Attacks/Breaches
11/29/2012
11:09 AM
Connect Directly
RSS
E-Mail
50%
50%

U.S. Bank Attackers Dispute Iran Ties

Izz ad-Din al-Qassam Cyber Fighters resurface, not with new DDoS takedowns, but a media interview to explain their motives.

Who Is Hacking U.S. Banks? 8 Facts
Who Is Hacking U.S. Banks? 8 Facts
(click image for larger view and for slideshow)
Remember the Muslim hackers behind the "Operation Ababil" attack campaign against Wall Street banks, which saw leading U.S. financial firms' websites disrupted at preannounced days and times?

The group that's claimed responsibility for the attacks -- calling themselves the Izz ad-Din al-Qassam Cyber Fighters -- is back. Thankfully, however, it's only to grant an interview.

After weeks of website takedowns, the last post to the group's Pastebin account, on October 25, 2012, announced that the group was pausing its distributed denial-of-service (DDoS) attacks in honor of the Muslim Eid al-Adha holiday. That represented the culmination of six weeks of attacks that disrupted the websites of numerous firms, including Bank of America, JPMorgan Chase and Wells Fargo.

In classic hacktivist fashion, however, at the same time as it announced the pause, the group promised to grant a media interview. "To commemorate this breezy and blessing day, we will stop our attack operations during the next days. Instead, we are going to have an interview with one of the American media and press about our ideas and positions," read the group's announcement. "Every press volunteer to interview us, send its full specifications and offers to us throughout (alqassamcyberfighter@myway.com)."

[ Symantec says Iranian accounting software is under attack, but Iran disputes the threat. See Malware Corrupts Iranian Financial Databases. ]

Curiously, the interview that resulted from that open offer was apparently granted to Flashpoint Partners, which describes itself as a "consulting and data services enterprise focused on threat actors in cyberspace," and says its "customers and partners" include the Department of Defense, NBC and the Department of Justice.

What revelations does the interview with Flashpoint Partners contain? For starters, the hacktivists reiterated their previous assertions that the targeting of U.S. banks' websites was in retaliation for the release of the Innocence of Muslims film that mocks the founder of Islam. A 13-minute clip of the film was uploaded in September to YouTube, and the group has demanded that the video be removed from the Internet.

The group argued in its interview that the website disruptions were commensurate with the perceived insult. "We have not pursued any hit or destruction in the United States. We have selected the banks because we should have done something proportional to what has happened against us," they said. "In the system where ... religion and sacred things are not honorable, and only material, money and finance have value, this seems a suitable and effective ... [action] and can influence governors and decision makers."

What are the hacktivists' overall political aims? The name of their group apparently references "Izz ad-Din al-Qassam, a Muslim holy man who fought against European forces and Jewish settlers in the Middle East in the 1920s and 1930s," according to The New York Times. But in the interview, the group's representative said the choice of name was apolitical. "We don't have connection with any fractional or political structure," according to the group. "Also we are not aware of nationality composition of our group's members. Our unifying and gathering factor is protesting against insulting sanctities."

U.S. government officials have blamed Iran for sponsoring the banking website disruptions for which the group has claimed credit. But in the interview, the hacktivists disputed that assertion. "We are not dependent on any government. We merely wanted to protest against the insulting movie," they said. "But there are some ones who want to portray this action as political. So they are deflecting the issue to the side of their political leanings."

Interestingly, the group also distanced itself from the Hilf-ol-Fozoul blog, which had suggested that the hacktivist group's attacks were the work of a crowdsourced, Anonymous-like operation. Instead, the Izz ad-Din al-Qassam Cyber Fighters said the only official communications from their group are disseminated via their Pastebin account.

Asked whether or not the group was using botnets to attack service providers and hosting companies, as some security experts have suggested -- and other security experts have disputed -- the group said that "any of [the] technical comments during the attacks have made us doubtful about [the] technical competence of American companies' security consultants" and noted that "many of [the] technical statements about this case are not scientific, reliable or significant."

Has Operation Ababil now run its course? In the interview, the group of "volunteer hackers" threatened that unless the Innocence of Muslims film gets excised from the Internet, it could resume its attacks.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Must Reads - September 25, 2014
Dark Reading's new Must Reads is a compendium of our best recent coverage of identity and access management. Learn about access control in the age of HTML5, how to improve authentication, why Active Directory is dead, and more.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2003-1598
Published: 2014-10-01
SQL injection vulnerability in log.header.php in WordPress 0.7 and earlier allows remote attackers to execute arbitrary SQL commands via the posts variable.

CVE-2011-4624
Published: 2014-10-01
Cross-site scripting (XSS) vulnerability in facebook.php in the GRAND FlAGallery plugin (flash-album-gallery) before 1.57 for WordPress allows remote attackers to inject arbitrary web script or HTML via the i parameter.

CVE-2012-0811
Published: 2014-10-01
Multiple SQL injection vulnerabilities in Postfix Admin (aka postfixadmin) before 2.3.5 allow remote authenticated users to execute arbitrary SQL commands via (1) the pw parameter to the pacrypt function, when mysql_encrypt is configured, or (2) unspecified vectors that are used in backup files gene...

CVE-2012-5485
Published: 2014-09-30
registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors, related to the admin interface.

CVE-2012-5486
Published: 2014-09-30
ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Chris Hadnagy, who hosts the annual Social Engineering Capture the Flag Contest at DEF CON, will discuss the latest trends attackers are using.