NSA warns of ongoing Russian hacking campaign against U.S. systems

US News

[ad_1]

FILE PHOTO: A computer keyboard lit by a displayed cyber code is seen in this illustration picture taken on March 1, 2017. REUTERS/Kacper Pempel/Illustration/File Photo

(Reuters) – The U.S. National Security Agency on Thursday warned government partners and private companies about a Russian hacking operation that uses a special intrusion technique to target operating systems often used by industrial firms to manage computer infrastructure.

“This is a vulnerability that is being actively exploited, that’s why we’re bringing this notification out,” said Doug Cress, chief of the cybersecurity collaboration center and directorate at NSA. “We really want… the broader cybersecurity community to take this seriously.”

You Might Like

The notice is part of a series of public reports by the spy agency, which is responsible for both collecting foreign intelligence and protecting Defense Department systems at home, to share actionable cyber defense information.

Cress declined to discuss which business sectors had been most affected, how many organizations were compromised using the Russian technique, or whether the cyber espionage operation targeted a specific geographic region.

The NSA said the hacking activity was tied directly to a specific unit within Russia’s Main Intelligence Directorate, also known as the GRU, named the Main Center for Special Technologies. The cybersecurity research community refers to this same hacking group as “Sandworm,” and has previously connected it to disruptive cyberattacks against Ukrainian electric production facilities.

Secretary of State Mike Pompeo also called out the same GRU unit in February for conducting a cyberattack against the country of Georgia.

A security alert published by the NSA on Thursday explains how hackers with GRU, Russia’s military intelligence, are leveraging a software vulnerability in Exim, a mail transfer agent common on Unix-based operating systems, such as Linux. The vulnerability was patched last year, but some users have not updated their systems to close the security gap.

“Being able to gain root access to a bridge point into a network gives you so much ability and capability to read email, to navigate across and maneuver through the network,” said Cress, “so it’s more about the danger we’re trying to help people understand.”

Reporting by Christopher Bing; Editing by Dan Grebler

[ad_2]

Read the Original Article Here

Articles You May Like

EXCLUSIVE: Rubio Calls for DOJ to Investigate Planned Parenthood’s Handling of Aborted Baby Tissue
Pilot dropped port anchor in bid to swing ship away from Baltimore bridge, officials say
This Union Is Plotting To Take Over The Auto Industry. Can It Be Done?
Man sees distorted ‘demon-like’ faces because of rare neurological disorder
Chinese-Owned Chemical Giant Expanding Into US Heartland Led By Members Of Communist Party, Influence Orgs

Leave a Reply

Your email address will not be published. Required fields are marked *