Spoof voter emails targeting US Democratic voters were not the result of an election systems hack, according to security experts.
Last week Motherboard reported that Democrat voters in four swing states reported receiving emails warning them to vote for Donald Trump or “we will come after you”, purporting to be from far-right group Proud Boys.
Go deeper with GlobalData
US officials later said that Iran was behind the emails, with National Intelligence Director John Ratcliffe claiming that both Iran and Russia had obtained “some voter registration information”. Both countries deny this, with spokesman Alireza Miryousefi saying “Iran has no interest in interfering in the US election and no preference for the outcome.”
Ratcliffe said that the purpose of the spoof emails was to “confusion, sow chaos, and undermine your confidence in American democracy.”
US officials also said that Iran was behind the circulation of a video appearing to show that fraudulent ballots could be cast from abroad.
FBI Director Christopher Wray said:
How well do you really know your competitors?
Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.
Thank you!
Your download email will arrive shortly
Not ready to buy yet? Download a free sample
We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form
By GlobalData“We are not going to tolerate foreign interference in our elections or any criminal activity that threatens the sanctity of your vote or undermines public confidence in the outcome of the election. When we see indications of foreign interference or federal election crimes, we’re going to aggressively investigate and work with our partners to quickly take appropriate action.”
However, researchers from SecureWorks believe that the attack was not the result of a voter database breach but was instead engineered to appear that way.
Rather than being the result of sophisticated attack, some voter data is available on request and in some states voter registration information is publicly available, which could be used by an attacker to send spoof emails in the same way that attackers send spam or phishing emails.
Rafe Pilling, senior security researcher at Secureworks, said:
“Our analysis indicates the attack was simulated using infrastructure setup by the adversary—and not against a real voter registration database.
“The unusual thing about this campaign is the target set, theme, and inclusion of a contrived video showing a hack of a voter registration database. The messages were sent using compromised infrastructure from companies linked to Saudi Arabia, Estonia and United Arab Emirates. This is a common tactic for threat actors. In some cases, it appears that the threat actors had technical difficulties getting target-specific, personal information, to populate in their email templates, with only the variable name showing in the resulting message.
“This could indicate that aspects of the operation were rushed or not well-planned in advance. While the video shows the use of the sqlmap tool to compromise a voter registration database, some failures in the redaction reveal command lines that indicate the attack was simulated using infrastructure setup by the adversary—and not against a real voter registration database.”
However, Pilling still believes that the spoof voter emails could still affect voter confidence in the election:
“Regarding the intent of the campaign, Secureworks’ CTU researchers agree with the US Director of National Intelligence, the campaign’s aim is to create confusion, as well as fuel speculation and existing voter division, but not to influence specific voters. The real attack is on the United States’ democratic system with the intention to cast doubt over the integrity of the election process. This is illustrated by the inclusion of a link to a contrived video showing what appears to be fraudulent requests being submitted to the Federal Voting Assistance Program on-line portal.
“Since Iranian disinformation operations are usually focused on its domestic audience and neighbours in the Middle East, this is an unusual foray into American politics perhaps intended to test the waters and monitor the U.S. response. This statement only relates to the Iranian operation. The Russian activity is very different. And probably less directly election related.”
Read More: Sopra Steria confirms “new” strain of Ryuk ransomware behind cyberattack.
