Subverting Democracy: How Cyber Attackers Try to Hack the Vote

#News(Security) [ via IoTForIndiaGroup ]

Everything you need to know about APT28 and APT29, the attackers that attempted to influence the U.S. presidential election.
The U.S. midterm elections are taking place on November 6 and, given what happened in the run-up to the 2016 presidential election, many voters may be concerned about whether foreign espionage actors will once again attempt to influence the vote.

Cyber attacks played a central role in the 2016 campaign, creating some of the main controversies of the campaign. Multiple organizations were targeted, with the most talked about incident being the attack on the Democratic National Committee (DNC) which resulted in nearly 20,000 internal emails being leaked.

With the midterm elections now around the corner, there are naturally concerns about further attacks. Here’s a short primer on the 2016 attacks and what tactics were used by the attackers:

How can cyber espionage groups interfere with elections?
While there are many ways a cyber espionage actor could potentially interfere with an election, proven cases to date have involved compromising targeted organizations in order to steal and leak information in the hope that it could influence the outcome and/or sow distrust in the political process.

During the 2016 U.S. presidential election, two cyber espionage groups—APT28 and APT29 —compromised a number of political targets, including the DNC, and stole a cache of information, including a large number of emails. These emails were then leaked online, and their contents became a significant talking point during the campaign. According to the U.S. government, both APT28 and APT29 are linked to the Russian government.

Who is APT28?
APT28 (aka Sofacy, Fancy Bear, Swallowtail, Tsar Team, Sednit) is believed to be a Russian cyber espionage group which has been active since at least January 2007. The group was initially known for traditional, information-stealing espionage campaigns, targeting governments in the U.S. and Europe. It became involved in more overt, disruptive operations in the run-up to the 2016 U.S. presidential election. It was also responsible for the 2016 attack on the World Anti Doping Agency (WADA) and subsequent leak of drug testing information.

How does APT28 infiltrate targets?
The group has been known to employ a variety of methods to gain access to targeted organizations’ networks. These include spear-phishing emails, watering hole websites, infected storage devices, and exploitation of software vulnerabilities, including zero-day vulnerabilities.