Recorded Future is a real time open source intelligence collection company that determines trends and predictions of emerging threats.
Recorded Future identified the possible exposures of login credentials for 47 United States government agencies across 89 unique domains.
As of early 2015, 12 of these agencies, including the Departments of State and Energy, allowed some of their users access to computer networks with no form of two-factor authentication. The presence of these credentials on the open Web leaves these agencies vulnerable to espionage, socially engineered attacks, and tailored spear-phishing attacks against their workforce.
The damage has yet to be fully realized and cannot be overstated. Where is the White House? Where are the protections? Where is a policy? Major alarm bells as you read on.
From Associated Press:
Tech company finds stolen government log-ins all over Web
WASHINGTON (AP) — A CIA-backed technology company has found logins and passwords for 47 government agencies strewn across the Web – available for hackers, spies and thieves.
Recorded Future, a social media data mining firm backed by the CIA’s venture capital arm, says in a report that login credentials for nearly every federal agency have been posted on open Internet sites for those who know where to look.
According to the company, at least 12 agencies don’t require authentication beyond passwords to access their networks, so those agencies are vulnerable to espionage and cyberattacks.
The company says logins and passwords were found connected with the departments of Defense, Justice, Treasury and Energy, as well as the CIA and the Director of National Intelligence.
From the WSJ: Obama’s Cyber Meltdown
If you thought Edward Snowden damaged U.S. security, evidence is building that the hack of federal Office of Personnel Management (OPM) files may be even worse.
When the Administration disclosed the OPM hack in early June, they said Chinese hackers had stolen the personal information of up to four million current and former federal employees. The suspicion was that this was another case of hackers (presumably sanctioned by China’s government) stealing data to use in identity theft and financial fraud. Which is bad enough.
Yet in recent days Obama officials have quietly acknowledged to Congress that the hack was far bigger, and far more devastating. It appears OPM was subject to two breaches of its system in mid-to-late 2014, and the hackers appear to have made off with millions of security-clearance background check files.
These include reports on Americans who work for, did work for, or attempted to work for the Administration, the military and intelligence agencies. They even include Congressional staffers who left government—since their files are also sent to OPM.
This means the Chinese now possess sensitive information on everyone from current cabinet officials to U.S. spies. Background checks are specifically done to report personal histories that might put federal employees at risk for blackmail. The Chinese now hold a blackmail instruction manual for millions of targets.
These background checks are also a treasure trove of names, containing sensitive information on an applicant’s spouse, children, extended family, friends, neighbors, employers, landlords. Each of those people is also now a target, and in ways they may not contemplate. In many instances the files contain reports on applicants compiled by federal investigators, and thus may contain information that the applicant isn’t aware of.
Of particular concern are federal contractors and subcontractors, who rarely get the same security training as federal employees, and in some scenarios don’t even know for what agency they are working. These employees are particularly ripe targets for highly sophisticated phishing emails that attempt to elicit sensitive corporate or government information.
The volume of data also allows the Chinese to do what the intell pros call “exclusionary analysis.” We’re told, for instance, that some highly sensitive agencies don’t send their background checks to OPM. So imagine a scenario in which the Chinese look through the names of 30 State Department employees in a U.S. embassy. Thanks to their hack, they’ve got information on 27 of them. The other three they can now assume are working, undercover, for a sensitive agency. Say, the CIA.
Or imagine a scenario in which the Chinese cross-match databases, running the names of hacked U.S. officials against, say, hotel logs. They discover that four Americans on whom they have background data all met at a hotel on a certain day in Cairo, along with a fifth American for whom they don’t have data. The point here is that China now has more than enough information to harass U.S. agents around the world.
And not only Americans. Background checks require Americans to list their contacts with foreign nationals. So the Chinese may now have the names of thousands of dissidents and foreigners who have interacted with the U.S. government. China’s rogue allies would no doubt also like this list.
This is a failure of extraordinary proportions, yet even Congress doesn’t know its extent. The Administration is still refusing to say, even in classified briefings, which systems were compromised, which files were taken, or how much data was at risk.
***
While little noticed, the IRS admitted this spring it was also the subject of a Russian hack, in which thieves grabbed 100,000 tax returns and requested 15,000 fraudulent refunds. Officials have figured out that the hackers used names and Social Security data to pretend to be the taxpayers and break through weak IRS cyber-barriers. As Wisconsin Senator Ron Johnson has noted, the Health and Human Services Department and Social Security Administration use the same weak security wall to guard ObamaCare files and retirement information. Yet the Administration is hardly rushing to fix the problem.
Way back in March 2014, OPM knew that Chinese hackers had accessed its system without having downloaded files. So the agency was on notice as a target. It nonetheless failed to stop the two subsequent successful breaches. If this were a private federal contractor that had lost sensitive data, the Justice Department might be contemplating indictments.
Yet OPM director Katherine Archuleta and chief information officer Donna Seymour are still on the job. Mr. Obama has defended Ms. Archuleta, and the Administration is trying to change the subject by faulting Congress for not passing a cybersecurity bill. But that legislation concerns information sharing between business and government. It has nothing to do with OPM and the Administration’s failure to protect itself from cyber attack.
Ms. Archuleta appears before Congress this week, and she ought to remain seated until she explains the extent of this breach. While Russia and Islamic State are advancing abroad, the Obama Administration may have allowed a cyber 9/11 at home.
