Attacks/Breaches
11/29/2012
11:09 AM
50%
50%

U.S. Bank Attackers Dispute Iran Ties

Izz ad-Din al-Qassam Cyber Fighters resurface, not with new DDoS takedowns, but a media interview to explain their motives.

Who Is Hacking U.S. Banks? 8 Facts
Who Is Hacking U.S. Banks? 8 Facts
(click image for larger view and for slideshow)
Remember the Muslim hackers behind the "Operation Ababil" attack campaign against Wall Street banks, which saw leading U.S. financial firms' websites disrupted at preannounced days and times?

The group that's claimed responsibility for the attacks -- calling themselves the Izz ad-Din al-Qassam Cyber Fighters -- is back. Thankfully, however, it's only to grant an interview.

After weeks of website takedowns, the last post to the group's Pastebin account, on October 25, 2012, announced that the group was pausing its distributed denial-of-service (DDoS) attacks in honor of the Muslim Eid al-Adha holiday. That represented the culmination of six weeks of attacks that disrupted the websites of numerous firms, including Bank of America, JPMorgan Chase and Wells Fargo.

In classic hacktivist fashion, however, at the same time as it announced the pause, the group promised to grant a media interview. "To commemorate this breezy and blessing day, we will stop our attack operations during the next days. Instead, we are going to have an interview with one of the American media and press about our ideas and positions," read the group's announcement. "Every press volunteer to interview us, send its full specifications and offers to us throughout ([email protected])."

[ Symantec says Iranian accounting software is under attack, but Iran disputes the threat. See Malware Corrupts Iranian Financial Databases. ]

Curiously, the interview that resulted from that open offer was apparently granted to Flashpoint Partners, which describes itself as a "consulting and data services enterprise focused on threat actors in cyberspace," and says its "customers and partners" include the Department of Defense, NBC and the Department of Justice.

What revelations does the interview with Flashpoint Partners contain? For starters, the hacktivists reiterated their previous assertions that the targeting of U.S. banks' websites was in retaliation for the release of the Innocence of Muslims film that mocks the founder of Islam. A 13-minute clip of the film was uploaded in September to YouTube, and the group has demanded that the video be removed from the Internet.

The group argued in its interview that the website disruptions were commensurate with the perceived insult. "We have not pursued any hit or destruction in the United States. We have selected the banks because we should have done something proportional to what has happened against us," they said. "In the system where ... religion and sacred things are not honorable, and only material, money and finance have value, this seems a suitable and effective ... [action] and can influence governors and decision makers."

What are the hacktivists' overall political aims? The name of their group apparently references "Izz ad-Din al-Qassam, a Muslim holy man who fought against European forces and Jewish settlers in the Middle East in the 1920s and 1930s," according to The New York Times. But in the interview, the group's representative said the choice of name was apolitical. "We don't have connection with any fractional or political structure," according to the group. "Also we are not aware of nationality composition of our group's members. Our unifying and gathering factor is protesting against insulting sanctities."

U.S. government officials have blamed Iran for sponsoring the banking website disruptions for which the group has claimed credit. But in the interview, the hacktivists disputed that assertion. "We are not dependent on any government. We merely wanted to protest against the insulting movie," they said. "But there are some ones who want to portray this action as political. So they are deflecting the issue to the side of their political leanings."

Interestingly, the group also distanced itself from the Hilf-ol-Fozoul blog, which had suggested that the hacktivist group's attacks were the work of a crowdsourced, Anonymous-like operation. Instead, the Izz ad-Din al-Qassam Cyber Fighters said the only official communications from their group are disseminated via their Pastebin account.

Asked whether or not the group was using botnets to attack service providers and hosting companies, as some security experts have suggested -- and other security experts have disputed -- the group said that "any of [the] technical comments during the attacks have made us doubtful about [the] technical competence of American companies' security consultants" and noted that "many of [the] technical statements about this case are not scientific, reliable or significant."

Has Operation Ababil now run its course? In the interview, the group of "volunteer hackers" threatened that unless the Innocence of Muslims film gets excised from the Internet, it could resume its attacks.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Printers: The Weak Link in Enterprise Security
Kelly Sheridan, Associate Editor, Dark Reading,  10/16/2017
20 Questions to Ask Yourself before Giving a Security Conference Talk
Joshua Goldfarb, Co-founder & Chief Product Officer, IDDRA,  10/16/2017
Why Security Leaders Can't Afford to Be Just 'Left-Brained'
Bill Bradley, SVP, Cyber Engineering and Technical Services, CenturyLink,  10/17/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.