Microsoft: Phishing Scam Targets Politicians

Microsoft says hackers have targeted at least three candidates for Congress. Security experts say the group behind the attacks has been linked to Russia's intelligence services.

The revelation came at the Aspen Security Forum in a speech from Tom Burt, Microsoft's head of Customer Security & Trust. He was talking about domains that appeared to be Microsoft-owned but were in fact bogus sites.

Burt said one of the domains was the landing page for a phishing attack, meaning it was the page somebody would go to if they followed a misleading link from an email or social media message. The page in question falsely gave the impression of being operated by Microsoft.

Pages Referred To Specific Candidates

According to Burt, examination of metadata on the page (information that was part of the page's code but not readily visible on the page itself) included references to three people standing in November's mid-term elections. That strongly suggests the page had been set up specifically to target those candidates through the phishing attacks.

Burt didn't name the candidates for security reasons, but said they could be "interesting targets from an espionage standpoint, as well as an election disruption standpoint." Microsoft was able to get the domain taken down and it doesn't appear any of the candidates had been mislead by it. (Source: qz.com)

The domains were known to be operated by a group that Microsoft refers to as "Strontium", though other security researchers call "Fancy bear." It has been linked with Russian intelligence.

Emails The Likely Target

The most likely explanation for the attack was that the idea was to have the candidates visit the pages, believe they were genuine, then trick them into handing over some form of login details such as usernames and passwords. This could then be used to get into a Microsoft account or, if the victims reused login information, into other accounts.

Such an attack does require a lot of things to go right for the attackers, but it may also be possible they are unleashing the same tactic over and over to play the numbers game. The goal seems to be to gain access to private email messages and them make them public, something that would could embarrass the candidates.

One theory is that the idea isn't so much to hurt specific candidates, but rather to create wider political divisions and undermine the democratic process itself. (Source: bbc.co.uk)

What's Your Opinion?

Do you believe Russia is behind such attacks? Should candidates get better training in cyber security? Should law enforcement put extra effort into tackling cyber crime against politicians?