Attacks/Breaches
10/5/2012
12:58 PM
Connect Directly
RSS
E-Mail
50%
50%

Bank Hacks: 7 Misunderstood Facts

As security researchers review recent bank hacks--affecting Bank of America, JPMorgan Chase, PNC, U.S. Bank, and Wells Fargo--claims made by supposed hacktivists don't all add up.

Who's behind the recent online attacks against multiple financial institutions including Bank of America, JPMorgan Chase, PNC, U.S. Bank, and Wells Fargo? In recent weeks, all have bit hit by large-scale distributed denial-of-service (DDoS) attacks. Cue website outages and customer outrage.

A self-described hacktivist group, the Cyber fighters of Izz ad-din Al qassam, has taken credit for organizing the related Operation Ababil, which it claims is a grassroots campaign to protest the recent release of a film that mocked the founder of Islam.

But as information security researchers review the attacks and tools used, they're finding that the claims made by the supposed hacktivist group don't all appear to add up. Here are seven facts about what's currently known about recent and forthcoming banking attacks.

1. Hacktivist Tool Claims Remain Unverified

Was a hacktivist group really behind the bank attacks, or--as some former U.S. government officials have alleged in anonymous interviews--might the government of Iran be to blame?

"In its postings, Cyber fighters of Izz ad-din Al Qassam published several attack tools including the Mobile LOIC Apache Killer version," said Ronen Kenig, director of product marketing for security products at Radware, in a blog post. "That tool was not present in the observed attack traffic, however, meaning it is possible that the Cyber fighters of Izz ad-din Al Qassam group was not behind the attack after all, or that it didn't manage to recruit supporters to its attack who were willing to use the mobile LOIC attack tool."

[ Criminals are tripling down on attack infrastructure. See Online Criminals' Best Friends: Malnets. ]

2. Servers, Not Botnets, Disrupted Bank Sites

What the attackers lacked in grassroots support, they made up for in attack strength, since they successfully disrupted the websites of leading banks, even after publicizing in advance the date and time of their attacks. Their attack power came from the use of server-infecting malware. "The majority of the attack traffic was not generated from a botnet, but rather from servers," said Carl Herberger, VP of security solutions at Radware, via phone. "The servers were compromised by the attackers prior to the attack."

Using server malware is unusual, and according to Arbor Networks researchers, the attacks don't resemble any previously seen hacktivism campaigns. "These are high-bandwidth servers that have obviously been compromised," said Dan Holden, director of security for the Arbor security engineering and respo nse team, speaking by phone. "So you're talking about probably hosting websites that have been compromised or used."

Recent hacktivist attacks have involved botnets of infected PCs--not servers. "For years and years, there have been botnets used for DDoS," said Holden. "Then you had opt-in hacktivism activity, and the 'hive mind' type of feature set. And now this is almost back to the future, where you're going back to the 1990s style of servers being leveraged, because of course they have very high bandwidth."

3. Attack Toolkit Positively Identified

One of the DDoS toolkits used in the attacks--and it may be the only one--has been identified as the 'itsoknoproblembro' tool kit. According to Prolexic Technologies, the toolkit has been used to launch "sustained floods" that have peaked at 70 Gbps and 30 million packets per second.

The tool can also be used to launch blended DDoS attacks. "The itsoknoproblembro toolkit includes multiple infrastructure and application-layer attack vectors, such as SYN floods, that can simultaneously attack multiple destination ports and targets, as well as ICMP, UDP, and SSL encrypted attack types," according to Prolexic. In addition, the toolkit can also be used to take out domain name system (DNS) infrastructure via UDP floods.

4. Banks Knocked Offline Via Encrypted SSL Floods

Beyond the volume of attacks generated, the banking website disruptions were also successful because they included SSL attacks, which can be generated by tools such as Dirt Jumper.

"Every SSL DDoS attack that we've seen has been an HTTP GET flood that's been encrypted," said Radware's Herberger. "It's been a very simple flood ... [but] the infrastructures that are in place to prevent SSL attacks are designed against intrusion events, not DDoS attacks."

Unfortunately, devices that provide SSL intrusion prevention can themselves become DDoS targets and be successfully shut down using relatively little traffic. "In one case in the last two weeks, we saw a financial services organization with 40 gigabits of external link that was taken down with 30 megabits of SSL attack," Herberger said.

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
progan01
50%
50%
progan01,
User Rank: Apprentice
10/8/2012 | 1:20:00 AM
re: Bank Hacks: 7 Misunderstood Facts
Looks like cyberwar has begun in earnest. How do you respond when you don't have a smokestack to send a missile down?
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Must Reads - September 25, 2014
Dark Reading's new Must Reads is a compendium of our best recent coverage of identity and access management. Learn about access control in the age of HTML5, how to improve authentication, why Active Directory is dead, and more.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-5619
Published: 2014-09-29
The Sleuth Kit (TSK) 4.0.1 does not properly handle "." (dotfile) file system entries in FAT file systems and other file systems for which . is not a reserved name, which allows local users to hide activities it more difficult to conduct forensics activities, as demonstrated by Flame.

CVE-2012-5621
Published: 2014-09-29
lib/engine/components/opal/opal-call.cpp in ekiga before 4.0.0 allows remote attackers to cause a denial of service (crash) via an OPAL connection with a party name that contains invalid UTF-8 strings.

CVE-2012-6107
Published: 2014-09-29
Apache Axis2/C does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

CVE-2012-6110
Published: 2014-09-29
bcron-exec in bcron before 0.10 does not close file descriptors associated with temporary files when running a cron job, which allows local users to modify job files and send spam messages by accessing an open file descriptor.

CVE-2013-1874
Published: 2014-09-29
Untrusted search path vulnerability in csi in Chicken before 4.8.2 allows local users to execute arbitrary code via a Trojan horse .csirc in the current working directory.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
In our next Dark Reading Radio broadcast, we’ll take a close look at some of the latest research and practices in application security.