It’s hard for campaigns to be transparent without aiding attackers

Op-ed: Transparency is essential to democratic elections. But security is also important to the integrity of the process.

Everyone knows what happened to John Podesta in 2016. Hillary Clinton’s campaign manager clicked on a phishing email, and as far as we know, it was the first time a cyberattack shaped a presidential election.

This time around, the campaigns are more focused on recognizing and stopping phishing attacks. That’s good, because phishing has become way more sophisticated over the last four years, including the painstaking research smart attackers run.

So if we were to see a repeat of 2016, where would hackers conduct their homework? They could look no further than the Federal Election Commission, whose website illustrates how tough it is to balance transparency and security.

The bad guys are looking, too

Check out the FEC’s campaign finance data repository. It enables anyone to see where campaigns are spending their money: They’re required to list individuals, vendors, and others they are paying to support their operations.

The site exists for a laudable reason: financial transparency in support of fair elections. However, all this public information makes it easy for threat actors to customize phishing emails. We’re talking employee, donor, and contractor names, plus software providers, media partners, payroll companies, and so on. And yes, that includes physical and cybersecurity services.

Though it’s true that anyone can find this information, it’s a bounty for today’s sophisticated threat actors. An attacker could, for instance, identify campaign staffers on the website and, using other public sources, discover their email addresses. In maybe an hour’s time, the attacker would have a target list for launching phishing attempts. The attacker might conclude that higher-paid staffers are higher-value phishing targets. Again, a little more reconnaissance would flesh out a target’s identity: job title, responsibilities, and public social media profiles.

Back on the FEC site, the attacker could see which vendors a staffer might use, such as travel services like airlines or hotels. It’s not hard to imagine a phishing email spoofing a hotel chain, complete with logo and corporate typeface. The now defunct Warren for President campaign, for instance, listed Hyatt as a vendor. With a single click on a fraudulent email, malware can be injected to scope a network for sensitive files.

Platforms can also be targets

Attackers could also learn which platforms a campaign uses, then try to exploit known vulnerabilities.

An example: The Trump campaign uses Stripe to process online payments. Time for a new MAGA cap? Some Trump-Pence wrapping paper? Stripe will handle the payment in a matter of seconds. To the best of my knowledge, Stripe does not have any vulnerabilities that can be targeted by attackers. But an enterprising phisher might check to see if it does, along with other platforms the campaign relies on, like its fundraising engines or secure email gateways.

Using what they learn about a campaign’s technology stack, phishers could create an email that has a better chance of getting through and causing serious damage.

Third-party services are notorious for lackluster cybersecurity, especially small businesses (like campaigns) with small security budgets. Say a campaign office in Wisconsin uses a local caterer. A phish disguised as a friendly email, with an innocent-looking invoice attached, might not fool most staffers. But it only takes one. Larger third parties, especially tech providers of SaaS, software, and cloud platforms, offer attackers even more fodder. Who provides the payroll system for the Biden campaign? The email marketing suite for Trump 2020? It’s not hard to find out.

We all need to step up

There are plenty of other sources phishing attackers can mine for intel. Social media is probably the richest lode. Is resistance futile? Not at all. The fallible human beings phishing attackers prey on can also be stout defenders when they learn the right habits. Regular training and healthy skepticism go a long way.

Transparency is essential to democratic elections. But security is also important to the integrity of the process. Ultimately, all of us—whether we’re security professionals, campaign staffers, or both—need to be vigilant. Before you click, verify.

Joshua Bartolomie is the director of Cofense Labs and Cofense Intelligence. He is responsible for translating corporate business strategies, cyber threat landscapes, and related environmental conditions into cutting edge and actionable cybersecurity research.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure