PARC MEDIA GROUP

"THE VOICE THE WORLD HEARS, THE ONE THAT CARES" (C)2017/2022

The Daily Report of PR

DNC phishing hack was actually a false alarm

Posted on August 23, 2018 at 11:35 AM

Source:www.cnet.net/By Alfred Ng

https://www.cnet.com/news/dnc-phishing-hack-was-actually-a-false-alarm/

DNC phishing hack was actually a false alarm

Someone set up a fake login page for the Democratic National Committee's voter database.

 

BY

ALFRED NG

AUGUST 23, 2018

The hacking attempt relied on a bogus login page for VoteBuilder, which hosts the DNC's voter database.

It must have been a bad sense of deja vu for the Democratic National Committee.

 

A scheme discovered and shut down Tuesday involved someone who seemed to be trying to steal usernames and passwords of Democratic Party officials by way of a fake login page for VoteBuilder, the service that hosts the DNC's voter database.

 

That was a disturbing echo of an incident during the 2016 US presidential election. At that time, Russian hackers infiltrated the DNC using a similar "spear phishing" method, according to indictments filed in July against 12 Russian agents. And cyberattacks against US electoral systems have only ramped up since. On Monday, for instance, Microsoft said it foiled similar phishing schemes targeting conservative groups.

Tech companies, along with US agencies like the Department of Homeland Security, have increased efforts to protect elections against cyberattacks, which are now coming from nations like China and Iran as well, US National Security Adviser John Bolton said Sunday.

 

But the trickery uncovered Tuesday seems to have been more benign.

 

The DNC said late Wednesday that the phishing site was an unauthorized simulation.

 

"We, along with the partners who reported the site, now believe it was built by a third party as part of a simulated phishing test on VoteBuilder," said Bob Lord, the DNC's chief security officer, in a statement. "The test, which mimicked several attributes of actual attacks on the Democratic party's voter file, was not authorized by the DNC, VoteBuilder nor any of our vendors."

 

The committee said that the unnamed third party took precautions to ensure that sensitive data was not compromised.

 

"While we are extremely relieved that this wasn't an attempted intrusion by a foreign adversary, this incident is further proof that we need to continue to be vigilant in light of potential attacks," Lord said.

 

The DNC learned about the phishing site Tuesday morning, after security researchers from Lookout, a mobile cybersecurity company, alerted the organization.

 

Lookout's "Phishing AI," artificial intelligence that automatically picks up on such attack campaigns, discovered the attempt and reported it to DigitalOcean, a cloud provider. The spoof page was almost impossible to distinguish from the original and was taken down within hours, Lookout said in a statement.

 

"We see no evidence that any sensitive data was stolen, and our initial investigation indicates that we were able to address this threat prior to the attack being launched," DigitalOcean's chief security officer, Josh Feinblum, said in a statement at the time. "We are continuing to partner with the DNC and appropriate law enforcement agencies on this issue."

 

The DNC contacted the FBI after learning about the hacking attempt. The FBI declined to comment. NGP VAN, the organization that owns VoteBuilder, didn't respond to a request for comment.

 

CNN reported the attempted hack earlier Wednesday.

 

CNN reported the attempted hack earlier Wednesday.

 

First published Aug. 22 at 10:12 a.m. PT

Update at 11:19 a.m.: Added details on how researchers found the spoofed website, along with responses from Lookout and Digital Ocean.

Update Aug. 23 at 5:44 a.m. PT: Added response from the DNC and reworked elements of the story to reflect the DNC's disclosure that the phishing site was a simulation.

 

Security: Stay up-to-date on the latest in breaches, hacks, fixes and all those cybersecurity issues that keep you up at night.






Categories: None

Post a Comment

Oops!

Oops, you forgot something.

Oops!

The words you entered did not match the given text. Please try again.

Already a member? Sign In

0 Comments