Russia accused of global net hack attacks

State-sponsored Russian hackers are actively seeking to hijack essential internet hardware, US and UK intelligence agencies say.

The UK’s National Cyber Security Centre (NCSC), the FBI and the US Department of Homeland Security issued a joint alert warning of a global campaign.

The alert details methods used to compromise the networking equipment used to move traffic across the net.

This could be used be used to mount a future offensive, it warned.

Basic weakness
In a press conference about the alert, White House cyber-security co-ordinator Rob Joyce said the US and its allies had “high confidence” that Russia was behind the “broad campaign”.

Intelligence gathered by the US and UK suggested that millions of machines directing data around the net were being targeted, he said.

Compromised devices were used to look at data passing through them, added Mr Joyce. Attackers also sought to undermine the firewalls and intrusion detection systems organisations used to spot malicious traffic before it reached users.
Analysis
By Gordon Corera, Security correspondent
It is possible that Russian intrusions may be increasing. But it is too early to know for sure if this is the case, since it takes time to spot this – if it is spotted at all – and to be sure it is Russian.

The crucial thing is whether Russia actually employs its offensive capability to actually do something destructive.

So far, there has been relatively little sign of this in the US or UK, although Russia is accused of launching destructive attacks against Ukraine.

It is worth saying that Britain and the US will be carrying out almost identical activities in Russia, pre-positioning in Russian networks to be able to respond.

What no-one is quite sure of is whether this creates a deterrent a bit like mutually assured nuclear destruction in the Cold War.




Read Gordon’s full blog

In addition, Mr Joyce said, many different organisation had come under attacks for months at a time in a bid to scoop up valuable intellectual property, business information or to get at their customers.

“When we see malicious cyber-activity ,whether Kremlin or other nation state actors, we are going to push back,” said Mr Joyce.

Ciaran Martin, head of the UK’s NCSC, said the issuing of the alert marked a “significant moment” as the two powers had never before given joint advice on how to deal with attacks.

“Many of the techniques used by Russia exploit basic weaknesses in network systems,” said Mr Martin.

The principal targets of the global campaign were internet service providers, firms running critical infrastructure, government departments and large companies, the alert stated.

And it contained detailed information about attack methods, the signs left when hardware has been compromised, and how networks change when they have been breached.

The advice given to firms has included ways to configure their systems correctly and how to apply patches to address hardware vulnerabilities.

Mr Martin said GCHQ, NCSC’s parent organisation, had tracked the threat posed by Russian cyber-gangs for more than 20 years. Further intelligence about the attacks had been added by “multiple” cyber-security organisations and companies, he added.

The UK was working with America, its other allies and the technology industry to “expose Russia’s unacceptable cyber-behaviour, so they are held accountable for their actions”, said Mr Martin.

Source:BBC