Cyber researchers, Ukraine warn of possible Russian attack

TORONTO/KIEV (Reuters) - Hackers have infected at least 500,000 routers and storage devices in dozens of countries, some of the world’s biggest cyber security firms warned on Wednesday, in a campaign that Ukraine said was preparation for a future Russian cyber attack.

The U.S. Department of Homeland Security said it was investigating the malware, which targets devices from Linksys, MikroTik, Netgear Inc (NTGR.O), TP-Link and QNAP, advising users to install security updates.

Ukraine’s SBU state security service said the activity showed Russia was readying a large-scale cyber attack ahead of the Champions League soccer final, due to be held in Kiev on Saturday.

“Security Service experts believe the infection of hardware on the territory of Ukraine is preparation for another act of cyber-aggression by the Russian Federation aimed at destabilising the situation during the Champions League final,” it said in a statement.

Cisco Systems Inc (CSCO.O), which has been investigating the threat for several months, has high confidence that the Russian government is behind the campaign, according to Cisco researcher Craig Williams. He cited the overlap of hacking code with malware used in previous cyber attacks that the U.S. government have attributed to Moscow.

Cisco, which uncovered the campaign several months ago, alerted authorities in Ukraine and the United States before going public with its findings about the malware it dubbed VPNFilter.

It also shared technical details with rivals who sell security software, hardware and services so they could issue alerts to their customers and protect against the threat.

Cisco described the mechanisms that the malware uses to hide communications with hackers and a module that targets industrial networks like ones that operate electric grids, said Michael Daniel, chief executive officer of Cyber Threat Alliance, a nonprofit group.

Slideshow (3 Images)

“We should be taking this pretty seriously,” said Daniel, whose group’s 17 members include Cisco, Check Point Software Technologies Ltd (CHKP.O), Palo Alto Networks Inc (PANW.N) and Symantec Corp (SYMC.O).

Cyber security firms, governments and corporate security teams closely monitor events in Ukraine, where some of the world’s most costly and destructive cyber attacks have been launched.

They include the first documented cases where hacks have caused power outages and the June 2017 NotPetya cyber attack that quickly spread around the world, causing network outages that lasted weeks at some companies. Victims included Beiersdorf AG (BEIG.DE), FedEx Corp (FDX.N), Merck & Co Inc (MRK.N), Mondelez International Inc (MDLZ.O) and Reckitt Benckiser Group Plc (RB.L).

Cisco said it does not know what the hackers have planned. The malware could be used for espionage, to interfere with internet communications or launch a destructive attack like NotPetya, according to Williams.

The Kremlin did not immediately respond to a request for comment. Russia has denied assertions by nations including Ukraine and Western cyber-security firms that it is behind a massive global hacking program that has included attempts to harm Ukraine’s economy and interfering in the 2016 U.S. presidential election.

VPNFilter has infected devices in at least 54 countries, but by far the largest number is in Ukraine, according to Cisco.

Netgear representative Nathan Papadopulos said the company was looking into the matter. He advised customers to make sure their routers are patched with the latest version of its firmware, disable remote management and make sure they have changed default passwords shipped with the device.

A Linksys spokeswoman had no immediate comment. MikroTik, TP-Link and QNAP could not be reached.

Reporting by Jim Finkle in Toron to and Pavel Polityuk in Live; Writing by Jim Finkle and Jack Stubbs; Editing by Mark Heinrich and Jeffrey Benkoe

Tech

Twitter may notify users exposed to Russian propaganda during 2016 election

WASHINGTON (Reuters) - Twitter may notify users whether they were exposed to content generated by a suspected Russian propaganda service, a company executive told U.S. lawmakers on Wednesday.

The social media company is “working to identify and inform individually” its users who saw tweets during the 2016 U.S. presidential election produced by accounts tied to the Kremlin-linked Internet Research Army, Carlos Monje, Twitter’s director of public policy, told the U.S. Senate Commerce, Science and Transportation Committee.

A Twitter spokeswoman did not immediately respond to a request for comment about plans to notify its users.

Facebook Inc in December created a portal where its users could learn whether they interacted with accounts created by the Internet Research Agency.

Both companies and Alphabet’s YouTube appeared before the Senate committee on Wednesday to answer lawmaker questions about how their efforts to combat the use of their platforms by violent extremists, such as the Islamic State.

But the hearing often turned its focus to questions of Russian propaganda, a vexing issue for internet firms who spent most of the past year responding to a backlash that they did too little to deter Russians from using their services to anonymously spread divisive messages among Americans in the run-up to the 2016 U.S. elections.

U.S. intelligence agencies concluded Russia sought to interfere in the election through a variety of cyber-enabled means to sow political discord and help President Donald Trump win. Russia has repeatedly denied the allegations.

Reporting by Dustin Volz; Editing by Nick Zieminski

Our Standards:The Thomson Reuters Trust Principles.

Tech