Federal Bureau of Investigation

FBI Cyber Bulletin: Targeting Activity Against State Board of Election Systems

The following alert was originally published in an article by Yahoo News on August 29, 2016.

Targeting Activity Against State Board of Election Systems

Page Count: 4 pages
Date: August 18, 2016
Restriction: TLP: AMBER
Originating Organization: Federal Bureau of Investigation, Cyber Divison
File Type: pdf
File Size: 524,756 bytes
File Hash (SHA-256): 1EE66D31C46FF1F4DE98D36012E705586D6DFF6800B7F051F564D1A7CED58B3E


Download File

The FBI received information of an additional IP address, 5.149.249.172, which was detected in the July 2016 compromise of a state’s Board of Election Web site. Additionally, in August 2016 attempted intrusion activities into another state’s Board of Election system identified the IP address, 185.104.9.39 used in the aforementioned compromise.

Technical Details

The following information was released by the MS-ISAC on 1 August 2016, which was derived through the course of the investigation.

In late June 2016, an unknown actor scanned a state’s Board of Election website for vulnerabilities using Acunetix, and after identifying a Structured Query Language (SQL) injection (SQLi) vulnerability, used SQLmap to target the state website. The majority of the data exfiltration occurred in mid-July. There were 7 suspicious IPs and penetration testing tools Acunetix, SQLMap, and DirBuster used by the actor, detailed in the indicators section below.
Indicators associated with the Board of Elections intrusion:

  • The use of Acunetix tool was confirmed when “GET /acunetix-wvs-test-for-some-inexistent-file – 443” and several requests with “wvstest=” appeared in the logs;
  • The user agent for Acunetix was identified in the logs –”Mozilla/5.0+(Windows+NT+6.1;+WOW64)+AppleWebKit/537.21++(KHTML,+like+Gecko)+Chrome/41.0.2228.0+Safari/537.21″;
  • The use of SQLMap was confirmed after “GET /status.aspx DLIDNumber=1′;DROP TABLE sqlmapoutput” appeared in the logs;
  • The user agent for SQLMap is “Mozilla/5.0+(Macintosh;+U;+Intel+Mac+OS+X+10.7;+en-US;+rv:1.9.2.2)+ Gecko/20100316+Firefox/3.6.2 200 0 0 421” (These are easily spoofed and not inclusive of all SQLMap activity);
  • The user agent for the DirBuster program is “DirBuster-1.0- RC1+(http://www.owasp.org/index.php/Category:OWASP_DirBuster_Project<http://www.owasp.org/index.php/Category:OWASP_DirBuster_Project> )”;

IP Addresses:

  • 185.104.11.154
  • 185.104.9.39
  • 204.155.30.75
  • 204.155.30.76
  • 204.155.30.80
  • 204.155.30.81
  • 89.188.9.91
  • 5.149.249.172 (new, per FBI)

Recommendations

The FBI is requesting that states contact their Board of Elections and determine if any similar activity to their logs, both inbound and outbound, has been detected. Attempts should not be made to touch or ping the IP addresses directly.

Share this:

Facebooktwitterredditlinkedinmail