GENEVA \u2014 The United Nations has been hacked.<\/p>\n\n\n\n
An internal confidential document from the United Nations, leaked to The New Humanitarian and seen by The Associated Press, says that dozens of servers were \u201ccompromised\u201d at its offices in Geneva and Vienna.<\/p>\n\n\n\n
Those include the U.N. human rights office, which has often been a lightning rod of criticism from autocratic governments for its calling-out of rights abuses.<\/p>\n\n\n\n
One U.N. official told the AP that the hack, which was first detected over the summer, appeared \u201csophisticated\u201d and that the extent of the damage remained unclear, especially in terms of personal, secret or compromising information that may have been stolen. The official, who spoke only on condition of anonymity to speak freely about the episode, said systems have since been reinforced.<\/p>\n\n\n\n
The level of sophistication was so high that it was possible a state-backed actor might have been behind it, the official said.<\/p>\n\n\n\n
There were conflicting accounts about the significance of the incursion.<\/p>\n\n\n\n
\u201cWe were hacked,\u201d U.N. human rights office spokesman Rupert Colville. \u201cWe face daily attempts to get into our computer systems. This time, they managed, but it did not get very far. Nothing confidential was compromised.\u201d<\/p>\n\n\n\n
The breach, at least at the human rights office, appears to have been limited to the so-called active directory \u2014 including a staff list and details like e-mail addresses \u2014 but not access to passwords. No domain administration\u2019s account was compromised, officials said.<\/p>\n\n\n\n
U.N. spokesman Stephane Dujarric said in an e-mail that the attack \u201cresulted in a compromise of core infrastructure components\u201d at the U.N. offices in Geneva and Vienna, and was \u201cdetermined to be serious.\u201d<\/p>\n\n\n\n
In an e-mail response, he wrote that the servers in Geneva that were targeted were part of a \u201cdevelopment environment and contained non-sensitive, test data from two development servers used for web application development.\u201d<\/p>\n\n\n\n
\u201cThere is no indication that data was exfiltrated from Vienna,\u201d he wrote. The U.N.’s Vienna office is home notably to the U.N.’s Office on Drugs and Crime.<\/p>\n\n\n\n
Dujarric said the world body does not have enough information to determine who might have been behind the incursion, but added “the methods and tools used in the attack indicate a high level of resource, capability and determination.<\/p>\n\n\n\n
\u201cThe damage related to this specific attack has been contained, and additional mitigation measures implemented,\u201d Dujarric wrote. \u201cNevertheless the threat of future attacks continues, and the United Nations Secretariat detects and responds to multiple attacks of various level of sophistication on a daily basis.\u201d<\/p>\n\n\n\n
The internal document from the U.N. Office of Information and Technology said 42 servers were \u201ccompromised\u201d and another 25 were deemed \u201csuspicious,\u201d nearly all at the sprawling United Nations offices in Geneva and Vienna. Three of the \u201ccompromised\u201d servers belonged to the Office of the High Commissioner for Human Rights, which is located across town from the main U.N. office in Geneva, and two were used by the U.N. Economic Commission for Europe.<\/p>\n\n\n\n
Jake Williams, CEO of data firm Rendition Infosec and a former U.S. government hacker, said of the U.N. report: \u201cThe intrusion definitely looks like espionage.\u201d<\/p>\n\n\n\n
He noted that accounts from three different domains were compromised. \u201cThis, coupled with the relatively small number of infected machines, is highly suggestive of espionage,\u201d he said after viewing the report.<\/p>\n\n\n\n
\u201cThe attackers have a goal in mind and are deploying malware to machines that they believe serve some purpose for them,\u201d he added.<\/p>\n\n\n\n
The report indicated that 22 accounts were compromised, including domain admins \u2014 the log-in level used by administrators. It also showed logs that would have betrayed the activities of the hackers inside the U.N. networks were \u201ccleared.\u201d<\/p>\n\n\n\n
Williams said the report showed the hackers eliminated evidence of what they may have taken through the bulk erasure of network logs. But by doing so, they left their tracks. The most skilled hackers \u2014 including U.S., Russian and Chinese agents \u2014 can cover their tracks by editing those logs instead of wiping them clean.<\/p>\n\n\n\n
Technicians at the United Nations office in Geneva, the world body\u2019s European hub, on at least two occasions worked through weekends in recent months to isolate the local U.N. data center from the Internet, re-write passwords and ensure the systems were clean.<\/p>\n\n\n\n
The hack comes amid rising concerns about computer or mobile phone vulnerabilities, both for large organizations like governments and the U.N. as well as for individuals and businesses.<\/p>\n\n\n\n
Last week, U.N. human rights experts asked the U.S. government to investigate a suspected Saudi hack that may have siphoned data from the personal smartphone of Jeff Bezos, the Amazon founder and owner of The Washington Post, in 2018. On Tuesday, the New York Times\u2019s bureau chief in Beirut, Ben Hubbard, said technology researchers suspected an attempted intrusion into his phone around the same time.<\/p>\n\n\n\n
The United Nations, and its human rights office, is particularly sensitive, and could be a tempting target. The U.N. High Commissioner for Human Rights, Michelle Bachelet, and her predecessors have called out, denounced and criticized alleged war crimes, crimes against humanity and less severe rights violations and abuses in places as diverse as Syria and Saudi Arabia.<\/p>\n\n\n\n
Dozens of independent human rights experts who work with the U.N. human rights office have greater leeway \u2014 and fewer political and financial ties to the governments that fund the United Nations and make up its membership \u2014 to denounce alleged rights abuses.<\/p>\n\n\n\n
The U.N. document highlights a vulnerability in the software program Microsoft Sharepoint, which could have been used for the hack.<\/p>\n\n\n\n
Matt Suiche, a French entrepreneur based in Dubai who founded cybersecurity firm Comae Technologies, said that based on the report from September: \u201cIt is impossible to know if it was a targeted attack or just some random internet scan for vulnerable SharePoints.\u201d<\/p>\n\n\n\n
But the U.N. official, speaking to The Associated Press on Tuesday, said that since then, the intrusion appeared sophisticated.<\/p>\n\n\n\n
\u201cIt\u2019s as if someone were walking in the sand, and swept up their tracks with a broom afterward,\u201d the official said. \u201cThere\u2019s not even a trace of a clean-up.\u201d<\/p>\n\n\n\n
Frank Bajak in Boston contributed to this report.<\/i><\/p>\n","protected":false},"excerpt":{"rendered":"
One U.N. official told the AP that the hack, first detected over the summer, appeared \u201csophisticated\u201d and that the extent of the damage remained unclear, especially in terms of personal, secret or compromising information that may have been stolen.<\/p>\n","protected":false},"author":7,"featured_media":55311,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":10,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":[]},"categories":[10],"tags":[],"coauthors":[5459],"class_list":["post-18161","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber"],"acf":{"subheadline":"","legacy_arc_id":"TAYLNERB4VD6VBYQUQTLXMSVII","arc_canonical_url":"\/international\/2020\/01\/29\/leaked-report-shows-united-nations-suffered-hack\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n