Massive Data Leak From Russian FSB Reveals Nothing New, But Sheds Light On Cyber Security Problem

Support SouthFront

Landing page of FSB contractor SyTech after being hacked. Click to see full-size image

A massive data leak took place after hackers successfully targeted the Russian Security Service – the FSB’s servers, BBC Russia reported.

According to the report, the FSB’s leaked projects include:

• De-anonymization of TOR Browser:

Киберреволюция растет! Наши ряды пополняются!
Еще одна ФСБэшная подстилка, работая над деанонимизацией TORа, поплатилась за сотрудничество с властями. @Dobrokhotov @RuBlackListNET @bbcrussian @kozlyuk pic.twitter.com/Ohcw7fbGKz

— DigitalRevolution (@D1G1R3V) July 18, 2019

• How to separate the Russian internet from the rest of the world:

Эй, ФСБ, как там у вас получается с Натиском-2? Может стоило бы поменять название проекта на Дуршлаг-1? @Dobrokhotov @RuBlackListNET @leonidvolkov @msvetov @shaveddinov @kozlyuk @RuHackersNews @the_ins_ru @tjournal @kmartynov @bbcrussian pic.twitter.com/RjKCFnXWlT

— DigitalRevolution (@D1G1R3V) July 18, 2019

• How to scrape social media:

Все мы, журналисты, студенты и даже пенсионеры, находимся под навлюдением ФСБ. Присоединяйтесь к нам, как и 0V1ru$, защищая наше будущее! Они не заглушат наши голоса! @tjournal @Dobrokhotov @bbcrussian @unkn0wnerror pic.twitter.com/HUYDas7FSN

— DigitalRevolution (@D1G1R3V) July 18, 2019

A week ago, on July 13, a hacking group under the name 0v1ru$ that had reportedly breached SyTech, a major FSB contractor working on a range of live and exploratory internet projects, left a smiling Yoba Face on SyTech’s homepage alongside pictures purporting to showcase the breach.

As well as defacing SyTech’s homepage with the Yoba Face, 0v1ru$ also detailed the project names exposed: “Arion”, “Relation”, “Hryvnia,” alongside the names of the SyTech project managers.

According to BBC Russia, no actual state secrets were exposed.

Essentially, the leaked projects are not something unexpected and are more or less normal. But the breach is massive, about 7.5 TB, and how easily it was carried out is also of note.

Contractors remain the weak link in the chain for intelligence agencies worldwide—to emphasize the point, just last week, a former NSA contractor was jailed in the US for stealing secrets over two decades. And the fallout from Edward Snowden continues to this day.

So, the contractor failed to protect the data. Attention then must be turned to another Russian government project:

By 2022, Russia may stop issuing passports on paper – it will all be replaced with plastic cards with chips and mobile applications.

Electronic passports will be issued instead of regular passports in Russia in 2020, and two years later the issuance of paper documents will cease.

“The issuance of electronic passports will begin in July next year in a pilot mode in Moscow. Then we will dynamically, with an increase from 1100 to 3000 points for issuing passports of the new sample in the country, in 2022 we will stop the issuance of old passports,” Deputy Prime Minister Maxim Akimov said after the meeting on the introduction of an electronic identity card with Prime Minister Dmitry Medvedev.

Formally, the concept of an electronic identity card has not yet been approved, according to Akimov it will be the following:

• an electronic passport will be a plastic card with a chip. It will consist only of Russian components and will work on Russian software. The cryptographic algorithms developed in Russia will be used. “Security in this case will be much higher than in the sphere of circulation of paper passports. If you have lost your e-passport, you can block it in a few seconds,” Akimov said.
• The electronic passport card will be valid for ten years, and the replacement of existing paper passports with electronic ones will be made at the request of the owner.
• At the initial stage, the fee for obtaining an electronic certificate will be similar to that which is now charged when receiving a paper passport – 300 rubles, but will be gradually increased.
• In addition to the card, an e-passport application will be released for all mobile platforms. “That is, it is not necessary to carry even this light document with you, but it will be enough to submit an application,” said Akimov, adding that the developer will be state-owned, and the service itself will be free.

That is all good, but the cards and the software will be either produced, developed or support by a third party, and even if they’re not cyber security appears to be a growing issue.

Who’s to say that a massive leak wouldn’t take place then.

MORE ON THE TOPIC:

• Hack Leads to Massive Data Leak from Bulgarian NRA, Alleged Hacker Claims He’s Russian, Calls Government “Mentally Retarded”

Support SouthFront