”A spokeswoman for the security office said it would have no comment. Such keys supplement passwords to authenticate legitimate users, potentially frustrating distant hackers. Last month, Microsoft made news again when it seized several internet domains linked to Fancy Bear, including two apparently aimed at conservative think tanks in Washington. The NSA and DHS declined to offer further details.“The personal accounts of senators and their staff are high-value, low-hanging targets,” Rid wrote.Wyden has proposed legislation factory signs that would allow the security office to offer digital protection for personal accounts and devices, the same way it does with official ones.“In an ideal world, the Sergeant at Arms could just have a pile of YubiKeys,” said Tait.”  

The aide spoke on condition of anonymity because he was not authorized to discuss the issue publicly.”.The Wyden letter cites previous Associated Press reporting on the Russian hacking group known as Fancy Bear and how it targeted the personal accounts of congressional aides between 2015 and 2016.

The same group also spent the second half of 2017 laying digital traps intended to look like portals where Senate officials enter their work email credentials, the Tokyo-based cybersecurity firm TrendMicro has reported.”On Thursday, Google spokesman Aaron Stein confirmed that his company had notified the Senate targets.Wyden said Thursday that state-backed hackers “are like burglars who are knocking on windows and doors.

The Kremlin is by no means the only source of worry, said Matt Tait, a University of Texas cybersecurity fellow and former British intelligence official.Sen. “When legislators or staff come in they can (get) a quick cybersecurity briefing and pick up a couple of these for their personal accounts and their official accounts. “The November election grows ever closer, Russia continues its attacks on our democracy, and the Senate simply does not have the luxury of further delays. They are out knocking on a lot of them right now just looking for an opportunity to get through.Email theft is favored by hackers the world over, including the Russian military agents accused of leaking the content of Democrats’ inboxes ahead of the 2016 elections, and personal accounts have proven to be the easiest targets. “No rules, no regulations, no funding streams, no mandatory training, no systematic security support is available to secure these resources.Cybersecurity experts also recommend them for high-value cyber-espionage targets including human rights workers and journalists.  

Ron Wyden, an Oregon Democrat, said in a Wednesday letter to Senate leaders that his office discovered that “at least one major technology company” has warned an unspecified number of senators and aides that their personal email accounts were “targeted by foreign government hackers. Michael Rogers — then director of the National Security Agency — acknowledged that personal accounts of senior government officials “remain prime targets for exploitation” and said that officials at the NSA and Department for Homeland Security were discussing ways to better protect them. Steve Daines, the AP found.Microsoft seized some of those traps, and in September 2017 apparently thwarted an attempt to steal login credentials of a policy aide to Missouri Sen. Rid made the statement in a letter to Wyden last week .“There are lots of countries that are interested in what legislators are thinking, what they’re doing, how to influence them, and it’s not just for purposes of dumping their information online,” Tait said.”Guarding personal accounts is a complex, many-layered challenge.Such incidents “only scratch the surface” of advanced cyberthreats faced by US officials in the administration and Congress, according to Thomas Rid, a cybersecurity expert at Johns Hopkins University.  

The group’s prolific cyberspying targeted the Gmail accounts of current and former Senate staffers, including Robert Zarate, now national security adviser to Florida Sen. Marco Rubio, and Jason Thielman, chief of staff to Montana Sen. Claire McCaskill , the Daily Beast discovered in July.In an April 12 letter released by Wyden’s office, Adm.”Attempts to breach such accounts were a major feature of the yearlong AP investigation into Fancy Bear that identified hundreds of senior officials and politicians — including former secretaries of state, top generals and intelligence chiefs — whose Gmail accounts were targeted.

Neither Stein nor Wyden provided any indication as to who might be behind the attempted break-ins, whether they targeted lawmakers from both political parties or their timing, though a Senate staffer said they occurred “in the last few weeks or months.Wyden noted that the Office of the Sergeant at Arms, which oversees Senate security, had informed legislators and staffers that it has no authority to help secure personal, rather than official, accounts.“This must change,” Wyden wrote in the letter.State-backed hackers are still trying to break into the personal email accounts of US senators and their aides — and a lawmaker focused on cybersecurity says the Senate’s security office should stop refusing to help defend them.Boosting protection in the Senate could begin with the distribution of small chip-based security devices such as the YubiKey, which are already used in many secure corporate and government environments, Tait said.