A former homeland security adviser to President Donald Trump is warning that Russia may well have "persistent access" to hacked U.S. government networks for years to come with power to "destroy or alter data" after communications at several U.S. agencies were reportedly compromised.
Tom Bossert, who also served as deputy homeland security adviser to President George W. Bush, claimed in a New York Times op-ed on Wednesday that "the Russians have had access to a considerable number of important and sensitive networks for six to nine months."
Earlier this week, IT company SolarWinds announced that one of its network managing products had been compromised in a "highly-sophisticated, targeted and manual supply chain attack by a nation state." Shortly after, reports surfaced indicating experts believed hackers working for the Russian government were responsible.
The Cybersecurity and Infrastructure Agency issued an emergency directive ordering agencies to "review their networks for indicators of compromise and disconnect or power down SolarWinds Orion products immediately."
The hack began as early as March when malicious code was snuck into an update for the popular software used by many businesses and government agencies. Essentially, any organization that downloaded the update may have been breached, allowing the hackers to see communications and steal information. The hack went on undetected for months and was only discovered after prominent cybersecurity firm FireEye determined it had been compromised, the Associated Press reported.
"While the Russians did not have the time to gain complete control over every network they hacked, they most certainly did gain it over hundreds of them," Bossert wrote. "It will take years to know for certain which networks the Russians control and which ones they just occupy."
"The logical conclusion is that we must act as if the Russian government has control of all the networks it has penetrated," he continued, noting how both actual and perceived control of so many networks could undermine public trust in communications and data services.
"In the networks that the Russians control, they have the power to destroy or alter data, and impersonate legitimate people," he added. "Domestic and geopolitical tensions could escalate quite easily if they use their access for malign influence and misinformation — both hallmarks of Russian behavior."
According to Reuters, communications at the U.S. Treasury and Commerce Departments were breached. Several other federal agencies, including the State Department, Department of Homeland Security, National Institutes of Health, and even the Pentagon may have been compromised, as well.
There may be some good news, though. GeekWire reported Wednesday that cybersecurity experts at Microsoft have been taking dramatic steps over the last few days to "obliterate the actions" of the hackers.