Cyberattack on Berlin: US expert warns of danger to federal authorities
The cyberattack on Berlin's administration could have caused far more damage than previously known. A US expert warns of consequences for other government networks.
Berlin administration hacked – expert fears spread to federal level
The cyberattack on Berlin's administration could have significantly more serious consequences than have so far been made public, according to a leading US cybersecurity expert. As BILD reports, Professor Max Kilger (72), adjunct professor of cybersecurity at the University of Texas in San Antonio, warns of possible chain reactions into other state networks.
"There may be substantial network connections between the attacked Berlin systems and other systems of the German federal government," Kilger told BILD. If that were the case, it would be a "more serious incident" than is currently apparent.
Stolen passwords as a point of entry
Particularly concerning: password files appear to have been stolen in the attack. Kilger warns of so-called "credential stuffing" – an attack pattern in which stolen access credentials are systematically tested against other services. Had Berlin authorities used the same passwords in multiple state systems, further government networks could have been compromised.
How long the attackers were already active in the Berlin systems without being detected cannot be said at present, according to Kilger. From comparable cases it is known that hackers can "remain undetected in networks for up to several weeks" – time they could use to locate connected systems and extract further data.
Extortion instead of encryption possible
It is also unclear what exactly happened in the attack. According to Kilger, it is not yet established whether data was actually encrypted. Another approach is conceivable: the perpetrators could have infiltrated systems, extracted data and then threatened to publish it in order to extort money.
According to Kilger, evidence suggests that the ransomware group Rhysida is behind the attack, which may be operating from Russia or a CIS state. There is so far no public evidence for direct involvement by foreign intelligence services. However, Kilger considers it likely that the state in which the group is based at least tolerates its attacks on Western organisations. In addition, it is conceivable that a foreign state exerted pressure on Rhysida in order to gain insight into the stolen data and to examine material of intelligence interest.
No ransom – expert thinks this is right
According to available information, Berlin did not pay a ransom. Kilger considers this decision to be the right one: "Therefore, Berlin has probably acted rightly in not paying the ransom." There is no guarantee whatsoever that criminals will actually return the data after payment or will not nonetheless sell or publish it. Rhysida has previously auctioned stolen data both privately and publicly.
According to Kilger, Rhysida operates a structured business model: a core group provides malware and technical infrastructure, while other criminals carry out the actual attacks using it. Incoming ransom payments are divided among those involved. Experts refer to this model as "ransomware as a service".
Source: BILD