Spear-phising Likely Used to Bait the DNC in Cyber Esponiage

As if U.S. politics aren’t frustrating enough at the moment, now the Democratic National Committee (DNC) is hampered with investigating a breach of its network. The suspects are two separate hacking groups that have been associated with the Russian government.

As the story goes, the operations staff suspected something was amiss in April of this year. The DNC hired cyber security company CrowdStrike to investigate. It found evidence that the two groups had been monitoring the systems and only two files had been stolen. Neither included donor, voter, financial, or information, but included information on the 2016 presidential candidates.

While it isn’t known precisely how the intruders got in, CrowdStrike believes it was targeted phishing emails to DNC employees, or spear-phishing. Often this is the attack method of choice because the messages usually contain specific information about the recipient, or information that applies to them, making the messages more believable. That’s why it is so successful. It has also been blamed for breaches against the White House, the State Department, the Office of Personnel Management (OPM), and many other government and non-government related incidents such as Sony, J.P. Morgan Chase, and Target.

However, it’s important to remember that messages with attachments or links that are not expected should always be met with a bit of suspicion, even if they come from someone you know or with whom you do business. Most of the time, if it’s important you have had previous knowledge that the file is on the way; even if someone told you as they passed you in the hallway.

Other indicators that the message may be some type of phishing include:

• The sender is unknown
• The actual email address does not match the name of the recipient
• A link does not go where you expect by the name of it (hover over it with your mouse pointer to see where it goes)
• There are typos and/or grammatical mistakes

There are, of course other indicators and sometimes the messages are so well done that it is very difficult to tell if it is legitimate. So always remember that if it is not expected, pay closer attention and verify links and attachments with the sender before performing any action.

The DNC said they have “kicked out” the intruders. However, investigations are ongoing.