The Hack Roundup: Biden Orders Intel Assessment of Suspected Russian Malfeasance

President Joe Biden has directed the intelligence community to evaluate the widespread intrusion into federal agencies and U.S. tech companies connected to IT management company SolarWinds as part of a larger look into reports of Russian misdeeds.  

White House Press Secretary Jen Psaki fielded questions about how the administration intends to respond to the hacking campaign, which key agency leaders have said is of “likely Russian” origin, in her first two press briefings.

“We reserve the right to respond at a time and in a manner of our choosing to any cyberattack,” Psaki said Wednesday. On Thursday, she added the president “is issuing a tasking to the intelligence community for its full assessment of the SolarWinds cyber breach, Russian interference in the 2020 election, its use of chemical weapons against opposition leader Alexei Nevalny and the alleged bounties on U.S. soldiers in Afghanistan.”

The U.S. also seeks to extend a nuclear arms reduction agreement—New START—it entered with Russian in 2010, Psaki said, noting this was especially important given the Kremlin’s current adversarial posture.

“Even as we work with Russia to advance US interests so too we work to hold Russia to account for its reckless and adversarial actions,” she said.

Russia has denied responsibility for the hacking campaign. 

Representative Jim Langevin, D-R.I., chairman of a key Defense subcommittee and a member of the Cyberspace Solarium Commission, welcomed both the call for the SolarWinds review and the desire to extend the nuclear nonproliferation treaty. However, he cautioned the administration to pay attention to clear differences between the two policy areas.

“It is important to recognize—as we lay out in the Solarium Commission report—the difference between nuclear and cyber deterrence,” he told Nextgov. “Whereas nuclear deterrence has historically relied on drawing clear red lines, cyber conflict has, to date, almost exclusively existed in the ‘gray zone’ below the level of war. The diverse array of effects that can be achieved with cyber tools is why building up our resilience and developing norms of responsible state behavior are so important—we can’t simply rely on the threat of cost imposition after the fact.”

Langevin’s optimism about the intelligence review included an expectation that it would take a more comprehensive approach, and not be limited to computer screens and code.

“I have the utmost respect for [Director of National Intelligence Avril Haines], and I am confident she will lead a thorough review of any intelligence failures that may have allowed the Russians to infest our supply chain,” he said. “In particular, I hope that Director Haines does not confine her review to any missed cyber forensics. We need to do a much better job marshaling all-source intelligence to defeat cyber threats. For a campaign as pervasive as SolarWinds, there are doubtless clues that go far beyond zeroes and ones, and our intelligence community must spend more of an effort connecting those dots.” 

Cybersecurity experts pushed back on a Thursday New York Times report that more than a thousand Russian software engineers were likely involved in the SolarWinds campaign, in which the paper cited intelligence officials. 

“This number isn’t credible as presented, & if this is what our government really thinks & the advice it is getting is pushing this “>1000 engineers” number, we will not have the right risk assessment to prep for the next attack adequately,” Luta Security founder and CEO Katie Moussouris tweeted in reaction to the report. “Hacker hyperbole harms more than helps.”

Moussouris noted the role media reports play in shaping policy and flagged misdirection of officials’ attention as an undesirable consequence.

“While the inflation of the number of software engineers in one espionage campaign might seem innocuous, remember Gov is itching to respond to #SolarWinds & whatever media chooses to amplify, present without evidence, debunk, or bury will help set direction in real response policy,” she wrote. “It has been my direct experience that media setting misleading narratives send policy makers & lawmakers off chasing the wrong bits first, materially damaging both the US & world readiness to meet the real challenges.”

The assessment by U.S. officials that the hacking campaign was “likely Russian” in origin followed news reports by major outlets citing anonymous sources on Russian involvement.

FireEye, the cybersecurity intelligence firm that uncovered the SolarWinds compromise, continues to resist attributing the hack to Russia, although it said the sophisticated nature of techniques used suggest a nation-state was responsible.  

Security firm Symantec revealed more about how the perpetrators went about sending data from victim systems to themselves through randomly generated URL paths. On Friday the firm published a final installation in a series of blogs deciphering the techniques used by the SolarWinds hackers. According to the latest blog, the hackers used different methods to mask their activity, including ones beyond encryption, based on the amount of data they were removing.

“Instead of sending the encrypted data directly, as when the data is greater than 10,000 bytes, the data is steganographically sent,” the firm explained. 

Where encryption scrambles data so it’s indecipherable without a key, steganography refers to hiding the data as it’s transported in another vehicle. In cases where under 10,000 bytes were being exfiltrated, the hackers masqueraded them as an innocent clump of the data format JSON, which is commonly used to communicate between servers and browsers and is not dependent on any particular programming language. 

Microsoft promoted its own security tools in a post Wednesday delving into the second phase of the hacking campaign, where the perpetrators established command and control of target systems and moved laterally within organizations’ networks.

Microsoft warned that the goal of the threat actor is likely to remain in organizations’ networks for as long as possible without being detected, necessitating extended detection and response, or XDR tools.

“Affected organizations without an XDR solution like Microsoft 365 Defender in place will have a difficult job of performing incident response,” the post reads. “Modern attacks like Solorigate highlight the need for organizations to use advanced security solutions like Microsoft 365 Defender and Azure Sentinel and operate security response under an 'assume breach' mentality.”