WASHINGTON (AP) – After the U.S. government disclosed its first technical report publicly connecting Russia’s intelligence services to U.S. hacking, the phones started ringing inside cybersecurity firm Rendition Infosec LLC.
Worried customers were following the government’s advice, issued Dec. 29, and comparing digital logs recording incoming network traffic to their computers and finding matches to a list of hundreds of internet addresses the Homeland Security Department had identified as indicators of malicious Russian intelligence services cyber activity.
“They thought they were compromised,” said Rendition founder, Jake Williams, who described a “frenzy” of computer security specialists scrubbing their systems for signs of the Russians. The firm sent a cautionary note to businesses telling them, “be very, very careful on applying this,” and encouraging them to look for further evidence before raising alarms.
The incident illustrated the difficulties and dangers of imprecise government warnings on cybersecurity, especially when national security concerns are at play and sensitive details may compromise information sources. Alerts that are too vague aren’t meaningful. Alerts with details but lacking context might generate false positives, unnecessarily costing businesses and spreading panic among internet users – or worse, damaging the credibility of the government about its future warnings.
A Homeland Security Department official, speaking on condition of anonymity, defended the recent warnings. The official acknowledged the listed addresses included legitimate activity but said businesses were advised to investigate further traffic from those addresses because the Russians are sophisticated adversaries who hide their activities among ordinary internet traffic.