CIA director's email apparently hacked by California high school students

Federal investigators are examining claims that high school students hacked CIA director John Brennan’s personal email account and published identifying information for more than 20 alleged CIA personnel.

On Monday the hackers released a spreadsheet allegedly from Brennan’s account that included the alleged CIA employees’ clearance levels, email addresses, phone numbers and social security numbers.

Former National Security Agency technical director Jasper Graham said the highly embarrassing breach of Brennan’s email was likely a “social engineering” attack, in which personal information supposedly only the account holder would know is used to break in.

“Social media has enabled this to the nth degree, because a quick profile search and a friend request and then LinkedIn can get you enough information to start resetting things. All the providers, whether it’s credit cards or banks, have to have something else in place.”

A Twitter account being used by the hackers threatened to release more information from Brennan’s account, which they reportedly breached after the hackers convinced Verizon to give them the details. The account was suspended Monday afternoon.

The hack of Brennan’s AOL account was first reported by the New York Post . According to the Post, the unnamed hacker described himself as an “American high school student who is not Muslim and was motivated by opposition to US foreign policy and support for Palestine”.

“We are aware of the reports that have surfaced on social media and have referred the matter to the appropriate authorities,” a CIA spokesperson told the Guardian. The FBI said that it too is investigating the hack.

Related: OPM director resigns over data hack that affected up to 22 million Americans

Several of the cell numbers, posted by the hacker on Twitter, went directly to voicemail, though one went to a woman who said that she had been receiving calls for the person on the spreadsheet “for like two years”.

“I always tell people this is the wrong number,” she said. “If you do get in touch with him, could you ask him to update his information?”

The hackers – two of them, they say – have said on their Twitter accounts that they support Palestinian statehood; they also told Gawker with respect to the sudden spotlight on the breach that they were “pretty hype about it”.

The pair of Twitter accounts associated with the hack kept up a steady stream of teasing tweets followed by screenshots of potentially damaging information, including screenshots of financial info.

The breach comes as Democratic presidential candidate Hillary Clinton faces intense scrutiny of her use of a private email account while she was secretary of state. Clinton is expected to testify before Congress about her private email server on Thursday.

The hack is one of dozens in the past several weeks, among them data broker Experian, the US government’s Office of Personnel Management, and a hotel chain owned by Donald Trump.

Sven Schrecker, chief architect of IoT security solutions for Intel, saidthe problem was not technological. “People haven’t had to worry about this for 15 years,” he said. “Every single email app out there has the capability to take [security measures such as] keys and certificates. Nobody uses them. Nobody. That’s your technology solution. That’s the problem.”

The advent of the “internet of things”, said Schrecker, is likely to raise awareness, if only because it will create further security challenges. “I don’t understand how, without a security infrastructure in place, any of that will ever be secure,” he said. (Intel and other companies are designing such architectures.) “There’s a certain time window, that we’re in right now, when we need to address these problems.”

Graham said that he had some sympathy for government organizations trying – and failing – to change their practices.

“The government is in a real bind in that they’re not like a lot of industries,” said Graham, who now works for security company Darktrace as senior vice-president of cyber technologies. “They have a lot of demands that say ‘you must interact with this department’ and it doesn’t matter if that’s a small department in the middle of nowhere that has no security.”

Graham likened the breach to evolving standards at banks. “Back in the very early days of bank-robbing, there wasn’t a standard for how to build a bank vault,” he said. “Now we don’t have vaults built out of straw any more.”

Graham said that if AOL or Verizon had raised a red flag by tracking the location of the login against Brennan’s usual points of access, the attack might never have happened: “I’m sure if [Brennan] had gotten a text message saying ‘do you want to reset your password?’ he would have said no.”

guardian.co.uk © Guardian News and Media 2015