Russian Hacker False Flags Work—Even After They’re Exposed
Credit to Author: Andy Greenberg| Date: Tue, 27 Feb 2018 18:01:04 +0000
False flags, for the modern nation-state hacker, are quickly becoming as standard a part of the toolkit as phishing links and infected Microsoft Office attachments. Why simply hide your identity when you can simply paste a new one over it, invented or borrowed? Russia's hackers, in particular, have lately experimented with that digital mask-swapping with increasingly deceptive tactics—ones that, even when their deceit is successful dispelled, still manage to muddy the waters of accountability.
Over the past weekend, The Washington Post reported that US intelligence agencies have concluded that Russian hackers not only attempted to disrupt the Winter Olympics in Pyeongchang, but sought to frame North Korea for that attack. That leaked confirmation of Russia's involvement in the operation, which planted destructive malware known as Olympic Destroyer on the network of the games' organizers, follows a week of speculation from the cybersecurity research community about attribution. While Russia had been the leading suspect for the Pyeongchang attack, cybersecurity firms had also seen Chinese or North Korean hackers as candidates.
Those attempts at misdirection, researchers warn, are a sign that the Kremlin's hackers have advanced their impersonation techniques beyond flimsy masks, to planting relatively convincing fake fingerprints from other countries' hacking teams.
"They're getting bolder," says Juan Andres Guerrero-Saade, a researcher for security intelligence firm Recorded Future, who has warned for years of the rising threat of false flags. "I think this is the most effort on a campaign scale that we’ve seen trying to create a decent false flag."
Olympic Destroyer, according to the games' organizers, tore through their computer network just ahead of the Pyeongchang opening ceremonies, paralyzing display monitors, shutting down Wi-Fi, and taking down the Olympics' website so that many visitors were unable to print tickets or gain entrance to the event.
'I think this is the most effort on a campaign scale that we’ve seen trying to create a decent false flag.'
Juan Andres Guerrero-Saade, Recorded Future
But for security researchers trying to identify the creators of that Olympic Destroyer malware, the code's clues pointed to a list of countries practically as diverse as the Olympics itself. The malware roughly matched the behavior of NotPetya, another attack linked to Russia that struck Ukraine last year before rippling out to the rest of the world. Like that earlier wiper malware sample, Olympic Destroyer integrated code derived from Mimikatz, an open-source password stealing tool, and spread within networks via the Windows functions PSExec and Windows Management Instrumentation before encrypting or destroying data.
But some elements hinted at Chinese and North Korean meddling nearly as convincingly. As Cisco's Talos security division pointed out in a blog post Monday, the malware also resembled a tool used by North Korea's Lazarus hacking team, wiping a target computer's data by destroying exactly as many bytes of a file as the North Korean malware, sharing similarities in structure and referring to a file with very similar names, evtchk.txt in Olympic Destroyer, and evtchk.bat in the Lazarus tool. According to The Washington Post, the Olympic Destroyer hackers even proxied their connections through North Korean IPs.
Their code contained Chinese red herrings, too: Security firm Intezer also spotted that Olympic Destroyer shared nearly 20 percent of its code with a tool used by Chinese hacking group APT3—though possibly due to both pieces of malware integrating Mimikatz—as well sharing a far more unique function for generating encryption keys with another Chinese hacking group known as APT10.
"Attribution is hard. Rarely do analysts reach the level of evidence that would lead to a conviction in a courtroom," the Talos post reads. "Many were quick to jump to conclusions, and to attribute Olympic Destroyer to specific groups. However, the basis for such accusations are frequently weak. Now that we are potentially seeing malware authors placing multiple false flags, attribution based off malware samples alone has become even more difficult."
Given that muddle, it's still not exactly how US intelligence came to the conclusion that Russia was behind the Olympic Destroyer attacks. In previous cases, more definitive attribution has come from on-the-ground incident response rather than mere malware analysis, or, as in the case of North Korea's attack on Sony in 2014, preemptively hacking the hackers to spy on their operations in real time. But in the Olympic Destroyer case, the geopolitical context alone pointed strongly to Russia: By the start of the Olympics, Russia's would-be patsy, North Korea, had begun a campaign to use the Olympics as an opportunity to improve relations with South Korea. (Never mind that it was still likely spying on Pyeongchang targets and quietly attempting to steal from banks and bitcoin exchanges elsewhere in South Korea.)
That left Russia as the prime suspect for a disruptive, public attack, in part because it had already declared its intent to meddle with the games in response to the International Olympic Committee's decision to ban its athletes for doping violations. The known Russian military intelligence hacking team Fancy Bear had been attacking Olympics-related organizations for months, stealing documents and leaking them in retaliation for the IOC's ban. Olympic Destroyer immediately seemed like just another act of petty revenge.
"It's another example of Russian petulance," Center for Strategic and International Studies fellow James Lewis told WIRED in the immediate aftermath of the attack. "It's consistent with what they’ve done before. It's probably them."
'It would have mired us in a public discussion of attribution, instead of a discussion of how to respond.'
John Hultquist, FireEye
Russian hackers have, in fact, flown plenty of false flags in the past, though not quite as elaborate as Olympic Destroyer's. Fancy Bear, for instance, has hidden in past operations behind "hacktivist" fronts like CyberBerkut, a pro-Russian grassroots (or astroturf) movement, as well as Cyber Caliphate, a jihadist hacking outfit. After hacking the Democratic National Committee, it famously created the Romanian hacktivist persona Guccifer 2.0, who leaked the documents in an self-proclaimed attempt to target the "illuminati."
North Korean hackers have experimented with false flags too, calling themselves the Guardians of Peace in the wake of the Sony attack and other names like the ‘New Romantic Cyber Army Team’ and the ‘WhoIs Team' in earlier attacks on South Korean targets. But the Kremlin's cyberspies have been most the innovative and persistent in developing those false personas. "The Russia-based teams have been the pioneers of false flags all along," says Recorded Future's Guerrero-Saade.
The Olympic Destroyer false flag suggests that Russia's deception is evolving. And it could be easily adopted by other hackers, too: Adding a generic component of another hacking team's malware to yours or even a single filename, as in the Olympic Destroyer case, isn't hard.
And false flags work, even thinner and flimsier ones than the latest attack. After masks like CyberBerkut or Guccifer 2.0 were peeled away—a process that took years of investigation in some cases—they still often served their intended purpose, says Guerrero-Saade. In many cases, those false flags created significant doubt among non-experts and gave fodder to those, like Russian state media or President Trump, who were motivated to remain willfully blind to Russia's involvement in attacks like those during the 2016 election season.
The Olympic Destroyer false flag, despite the US intelligence pointing the finger squarely at Russia, served its purpose too, argues an essay from The Grugq, an influential pseudonymous security researcher for Comae Technologies. "By acknowledging that a legitimate, serious, for real, false flag cyber operation occurred, the US intelligence community has created fodder for future conspiracy theories and contrarian attributions regarding cyber attacks," writes the Grugq. "When an attack is publicly attributed to Russia, trolls and other info war participants will be able to point at this false flag operation and raise doubts about future attributions." Even when false flags fail, in other words, they still succeed.
Still, the Olympic Destroyer attack was in some ways a bust, says John Hultquist, director of research at security intelligence firm FireEye. He points out that it appears to have caused only a fraction of the damage it was intended to, and gained little public notice in comparison to earlier Russian attacks like NotPetya. But had the malware had achieved its disruptive goals, Hultquist argues, its false flag would have succeeded in confusing the public discussion of blame and accountability. "It would have been enough for the naysayer or the contrarian to latch onto and confuse the question," Hultquist says. "It would have mired us in a public discussion of attribution, instead of a discussion of how to respond."