Cybersecurity experts are increasingly concerned that both President Barack Obama’s government emails and Hillary Clinton’s private, encrypted email system are too vulnerable to attack by sophisticated hackers who may be working for foreign powers.
Obama carries a specially secured BlackBerry device for top-secret communications. It appears so far to have proved safe from cyber spies.
But a report that last year’s breach of the White House’s unclassified computer system by Russian hackers went deeper than previously acknowledged has caused widespread alarm.
“This attack is a red flag that they really need to improve their security procedures. It’s quite serious,” said Kevin Mitnick, a former hacker who is now a computer security consultant.
Russian hackers broke into the email archives of people in the White House, and possibly beyond, who regularly exchanged correspondence with the president. The hackers were then able to read emails that Obama had sent and received, according to the New York Times.
“It’s not surprising – the government has a huge attack surface where someone can exploit the computer data through a security flaw in the unclassified system,” said Mitnick.
He added that it was difficult to determine how worried to be about the president’s classified communications, however, without testing the system in detail. The public, Mitnick said, would “have to assume it’s safe until proven otherwise”.
“I don’t believe there is anything that’s 100% secure, but the president’s BlackBerry has a level of security that is satisfactory to the NSA,” he said, referring to the National Security Agency.
The government has admitted that Russian hackers attacked systems at the Pentagon, the White House and the State Department. It is not clear whether the hackers in the latest report were connected to the Russian government.
The most serious cyber threats in recent times have emanated from Russia, China and North Korea. Details about the perpetrators remain murky.
“This breach related to the lowest-level unclassified email,” said Jonathan Mayer, a graduate fellow in computer science at Stanford University. “But that said, that can still include very sensitive information, maybe not state secrets, but information that would be of great interest to a foreign nation. It’s unfortunate.”
Controversy continues to rage over Clinton using a private email system while serving as Obama’s secretary of state.
While at the State Department, she secured her online correspondence in a private email infrastructure. Nicknamed her “home brew” system, it nonetheless has sophisticated cyber “shields” to protect it from prying eyes.
The private clintonemail.com domain that was used by Clinton to conduct her government business on US and foreign soil for four years is still in use.
As of earlier this year she had “parked” the “www.” subdomain of clintonemail.com at hosting provider Network Solutions, in a way that was barely active but was still collecting advertising revenue, the Guardian reported. Since then it has been changed to become more dormant. It is not known what function www.clintonemail.com ever served for Clinton.
According to cybersecurity researcher John Bumgarner, however, she is probably still using the encrypted email system associated with the domain, mail.clintonemail.com, though it is not clear to what extent.
“Hackers from all over the world have probably looked at the security of this thing and tried to figure out a way to get through it,” he said.
“Now that she is running for president, I would guess she would not be using this system as much. Potentially she is vulnerable to some kind of hack – but there have probably been a lot of things thrown at this website, and it has still not been knocked offline or broken into.”
He added: “I’m concerned that it potentially could have been penetrated while she was secretary of state.”
Experts are trying to work out how top-level hackers in the latest reported breach gained access to White House communications.
One theory is that the attackers could have infected government staffers’ computer systems when the staffers were working on government business outside the office, using external wireless networks in places such as coffee shops or their homes which are more vulnerable to sophisticated cyber spies.
“You can compromise the system in their house, then use that to jump on to the system issued from the government,” said Bumgarner. “Perhaps you would springboard from the State Department email into the White House email.”
A hacker can also use an intrusion method known as social engineering to imitate an innocent staffer and send an email to another staffer, which contains a link or attachment that, once clicked on, lets malware breach the system.
“I’m surprised that the cybersecurity used for the White House unclassified network is not greater and they should have identified the problems much sooner than they did,” said Bumgarner.
“If the White House can be easily hacked like this, how can corporations in America protect themselves? It is concerning.”
Sent from my Tricorder