Today Cyber Security plays a paramount role in global security. On this blog, the CEO of Paramount Defenses shares rare insights on issues related to Cyber Security, including Privileged Access, Organizational Cyber Security, Foundational Security, Windows Security, Active Directory Security, Insider Threats and other topics.

November 1, 2016

Election Influencing Podesta/DNC Email Hacks, Cyber Attacks and Russia


There is no doubt that the recent email hacks of John Podesta and the DNC will have influenced the U.S. presidential election.

Given my background, I am often privately asked about my thoughts on the Podesta / DNC Email hacks purportedly carried out by Russia. Due to paucity of time, instead of having to respond to this so many times, I figured I'd publicly share a few thoughts.

But first I do wish to make it unequivocally clear that as (the CEO of) not just America's, but possibly the world's most relevant cyber security company today, we are professional, completely unbiased and objective, and this is only a professional opinion.

Disclaimer: My thoughts below are based on a cursory assessment of how Mr. Podesta's email was hacked. It is believed that at the time the DNC was hacked, they too may have been using Gmail, and thus may have been hacked in a similar fashion.

Simple Hacks, Huge Impact

Brass tacks, the Podesta/DNC email hack is simply a case wherein an entity that was engaging in high-value communications using a relatively low-assurance system (i.e. a free/low-cost email service) and insufficient security controls (i.e. not requiring two-factor authentication for password changes/resets) was compromised using simple social engineering involving very basic technical means by a 2nd entity, who in turn purportedly passed the compromised data to a 3rd entity that disclosed it publicly.

The 1st entity was John Podesta / the DNC, purportedly the 2nd entity was Russian hackers, and the 3rd entity was WikiLeaks.

When I say relatively, I mean that compared to (say) an in-house deployed, managed and controlled Active Directory integrated Microsoft Exchange Server based communications infrastructure that also requires 2-factor authentication (i.e. Smartcards), a free/low-cost email service is a relatively low-assurance system, especially when being used for high-value communications.

For those may not know, Mr. Podesta was using a Gmail account; he apparently received a phished email and clicked on a link.

In fairness to Mr. Podesta, apparently his assistant did ask their IT staff about the legitimacy of that phished email, and was told that it seemed legitimate and was okay to click on. In addition, at that point in time, apparently someone did ask as to whether or not two-factor authentication was enabled on his account, and if not, suggested that it be immediately enabled.

All said and done, apparently Mr. Podesta did end up clicking that link and at that very moment his account was compromised.

The rest i.e. the huge impact of the public disclosure of this sensitive data on the U.S. presidential election, is all over the news.

Now, strictly speaking, the only thing that makes this a huge deal is that in this case the compromised data happened to be vast amounts of high-value sensitive, private email conversations of one of two parties contesting an election in a specific country. The actual technical means involved in compromising security here were basic, a 2.5 on a scale of 1 to 10, 1 being very easy.

You see, usually perpetrators begin by trying to phish a target just to gain a foothold inside the organization's network perimeter. However, in a case where emails may be all they're after, and the target's already using a free/low-cost email service, merely step 1, i.e. being able to successfully phish that free/low-cost email service account will get them to mission-accomplished, because once they have compromised that email account, right then and there they have access to all of the account's emails.

Thus, using relatively easily targetable and compromisable free/low-cost email accounts likely increased their risk exposure.

From a professional cyber security standpoint, one of the most fundamental principles of security, the Principle of Adequate Protection, states that "an asset must be protected to a degree consistent with its value". In line with it, ideally entities engaging in high-value communications should be using sufficiently high-assurance systems and employing adequate security controls.   In light of this, in this case, the use of a free/low-cost email service to engage in high-value communications seems perplexing.

If you have high-value/sensitive communications to engage in, please do not use low-assurance / inadequately-secure systems to engage in them. If you must absolutely have to use a low-assurance/free email service such as Gmail for high-value/sensitive communications, at least do enable 2-factor authentication for password changes/resets to protect against phishing attacks.

At the end of the day, it matters not so much as to who compromised you, as it does that someone was able to compromise you. Once you've been compromised, the impact of that breach is purely a function of the perpetrator's motives and actions.

Speaking of Massive Cyber Attacks

Sorry for a brief digression. As a mature cyber security practioner, what I find more amusing than comical write-ups such as this and this is that the recent DoS attacks to hit the U.S. east coast were being referred to as a massive/huge cyber attack.

Don't get me wrong. Those attacks may have been massive/huge in terms of the number of websites they momentarily DOS'ed out, but if you consider the technical mechanics involved, brass tacks, its still just a (large) bunch of old-fashioned basic TCP/IP SYN flooding, using compromised IoT devices. Its fancy, but its still simple stuff with relatively low moment-in-time impact.

To put things in perspective, a massive cyber security attack would be one wherein a proficient adversary such as an advanced persistent threat could gain control over large parts of a country's power-grid, government, security and financial infrastructures. These are the kinds of cyber attacks we (know of and) worry about. In fairness, most cyber security companies aren't there yet.

Speaking of Russia

It is widely suspected that Russia carried out the DNC and Podesta email hacks. No one likely knows the facts, neither do I, so in regards to Russia, I'll share what I do know.

This so-called "hack" was so simple, that possibly even a smart freshman from anywhere in the world could have carried it out.

That said, speaking of Russia and its purported cyber attacks on U.S entities, what should be more concerning (and we know this based on publicly available info) is that most likely, code that was likely either written in Russia or is still being supported / updated from inside Russia, may likely be running in highly privileged security contexts in various parts of the U.S. Government.

(Responsible disclosure: Strictly speaking, there's nothing to disclose here since this info has been publicly available for years, yet out of an abundance of caution, earlier this year we did bring this to the attention of several top U.S. Government officials.)

The Russians are considered to be adept at hacking, so if it was them, I'm surprised that they would resort to using such basic attack vectors (i.e. phishing a Gmail account); I suppose it must be their starting point, and it appears they got lucky at step 1 itself. Now, if their target was a specific Gmail account to begin with, then of course that is exactly where they would start.

An Important Concluding Point

I'd like to make one very simple and important point - it matters not as to who is trying to hack you, because as long as you have digital assets of value to someone, there could be (and likely already are) many entities wanting to hack you, driven by various motives; what matters is that you need to protect yourself from being hacked by anyone in the first place.

In this specific case, although any logical mind can easily see why Russia might stand to gain a lot from the outcome of the U.S. election, one could similarly reason that many other countries in the world could stand to gain much from its outcome as well. In fact, not just countries, many corporations worldwide could stand to gain or lose much based on the outcome of this election.

The point again being that it matters not as to who is trying to hack you (or why), it matters that you protect yourself from being hacked by anyone. Mature entities consider it a norm to assume that they are always operating in a hostile environment with numerous adversaries trying to hack them 365-24-7. That is the unfortunate reality of engaging in business in a digital world.

By the way, I prefer not to use the word hack, because there's a connotation of casualness to it. It would be nice to see the media use professional terms like breach, compromise, security incident etc. as they rightfully have a serious connotation.

As I conclude, I'd like to request all organizations (including of course, all media companies and all cyber security companies) worldwide to look  within and if required, consider bolstering their cyber security defenses and enhancing their security posture.

Best wishes,