. Both the special counsel report and leaked National Security Agency documents show that Russian hackers infiltrated the United States’ vast back-end election apparatus, including voter registration databases and electronic pollbook vendors, in 2016.

Among the vendors hacked, NSA documents revealed, was VR Systems, a Florida company that sells electronic check-in systems to states like North Carolina, which experienced significant pollbook failures in Democratic-leaning counties on Election Day.

Now, 16 months from the 2020 election, it is still unclear what, if anything, Russian hackers did with that access in 2016. VR Systems consistently denies its systems were sabotaged. Last April, after the special counsel’s report on election interference, North Carolina state officials acknowledged that they lacked “the necessary technical expertise to forensically analyze the computers.” The Department of Homeland Security started an examination of North Carolina’s 2016 election equipment last month.

This article originally appeared in <a href="https://www.nytimes.com/2019/07/11/technology/2020-campaigns-election-security.html" id="27608ad2-06e2-3d10-acd5-d9cc0d5da79f">The New York Times</a>.

FEC allows security company to help 2020 candidates defend campaigns

SAN FRANCISCO — The Federal Election Commission said Thursday that a Silicon Valley security company could immediately start helping 2020 presidential candidates defend their campaigns from the kinds of malicious email attacks that Russian hackers exploited in the 2016 election.

Politics

Local

World

News

Celebrities

Music

Movies

Entertainment

Sports 

Fashion

Beauty & Health

Relationships & Weddings

Food & Travel

Lifestyle

Domestic

International 

Business

About

Highlights

Selection Criteria

Jury

Terms And Conditions

FAQs

Pulse Influencer Awards

Courses

Careers

Explore categories

Pulse Kenya is the most followed news and entertainment platform in Kenya. It informs and engages young Kenyans around the clock and provides updates by the hour.

Nicole Perlroth

Articles written by the author

DNC Says It Was Targeted Again by Russian Hackers After '18 Election

DNC Says It Was Targeted Again by Russian Hackers After '18 Election

FEC allows security company to help 2020 candidates defend campaigns