Russia ‘hacked the Olympics’ and tried to make it look like North Korea did it, US officials claim
Russian military spies hacked several hundred computers used at the 2018 Winter Olympic Games in South Korea, according to anonymous US intelligence officials.
They tried to make it appear as though the intrusion was by North Korea, the officials claim.
Officials in Pyeongchang acknowledged that the Games were hit by a cyberattack during the February 9 opening ceremony but refused to say whether Russia was responsible. That evening there were disruptions to the internet, broadcast systems and the Olympics website. Many attendees were unable to print their tickets, resulting in empty seats.
Analysts say the disruption may have been retaliation against the International Olympic Committee for banning the Russian team from the Winter Games due to alleged doping violations. No officials from Russia’s Olympic federation were allowed to attend, and while some athletes were permitted to compete under the designation “Olympic Athletes from Russia”, they were unable to display the Russian flag on their uniforms and, if they won medals, their country’s anthem was not played.
As of early February, the Russian military agency GRU had access to as many as 300 Olympic-related computers, according to an intelligence report this month.
The intelligence, which has not been publicly affirmed, is consistent with reports from private-sector analysts who have said they saw signs Russia targeted the 2018 Olympics.
Some US officials are concerned the Russians may try to disrupt the closing ceremony on Sunday. “We’re watching it pretty closely,” said one. “It’s essentially a Korean problem,” the official said. “We will help the Koreans as requested.”
Apart from accessing the computers, GRU cyber-operators are said to have hacked routers in South Korea last month and deployed new malware on the day the Olympics began, according to Western intelligence agencies. Such access could enable intelligence collection or network attacks, officials said.
It is not clear whether the disruptions during the opening ceremony were the result of that access, information security experts said.
“Anyone who controls a router would be able to redirect traffic for one or more selected targets or cause total disruption in the network by stopping the routing entirely,” said Jake Williams, a former National Security Agency cyber-operator and co-founder of Rendition Infosec, a cybersecurity firm. “Development of router malware is extremely costly, and Russia would probably use it only in locations where it contributes to accomplishing a high-value goal.”
The GRU hackers are thought to work for the agency’s Main Centre for Special Technology, or GTsST, according to intelligence agencies. That unit has been highly active in information warfare against the West and was behind the NotPetya cyberattack that crippled computers in Ukraine last year.
Two years ago, GRU penetrated a database containing drug test results and confidential medical data, and posted information about noteworthy US athletes including tennis stars Serena and Venus Williams, four-time gymnastics gold medallist Simone Biles and women’s basketball player Elena Delle Donne.
That action was widely seen as payback after nearly every member of Russia’s track and field team was banned from the 2016 Olympics following claims of a widespread, government-run doping scheme. However, the recent overturning of some of the bans by the court of arbitration for sport has raised questions about the validity of the claims.
Russia has a long history of undertaking such “active measures” against the Olympic Games, noted Thomas Rid, a professor of strategic studies at Johns Hopkins University. During the 1984 Olympics in Los Angeles, Soviet intelligence released fake Ku Klux Klan leaflets threatening violence against African athletes as part of an effort to embarrass the United States, he said. That year, the Soviets led a 14-nation boycott of the Games in retaliation for a US boycott of the 1980 Summer Games in Moscow, which was prompted by the Soviets’ 1979 invasion of Afghanistan.
The 1984 effort failed, Rid said, because the US government “very quickly” revealed the Soviet attempt. As a result, no African athletes withdrew from the Games.
While “old-school” tactics relied on leaflets among other things, the internet has provided new tools to spread disinformation, he said.
In this case, the GRU sought to make it appear as though the intrusions were the work of North Korean hackers by using North Korean IP addresses and other tactics, said the officials. Such deception is common for the GRU.
