Attacks/Breaches
10/5/2012
12:58 PM
Connect Directly
RSS
E-Mail
50%
50%

Bank Hacks: 7 Misunderstood Facts

As security researchers review recent bank hacks--affecting Bank of America, JPMorgan Chase, PNC, U.S. Bank, and Wells Fargo--claims made by supposed hacktivists don't all add up.

Who's behind the recent online attacks against multiple financial institutions including Bank of America, JPMorgan Chase, PNC, U.S. Bank, and Wells Fargo? In recent weeks, all have bit hit by large-scale distributed denial-of-service (DDoS) attacks. Cue website outages and customer outrage.

A self-described hacktivist group, the Cyber fighters of Izz ad-din Al qassam, has taken credit for organizing the related Operation Ababil, which it claims is a grassroots campaign to protest the recent release of a film that mocked the founder of Islam.

But as information security researchers review the attacks and tools used, they're finding that the claims made by the supposed hacktivist group don't all appear to add up. Here are seven facts about what's currently known about recent and forthcoming banking attacks.

1. Hacktivist Tool Claims Remain Unverified

Was a hacktivist group really behind the bank attacks, or--as some former U.S. government officials have alleged in anonymous interviews--might the government of Iran be to blame?

"In its postings, Cyber fighters of Izz ad-din Al Qassam published several attack tools including the Mobile LOIC Apache Killer version," said Ronen Kenig, director of product marketing for security products at Radware, in a blog post. "That tool was not present in the observed attack traffic, however, meaning it is possible that the Cyber fighters of Izz ad-din Al Qassam group was not behind the attack after all, or that it didn't manage to recruit supporters to its attack who were willing to use the mobile LOIC attack tool."

[ Criminals are tripling down on attack infrastructure. See Online Criminals' Best Friends: Malnets. ]

2. Servers, Not Botnets, Disrupted Bank Sites

What the attackers lacked in grassroots support, they made up for in attack strength, since they successfully disrupted the websites of leading banks, even after publicizing in advance the date and time of their attacks. Their attack power came from the use of server-infecting malware. "The majority of the attack traffic was not generated from a botnet, but rather from servers," said Carl Herberger, VP of security solutions at Radware, via phone. "The servers were compromised by the attackers prior to the attack."

Using server malware is unusual, and according to Arbor Networks researchers, the attacks don't resemble any previously seen hacktivism campaigns. "These are high-bandwidth servers that have obviously been compromised," said Dan Holden, director of security for the Arbor security engineering and respo nse team, speaking by phone. "So you're talking about probably hosting websites that have been compromised or used."

Recent hacktivist attacks have involved botnets of infected PCs--not servers. "For years and years, there have been botnets used for DDoS," said Holden. "Then you had opt-in hacktivism activity, and the 'hive mind' type of feature set. And now this is almost back to the future, where you're going back to the 1990s style of servers being leveraged, because of course they have very high bandwidth."

3. Attack Toolkit Positively Identified

One of the DDoS toolkits used in the attacks--and it may be the only one--has been identified as the 'itsoknoproblembro' tool kit. According to Prolexic Technologies, the toolkit has been used to launch "sustained floods" that have peaked at 70 Gbps and 30 million packets per second.

The tool can also be used to launch blended DDoS attacks. "The itsoknoproblembro toolkit includes multiple infrastructure and application-layer attack vectors, such as SYN floods, that can simultaneously attack multiple destination ports and targets, as well as ICMP, UDP, and SSL encrypted attack types," according to Prolexic. In addition, the toolkit can also be used to take out domain name system (DNS) infrastructure via UDP floods.

4. Banks Knocked Offline Via Encrypted SSL Floods

Beyond the volume of attacks generated, the banking website disruptions were also successful because they included SSL attacks, which can be generated by tools such as Dirt Jumper.

"Every SSL DDoS attack that we've seen has been an HTTP GET flood that's been encrypted," said Radware's Herberger. "It's been a very simple flood ... [but] the infrastructures that are in place to prevent SSL attacks are designed against intrusion events, not DDoS attacks."

Unfortunately, devices that provide SSL intrusion prevention can themselves become DDoS targets and be successfully shut down using relatively little traffic. "In one case in the last two weeks, we saw a financial services organization with 40 gigabits of external link that was taken down with 30 megabits of SSL attack," Herberger said.

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
progan01
50%
50%
progan01,
User Rank: Apprentice
10/8/2012 | 1:20:00 AM
re: Bank Hacks: 7 Misunderstood Facts
Looks like cyberwar has begun in earnest. How do you respond when you don't have a smokestack to send a missile down?
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7407
Published: 2014-10-22
Cross-site request forgery (CSRF) vulnerability in the MRBS module for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

CVE-2014-3675
Published: 2014-10-22
Shim allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted DHCPv6 packet.

CVE-2014-3676
Published: 2014-10-22
Heap-based buffer overflow in Shim allows remote attackers to execute arbitrary code via a crafted IPv6 address, related to the "tftp:// DHCPv6 boot option."

CVE-2014-3677
Published: 2014-10-22
Unspecified vulnerability in Shim might allow attackers to execute arbitrary code via a crafted MOK list, which triggers memory corruption.

CVE-2014-4448
Published: 2014-10-22
House Arrest in Apple iOS before 8.1 relies on the hardware UID for its encryption key, which makes it easier for physically proximate attackers to obtain sensitive information from a Documents directory by obtaining this UID.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.