Signs of OPM Hack at Another Federal Agency Turn Out to Be Legitimate Files (UPDATED)

Update June 25: The National Archives and Records Administration now says the U.S. Computer Emergency Readiness Team has determined the indicators of compromise detected on agency workstations turned out to be legitimate files not associated with the OPM hack. The original story follows below with some altered language to account for this fact.

The National Archives and Records Administration recently detected unauthorized activity on three desktops indicative of the same hack that extracted sensitive details on millions of current and former federal employees, government officials said Monday. The revelation suggests the breadth of one of the most damaging cyber assaults known may be wider than officials have disclosed. 

The National Archives' own intrusion-prevention technology successfully spotted the so-called indicators of compromise during a scan this spring, said a source involved in the investigation, who was not authorized to speak publicly about the incident. The discovery was made soon after the Department of Homeland Security's U.S. Computer Emergency Readiness Team published signs of the wider attack -- which targeted the Office of Personnel Management -- to look for at agencies, according to NARA. 

It is unclear when suspicious activity was detected on NARA.

Suspected Chinese-sponsored cyberspies reportedly had been inside OPM's networks for a year before the agency discovered what happened in April. Subsequently, the government uncovered a related attack against OPM that mined biographical information on individuals who have filed background investigation forms to access classified secrets.

The National Archives has found no evidence the meddling allowed "administrative access," or taking control, of systems, but files were found in places they did not belong, the investigator said.

NARA "systems" and "applications" were not compromised, National Archives spokeswoman Laura Diachenko emphasized to Nextgov,  “but we detected IOCs," indicators of compromise, "on three workstations, which were cleaned and re-imaged," or reinstalled. 

"Other files found seemed to be legitimate," such as those from a Microsoft website, she said. "We have requested further guidance from US-CERT on how to deal with these" and are still awaiting guidance on how to proceed. 

It will take additional forensics assessments to determine whether attackers ever "owned" the National Archives computers, the investigator said. 

Diachenko said, "Continued analysis with our monitoring and forensic tools has not detected any activity associated with a hack," including alerts from the latest version of a governmentwide network-monitoring tool called EINSTEIN 3A.

EINSTEIN, like NARA's own intrusion-prevention tool, is now configured to detect the tell-tale signs of the OPM attack.

"OPM isn't the only agency getting probed by this group," said John Prisco, president of security provider Triumfant, the company that developed the National Archives’ tool. "It could be happening in lots of other agencies."

Prisco said he learned of the incident at a security industry conference June 9, from an agency official the company has worked with for years.

"They told us that they were really happy because we stopped the OPM attack in their agency," Prisco said.  

The malicious operation tries to open up ports to the Internet, so it can excise information, Prisco said.

“It's doing exploration work laterally throughout the network and then it's looking for a way to communicate what it finds back to its server,” he added.

Homeland Security officials on Monday would not confirm or deny the situation at the National Archives. DHS spokesman S.Y. Lee referred to the department’s earlier statement about the OPM hack: “DHS has shared information regarding the potential incident with all federal chief information officers to ensure that all agencies have the knowledge they need to defend against this cybersecurity incident.”

UPDATED: DHS now "has deemed the files found on NARA's computers to be legitimate files and not associated with the OPM incident," Diachenko said. "NARA is partnering with DHS and US-CERT pro-actively to ensure that NARA systems are protected to the fullest extent possible." On Thursday, Triumfant technical experts on contract at NARA, who operate the agency's internal intrusion-prevent tool, said it is much better to be safe than sorry in situations such as this one. "The thing to keep in mind is that even though these files were deemed legitimate, there is no telling whether they could have been combined with other files and become malicious," Prisco said.  "The success story is that files deemed anomalous were identified and the systems were cleaned."

The assault on OPM represents the seventh raid on national security-sensitive or federal personnel information over the past year.

Well-funded hackers penetrated systems at the State Department, the White House, U.S. Postal Service and, previously in March 2014, OPM. Intruders also broke into networks twice at KeyPoint Government Solutions, an OPM background check provider, and once at USIS, which conducted most of OPM's employee investigations until last summer.

On Wednesday, the House Oversight and Government Reform Committee is scheduled to hold a hearing on the OPM incident that, among other things, will examine the possibility that hackers got into the agency’s systems by using details taken from the contractors.

(Image via Ben Shafer/ Shutterstock.com)