Former Yandex CISO weighs in on alleged Five Eyes hack

It's not known which of the alliance's five countries is behind the espionage operation

Russian hack concept

A former Yandex CISO has addressed the allegations made against the Five Eyes intelligence alliance which allegedly used a rare strain of malware to spy on user accounts relating to Russia's leading search engine.

The malware called Regin is known to have been used by Five Eyes in previous operations, according to information that was previously unearthed in the 2014 Edward Snowden leak of NSA documents.

According to sources familiar with the matter, who spoke to Reuters which first broke the story, it couldn't be determined which country launched the attack on Russia's leading search engine which was discovered between October and November 2018.

The Five Eyes intelligence alliance is formed of the UK, US, Canada, Australia and New Zealand and operates under the agreement that all information can be shared without fear of it being leaked outside of the alliance.

The former CISO of Yandex, which is often referred to as Russia's Google, took to Twitter upon reading the news to offer some interesting insights into the attack.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

Taking a more offensive stance, Vladimir Ivanov exclusively and repeatedly addressed the attackers as "NSA" instead of speculating the true origin of the attack like the sources of the information did.

"NSA is not an easy fish to catch, so kudos to you-know-how-you-are at Yandex security team," he said.

"As a former Yandex CISO I am extremely proud of the team that was able to detect and respond to NSA hacking attack," he added.

Ivanov quoted a section of the article which claimed the purpose of the attack wasn't strictly to spy on Yandex users, but to understand how Yandex authenticates user accounts before saying how the information has been in plain sight.

He alluded to Yandex being transparent in its methods of account authentication which included two-factor authentication and a proprietary Yandex Key application, according to self-written posts to Russian website Habr.

Advertisement - Article continues below

Addressing the NSA directly over Twitter, Ivanov said if they wanted to know how Yandex authenticates user accounts "you could've just asked".

"Yandex does not enrich Uranium, is not a critical infrastructure company, not a military agency," he said. "It's a NASDAQ trading commercial company. I wonder what's the justification to hack into it. Cannot avoid seeing similarities with Chinese attack on Google."

"This particular attack was detected at a very early stage by the Yandex security team. It was fully neutralized before any damage was done," Yandex spokesperson Ilya Grabovsky said to Reuters. "The Yandex security team's response ensured that no user data was compromised by the attack."

The sources said the hack was for espionage purposes and not to steal intellectual property or disrupt system operations. The hackers were able to remain concealed on the Yandex network for "several weeks" before being discovered.

Yandex recruited Kaspersky to help clean up the situation and it was the antivirus software company which was able to establish that the attackers were targeting a group of developers inside Yandex, according to the sources.

Advertisement
Advertisement - Article continues below

The Regin malware used in the attack was reportedly modified from previous versions with never before seen code compared to the previous iterations. Reports tied older version of Regin to GCHQ and NSA joint hacking operations on a Belgian telco in 2013.

Advertisement - Article continues below

GCHQ and the NSA declined to comment while the Home Office did not reply to requests for comment at the time of publication.

Featured Resources

How inkjet can transform your business

Get more out of your business by investing in the right printing technology

Download now

Journey to a modern workplace with Office 365: which tools and when?

A guide to how Office 365 builds a modern workplace

Download now

Modernise and transform your sales organisation

Learn how a modernised sales process can drive your business

Download now

Your guide to managing cloud transformation risk

Realise the benefits. Mitigate the risks

Download now
Advertisement

Recommended

Visit/security/28170/what-is-cyber-warfare
Security

What is cyber warfare?

20 Sep 2019
Visit/malware/33080/hackers-abuse-linkedin-dms-to-plant-malware
malware

Hackers abuse LinkedIn DMs to plant malware

25 Feb 2019
Visit/security/malware/28083/the-five-best-free-malware-removal-tools
Security

Best free malware removal tools 2019

23 Dec 2019
Visit/security/internet-security/354417/avast-and-avg-extensions-pulled-from-chrome
internet security

Avast and AVG extensions pulled from Chrome

19 Dec 2019

Most Popular

Visit/cloud/cloud-computing/354767/google-cloud-snaps-up-multi-cloud-analytics-platform-for-26bn
cloud computing

Google Cloud snaps up multi-cloud analytics platform for $2.6bn

13 Feb 2020
Visit/mobile/28299/how-to-use-chromecast-without-wi-fi
Mobile

How to use Chromecast without Wi-Fi

5 Feb 2020
Visit/operating-systems/27717/how-to-fix-a-stuck-windows-10-update
operating systems

How to fix a stuck Windows 10 update

12 Feb 2020
Visit/security/cyber-attacks/354747/apple-mac-malware-detections-overtake-windows-for-the-first-time
cyber attacks

Apple Mac malware detections overtake Windows for the first time

11 Feb 2020