The Kremlin has denied allegations its FSB intelligence agency was involved in the Yahoo data breach, despite two of its agents being indicted by the US Department of Justice on suspicion of hacking into the search giant's user database.
"We have said repeatedly that there can be no discussion of any official involvement of any Russian office, including the FSB, being involved in any unlawful cyber activities,"spokesman Dmitry Peskov said in a statement.
The spokesman for the Russian government told reporters at a press conference that the allegations were unfounded and in fact, it had not been approached by the US government, but was obtaining its information about the allegations from the media.
"We learned about this situation from the media, as far as we know, we did not receive any information from official channels, so unfortunately we do not have the details," Peskov added. "Russia has always expressed interest in cooperation in the field of countering cybercrime and ensuring cybersecurity, we believe that this is one of the priorities in our time."
According to Sky News, it's a well-discussed subject between US authorities and cyber security specialists that Russia employs hackers to help the government "advance its agenda while denying involvement".
16/03/2017: US government reveals how Russian spies allegedly hacked Yahoo
US officials have revealed how Russian spies allegedly carried out a massive attack on Yahoo's systems, enabling the Kremlin to spy on more than 500 million people.
The Department of Justice yesterday indicted two Russian nationals and residents, 33-year old Dmitry Aleksandrovich Dokuchaev and 43-year-old Igor Anatolyevich Sushchin, who worked as officers for Russian intelligence agency the FSB.
Yahoo has praised the news, saying: "The indictment unequivocally shows the attacks on Yahoo were state-sponsored. We are deeply grateful to the FBI for investigating these crimes and the DOJ for bringing charges against those responsible."
"We appreciate the FBI's diligent investigative work and the DOJ's decisive action to bring to justice to those (sic) responsible for the crimes against Yahoo and its users. We're committed to keeping our users and our platforms secure and will continue to engage with law enforcement to combat cybercrime."
"The criminal conduct at issue, carried out and otherwise facilitated by officers from an FSB unit that serves as the FBI's point of contact in Moscow on cybercrime matters, is beyond the pale," said acting assistant attorney General McCord. "State actors may be using common criminals to access the data they want, but the indictment shows that our companies do not have to stand alone against this threat."
The indictment also named 29-year old Latvian-born Russian national and resident Alexsey Alexseyvich Belan, as well as a fourth man, 22-year old Canadian and Kazakh national and Canadian resident Karim Baratov, both of whom are accused of being criminal hackers.
The indictment accuses Sushchin and Dokuchaev of disregarding an Interpol Red Notice for the detention of Belan, who was placed on the FBI's list of most wanted cyber criminals in 2013. Rather than arresting him, the DoJ claims the two FSB agents used him to gain access to Yahoo's systems.
Belan reportedly stole all or part of Yahoo's user database, which acts as a registry of all the information associated with user accounts. This includes names, phone numbers and alternate email addresses, but most importantly it also contained all the data to forge browser cookies.
Using this information, as well as access to Yahoo's internal account management tools, Belan, Dokuchaev and Sushchin were able to identify high-value Yahoo accounts and forge counterfeit cookies for those accounts, which would trick web browsers into thinking that they had already logged in as the victim.
Among the 6,500 Yahoo users the FSB agents targeted with this scheme were targets that were "of predictable interest", including journalists, government officials in both the US and Russia, and the staff of "a prominent Russian cybersecurity company". Also targeted were employees of private sector banking and investment firms in Switzerland, Russia and the US, as well as an American airline and a French transportation company.
The US has accused Sushchin and Dokuchaev not just of directing Belan to hack into Yahoo, but also facilitating his unrelated criminal activities by feeding him "intelligence information that would have helped him avoid detection by US and other law enforcement agencies". Belan allegedly made the most of this, stealing gift card numbers and credit card information from Yahoo accounts and using over 30 million users' contact details to propagate a spam campaign.
Baratov was reportedly instructed by the two FSB agents to access accounts held by high-value targets with other online providers, using data obtained as part of the Yahoo hack to gain entry.
Between them, the four men have been charged with over 47 counts of hacking and espionage-related offences, including conspiracy to commit wire fraud, aggravated identity theft and theft of trade secrets.
"Silicon Valley's computer infrastructure provides the means by which people around the world communicate with each other in their business and personal lives," said US attorney Brian Stretch. "The privacy and security of those communications must be governed by the rule of law, not by the whim of criminal hackers and those who employ them.
"We will not tolerate unauthorised and illegal intrusions into the Silicon Valley computer infrastructure upon which both private citizens and the global economy rely."
