outbrain
Close  

NSA: Russian agents have been hacking major email program

/ 08:39 AM May 29, 2020

This Feb 23, 2019, file photo shows the inside of a computer in Jersey City, N.J. The U.S. National Security Agency said Thursday, May 28, 2020, the same Russian military hacking group that interfered in the 2016 presidential election and unleashed a devastating malware attack the following year has been exploiting a major email server program since last August or earlier. (AP Photo/Jenny Kane, File)

BOSTON — The U.S. National Security Agency says the same Russian military hacking group that interfered in the 2016 presidential election and unleashed a devastating malware attack the following year has been exploiting a major email server program since last August or earlier.

The timing of the agency’s advisory Thursday was unusual considering that the critical vulnerability in the Exim Mail Transfer Agent — which mostly runs on Unix-type operating systems — was identified 11 months ago when a patch was issued.

ADVERTISEMENT

Exim is so widely used — tough far less known than such commercial alternatives as Microsoft’s proprietary Exchange — that some companies and government agencies that run it may still not have patched the vulnerability, said Jake Williams, president of Rendition Infosec and a former U.S. government hacker.

It took Williams about a minute of online probing on Thursday to find a potentially vulnerable government server in the U.K.

FEATURED STORIES

He speculated that the NSA might have issued to advisory to publicize the IP addresses and a domain name used by the Russian military group, known as Sandworm, in its hacking campaign — in hopes of thwarting their use for other means.

The Exim exploit allows an attacker to gain access using specially crafted email and install programs, modify data, and create new accounts — gaining a foothold on a compromised network.

The NSA did not say who the Russian military hackers have targeted. But senior U.S. intelligence officials have warned in recent months that Kremlin agents are engaged in activities that could threaten the integrity of the November presidential election.

Sandworm agents, tied to Russia’s GRU military intelligence arm, wreaked havoc on the 2016 U.S. presidential election, stealing and exposing Democratic National Committee emails and breaking into voter registration databases.

They also have been blamed by the U.S. and U.K. governments for the June 2017 NotPetya cyberattack, which targeted businesses that operate in Ukraine. It caused at least $10 billion in damage globally, most notably to the Danish shipping multinational Maersk.

ADVERTISEMENT
TOPICS: Crime, Exim, hacking, Internet, Military, NSA, Russia, security, technology, US
Read Next
EDITORS' PICK
MOST READ
Don't miss out on the latest news and information.
View comments

Subscribe to INQUIRER PLUS to get access to The Philippine Daily Inquirer & other 70+ titles, share up to 5 gadgets, listen to the news, download as early as 4am & share articles on social media. Call 896 6000.

For feedback, complaints, or inquiries, contact us.


© Copyright 1997-2020 INQUIRER.net | All Rights Reserved

We use cookies to ensure you get the best experience on our website. By continuing, you are agreeing to our use of cookies. To find out more, please click this link.