Beautiful Virgin Islands

Monday, Aug 04, 2025

US Spent Billions On System To Detect Hacks. The Russians Outsmarted It.

US Spent Billions On System To Detect Hacks. The Russians Outsmarted It.

The Russians, whose operation was discovered this month by a cybersecurity firm that they hacked, were good.
When Russian hackers first slipped their digital Trojan horses into federal government computer systems, probably in the spring, they sat dormant for days, doing nothing but hiding. Then the malicious code sprang into action and began communicating with the outside world.

At that moment - when the Russian malware began sending transmissions from federal servers to command-and-control computers operated by the hackers - an opportunity for detection arose, much as human spies behind enemy lines are particularly vulnerable when they radio home to report what they've found.

Why, then, when computer networks at the State Department and other federal agencies started signaling to Russian servers, did nobody in the U.S. government notice that something odd was afoot?

The answer is part Russian skill, part federal government blind spot.

The Russians, whose operation was discovered this month by a cybersecurity firm that they hacked, were good. After initiating the hacks by corrupting patches of widely used network monitoring software, the hackers hid well, wiped away their tracks and communicated through IP addresses in the United States rather than ones in, say, Moscow, to minimize suspicions.

The hackers also used novel bits of malicious code that apparently evaded the U.S. government's multibillion-dollar detection system, Einstein, which focuses on finding new uses of known malware and detecting connections to parts of the Internet used in previous hacks.

But Einstein, operated by the Department of Homeland Security (DHS), was not equipped to find novel malware or Internet connections, despite a 2018 report from the Government Accountability Office suggesting that building such capability might be a wise investment. Some private cybersecurity firms do this type of "hunting" for suspicious communications - maybe an IP address to which a server has never before connected - but Einstein does not.

"It's fair to say that Einstein wasn't designed properly," said Thomas Bossert, a top cybersecurity official in both the George W. Bush and Trump administrations. "But that's a management failure."

The DHS did not respond to a request for comment.

Russia has denied involvement in the intrusions.

The federal government has invested heavily in securing its myriad computers, especially since the extent of the devastating Chinese hack of the Office of Personnel Management was discovered in 2015, when more than 20 million federal employees and others had their personal information, including Social Security numbers, compromised.

But this year's months-long hack of federal networks, discovered in recent days, has revealed new weaknesses and underscored some previously known ones, including the federal government's reliance on widely used commercial software that provides potential attack vectors for nation-state hackers.

The Russians reportedly found their way into federal systems by first hacking SolarWinds, a Texas-based maker of network-monitoring software, and then slipped the malware into automatic updates that network administrators, in the federal government and elsewhere, routinely install to keep their systems current. The company reported that nearly 18,000 of its customers may have been affected worldwide.

More broadly, the hack highlighted the struggles of the government's network-monitoring systems to detect threats delivered through newly written malicious code communicating to servers not previously affiliated with known cyberattacks. This is something advanced nation-state hackers, including from Russia, sometimes do - presumably because it makes intrusions harder to detect.

The full scope of the hack remains unknown, though it's clear that a growing number of agencies have been penetrated, including the departments of State, Treasury, Homeland Security and Commerce and the National Institutes of Health. They are among victims that include consulting, technology, telecom, and oil and gas companies in North America, Europe, Asia and the Middle East.

The Pentagon was assessing Tuesday whether there had been intrusions at the sprawling department and what impact they may have had, a spokesman said.

The FBI and Department of Homeland Security are investigating the scope and nature of the breaches, which intelligence officials say were carried out by the Russian Foreign Intelligence Service, the SVR. The U.S. government has not publicly attributed the hacks to anyone.

Emails were one target of the hackers, officials said. Although it's not yet clear what the Russians may be intending to do with the information, their victims, including a variety of State Department bureaus, suggest a range of motives.

At the State Department, they may want to know what policymakers' plans are with respect to regions and issues that affect Russia's strategic interests. At the Treasury, they may have sought insights into potential Russian targets of U.S. sanctions. At the National Institutes of Health (NIH), they may be interested in information related to coronavirus vaccine research.

As the investigative work continues, some lawmakers are focused on probing why and how federal cybersecurity efforts have fallen short despite years of damaging hacks by Russian and Chinese spies and major federal investments in defensive technologies.

Einstein, which was developed by the DHS and is operated by the department's Cybersecurity and Infrastructure Security Agency (CISA), was made to be a backbone of federal protection of civilian agency computers, but the 2018 GAO report found significant weaknesses.

The capability to "identify any anomalies that may indicate a cybersecurity compromise" was planned for deployment by 2022, the report said. It also said network monitoring by individual agencies is spotty. Of 23 federal agencies surveyed, five "were not monitoring inbound or outbound direct connections to outside entities," and 11 "were not persistently monitoring inbound encrypted traffic." Eight "were not persistently monitoring outbound encrypted traffic."

"DHS spent billions of taxpayer dollars on cyber defenses and all it got in return was a lemon with a catchy name," said Sen. Ron Wyden, D-Ore., a member of the Senate Intelligence Committee. "Despite warnings by government watchdogs, this administration failed to promptly deploy technology necessary to identify suspicious traffic and catch hackers using new tools and new servers."

It was not just this administration.

Bossert, who worked on the original Einstein concept in the George W. Bush administration, said the idea was to place active sensors at an agency's Internet gateway that could recognize and neutralize malicious command-and-control traffic. "But the Bush, Obama and Trump administrations," he said, "never designed Einstein to meet its full potential."

CISA officials told congressional staff on a Monday evening call that the system did not have the capacity to flag the malware that was signaling back to its Russian masters.

The officials said federal agencies had not given CISA the information necessary to identify agency servers that should not be communicating with the outside world, said one congressional aide, who spoke on the condition of anonymity to discuss a sensitive matter.

"To CISA, all internal agency computers look the same, and so Einstein only flags samples of known malware or connections to 'known bad' IP addresses," the aide said.

Other cybersecurity experts say the breaches highlight the "desperate" need for a government board that can conduct a deep investigation of an incident such as SolarWind's, whose corrupted patches enabled the compromises - and crucially, make the report public.

"We need people to read the report, and say, 'Oh, wow, we need to secure our [information technology] pipeline,' " said Alex Stamos, head of the Stanford Internet Observatory, a research group. He previously was chief security officer at Facebook and Yahoo.

He said there are "hundreds or thousands of companies" in this space that may have security flaws without knowing. These firms do network monitoring, IT management and log aggregation. "Enterprise IT is a $2 trillion market," Stamos said. "There's no agency in charge of ensuring its security."
Newsletter

Related Articles

Beautiful Virgin Islands
0:00
0:00
Close
OpenAI’s Bold Bet: Teaching AI to Think, Not Just Chat
Tesla Seeks Shareholder Approval for $29 Billion Compensation Package for Elon Musk
Nvidia is cutting prices on its RTX 50-series graphics cards after sales slowed and inventories piled up
Ghislaine Maxwell Transferred to Minimum-Security Prison Amid Ongoing DOJ Discussions
U.S. Tariffs Surge to Highest Levels in Nearly a Century Under Second Trump Term
Matt Taibbi Slams Media for Role in Russiagate Narrative
Pilots Call for Mental Health Support Without Stigma
All Five Trapped Miners Found Dead After El Teniente Mine Collapse
Ong Beng Seng Pleads Guilty in Corruption Case Linked to Former Singapore Transport Minister
BP’s Largest Oil and Gas Find in 25 Years Uncovered Offshore Brazil
Italy Fines Shein One Million Euros for Misleading Sustainability Claims
JPMorgan and Coinbase Unveil Partnership to Let Chase Cardholders Buy Crypto Directly
Declassified Annex Links Soros‑Affiliated Officials and Clinton Campaign to ‘Russiagate’ Narrative
UK's Online Safety Law: A Front for Censorship
Nationwide Protests Erupt in Brazil Demanding Presidential Resignation
Parents Abandon Child at Barcelona Airport Over Passport Issue
Mystery Surrounds Death of Brazilian Woman with iPhones Glued to Her Body
Bus Driver Discovers Toddler Hidden in Suitcase in New Zealand
Switzerland Celebrates 734 Years of Independence Amid Global Changes
U.S. Opens Official Investigation into Former Trump Prosecutor Jack Smith
Leaked audio of Canada's new PM Mark Carney admitting the truth about the Net Zero agenda: "We're gonna make a lot of money off of this."
China Enforces Comprehensive Ban on Cryptocurrency Activities
Absolutely 100% Realistic EVO Series Doll by EXDOLL (Chinese Company) used mainly for carnal purposes
World Economic Forum founder Klaus Schwab: "In this new world, we must accept... total transparency. You have to get used to it. You have to behave accordingly. But if you have nothing to hide, you shouldn't be afraid."
Meet Mufti Hamid Patel, head of Office for Standards in Education in Pakistan
George Soros tells the World Economic Forum: "President Trump is a con man and the ultimate narcissist, who wants the world to revolve around him."
Hamas are STARVING the hostages.
Decline in Tourism in Majorca Amidst Ongoing Anti-Tourism Protests
British Tourist Dies Following Hair Transplant in Turkey, Police Investigate
Poland Begins Excavation at Dziemiany After New Clue to World War II‑Era Nazi Treasure
WhatsApp Users Targeted in New Scam Involving Account Takeovers
Trump Threatens Canada with Tariffs Over Palestinian State Recognition
Trump Deploys Nuclear Submarines After Threats from Former Russian President Medvedev
Trump Sues Murdoch in “Heavyweight Bout”: Lawsuit Over Alleged Epstein Letter Sets Stage for Courtroom Showdown
Germany Enters Fiscal Crisis as Cabinet Approves €174 Billion in New Debt
Trump Administration Finalizes Broad Tariff Increases on Global Trade Partners
J.K. Rowling Limits Public Engagements Citing Safety Fears
JD.com Launches €2.2 Billion Bid for German Electronics Retailer Ceconomy
Azerbaijan Proceeds with Plan to Legalise Casinos on Artificial Islands
Former Judge Charged After Drunk Driving Crash Kills Comedian in Brazil
Jeff Bezos hasn’t paid a dollar in taxes for decades. He makes billions and pays $0 in taxes, LEGALLY
China Increases Use of Exit Bans Amid Rising U.S. Tensions
IMF Upgrades Global Growth Forecast as Weaker Dollar Supports Outlook
Procter & Gamble to Raise U.S. Prices to Offset One‑Billion‑Dollar Tariff Cost
House Republicans Move to Defund OECD Over Global Tax Dispute
Botswana Seeks Controlling Stake in De Beers as Anglo American Prepares Exit
Trump Administration Proposes Repeal of Obama‑Era Endangerment Finding, Dismantling Regulatory Basis for CO₂ Emissions Limits
France Opens Criminal Investigation into X Over Algorithm Manipulation Allegations
A family has been arrested in the UK for displaying the British flag
Mel Gibson refuses to work with Robert De Niro, saying, "Keep that woke clown away from me."
×