Federal prosecutors charged two Russian intelligence agents with orchestrating a 2014 hack that compromised 500 million Yahoo accounts in a brazen campaign to access the e-mails of thousands of journalists, government officials, and technology company employees.
In a 38-page indictment unsealed Wednesday, the prosecutors said Dmitry Aleksandrovich Dokuchaev, 33, and Igor Anatolyevich Sushchin, 43—both officers of the Russian Federal Security Service—worked with two other men—Alexsey Alexseyevich Belan, 29, and Karim Baratov, 22—who were also indicted. The men gained initial access to Yahoo in early 2014 and began their reconnaissance, the indictment alleged. By November or December, Belan used the file transfer protocol to download part or all of a Yahoo database that contained user names, recovery e-mail accounts, and phone numbers. The user database (UDB) also contained the cryptographic nonces needed to generate the account-authentication browser cookies for more than 500 million accounts.
Belan also downloaded an account management tool (AMT) that Yahoo used to make and track changes to user accounts. Together, the pilfered UDB and AMT allowed Belan, Dokuchaev and Sushchin to locate Yahoo e-mail accounts of interest and to mint authentication cookies needed to access 6,500 accounts without authorization. The accounts belonged to Russian journalists, Russian and US government officials, employees of a prominent Russian security company, and employees of other Internet companies the indicted men wanted to target. Belan and Baratov also used their access to commit additional crimes, including by manipulating Yahoo search results to promote a scam involving erectile dysfunction drugs, stealing electronic gift cards, and sending spam messages to Yahoo users’ contacts.
Baratov was arrested Tuesday night by the Toronto Police Department’s fugitive squad. Belan and the two FSB officers are in Russia; the US has requested they be handed over to face charges, but the US has no extradition treaty with Russia, and Russia has not been cooperative in regard to existing charges against Belan. Additionally, Dokuchaev and Sushchin are members of FSB’s “Center 18,” the office within the agency that has been designated as the point of contact for cooperation with the FBI on other matters. Dokuchaev, Sushchin, and Belan are all Russian nationals and residents; Baratov is a Kazakh national and resident of Canada.
In a statement this morning, acting Assistant Attorney General Mary McCord said that there was no connection between this investigation and the investigation into the breach of the Democratic National Committee. A Justice Department official toldthat investigators don’t know if the Kremlin was involved. Dokuchaev, who also went by the alias “Forb,” was among those arrested on treason charges in December in Moscow, according to the news agency Interfax. One of the others arrested in the same sweep was a researcher for Kaspersky Lab, the largest security firm in the Russian Federation. It wasn’t immediately clear if that was the “prominent” Russian security company mentioned in the indictment. Belan, meanwhile, has been listed as the FBI’s most wanted criminal hacker.
The suspects allegedly used a variety of methods to compromise targets’ computers. In some cases they used spear phishing messages to trick people into installing malware or divulging passwords. They eventually were able to create authentication cookies that allowed them to access Yahoo accounts. Like many other Web services, Yahoo stored the small text files on the hard drives of users who had previously logged in. The cookies allowed the device to access the account for a specified duration, without requiring the user to reenter a password. The suspects often targeted the accounts of close associates of their targets, including spouses and children, in an attempt to gain additional information.
The men, prosecutors said, also used spear phishing to target at least 50 Google Mail accounts belonging to targeted individuals including an assistant to the deputy chairman of the Russian Federation, an officer of the Russian Ministry of Internal Affairs, and a physical training expert working in the Ministry of Sports of a republic.
Persistent access, no password required
Once inside Yahoo’s network, the suspects were able to mint cookies internally by loading programs on Yahoo servers. They were also able to mint cookies externally using the nonces taken from the user database. The pseudo-random values, which are unique to each account, were valid as of November 2014. Whenever a user changed an account password, however, the nonces were no longer valid. The forged cookies likely had the ability to work even when accounts were protected by two-factor authentication and strong passwords.
“The conspirators discussed among themselves how to mint cookies to access Yahoo accounts,” the indictment alleged. “For example, on or about July 20, 2015, Dokuchaev sent Sushchin a minted cookie for a Yahoo user account, a file containing the below screenshot of a cookie manager application, and instructions for using the application to access the Yahoo email account.”
The indictment continued:
31. Both internally and externally minted cookies allowed the conspirators to appear to Yahoo’s servers as if the intruder had previously obtained valid access to the associated Yahoo user’s account, obviating the need to enter a user name and password for that account. The conspirators utilized cookie minting to access the contents of more than 6,500 user accounts.
32. The conspirators used their access to the AMT to (among other unauthorized actions) maintain persistent unauthorized access to some of the compromised accounts.
33. The AMT did not permit text searches of underlying data. It permitted the conspirators to access information about particular user accounts. However, by combining their control of the stolen UDB copy and access to the AMT, the conspirators could, for example, search the UDB contents to identify Yahoo user accounts for which the user had provided a recovery email account hosted by a specific company of interest to the conspirators (e.g., “exampleuser@ExampleCompany.com”)—showing that the user was likely an employee of the company of interest—and then use information from the AMT to gain unauthorized access to the identified accounts using the means described [earlier].
The suspects then used the unauthorized access to identify and access accounts of various people of interest. They included:
- A diplomat from a country bordering Russia who was posted in a European country
- The former minister of economic development, and his wife, of a country bordering Russia
- A Russian investigative reporter who worked for Kommersant Daily
- A public affairs consultant and researcher who analyzed Russia’s bid for membership to the World Trade Organization
- Three officers of a US-based cloud computing service
- A Russian deputy consul general and
- A senior officer at a Russian webmail and Internet-related services provider
The suspects allegedly used their access of Yahoo to compromise accounts at Google and other webmail providers. Among others, the compromised Gmail accounts belonged to an assistant to the deputy chairman of the Russian Federation; a managing director, a former sales officer, and a researcher who worked for a “major” Russian computer security firm; and an officer of the Russian Ministry of Internal Affairs who investigates technology of pornography offenses. Prosecutors said Baratov was directed by officers from Russia’s Federal Security Service to use spear phishing to target 80 accounts, 50 of which were Gmail accounts.
All four defendants were charged with conspiring to commit computer fraud and abuse. Dokuchaev, Sushchin, and Belan were also charged with conspiring to engage in economic espionage, conspiring to engage in theft of trade secrets, economic espionage, theft of trade secrets, conspiring to commit wire fraud, accessing or attempting to access a computer without authorization, transmitting code with the intent to cause damage, counterfeit access device fraud, conspiring to commit access device fraud, and conspiring to commit wire fraud. Dokuchaev and Baratov were charged with aggravated identity theft. The charges carry maximum prison sentences of two years to 20 years each.