Attacks/Breaches
11/29/2012
11:09 AM
50%
50%

U.S. Bank Attackers Dispute Iran Ties

Izz ad-Din al-Qassam Cyber Fighters resurface, not with new DDoS takedowns, but a media interview to explain their motives.

Who Is Hacking U.S. Banks? 8 Facts
Who Is Hacking U.S. Banks? 8 Facts
(click image for larger view and for slideshow)
Remember the Muslim hackers behind the "Operation Ababil" attack campaign against Wall Street banks, which saw leading U.S. financial firms' websites disrupted at preannounced days and times?

The group that's claimed responsibility for the attacks -- calling themselves the Izz ad-Din al-Qassam Cyber Fighters -- is back. Thankfully, however, it's only to grant an interview.

After weeks of website takedowns, the last post to the group's Pastebin account, on October 25, 2012, announced that the group was pausing its distributed denial-of-service (DDoS) attacks in honor of the Muslim Eid al-Adha holiday. That represented the culmination of six weeks of attacks that disrupted the websites of numerous firms, including Bank of America, JPMorgan Chase and Wells Fargo.

In classic hacktivist fashion, however, at the same time as it announced the pause, the group promised to grant a media interview. "To commemorate this breezy and blessing day, we will stop our attack operations during the next days. Instead, we are going to have an interview with one of the American media and press about our ideas and positions," read the group's announcement. "Every press volunteer to interview us, send its full specifications and offers to us throughout (alqassamcyberfighter@myway.com)."

[ Symantec says Iranian accounting software is under attack, but Iran disputes the threat. See Malware Corrupts Iranian Financial Databases. ]

Curiously, the interview that resulted from that open offer was apparently granted to Flashpoint Partners, which describes itself as a "consulting and data services enterprise focused on threat actors in cyberspace," and says its "customers and partners" include the Department of Defense, NBC and the Department of Justice.

What revelations does the interview with Flashpoint Partners contain? For starters, the hacktivists reiterated their previous assertions that the targeting of U.S. banks' websites was in retaliation for the release of the Innocence of Muslims film that mocks the founder of Islam. A 13-minute clip of the film was uploaded in September to YouTube, and the group has demanded that the video be removed from the Internet.

The group argued in its interview that the website disruptions were commensurate with the perceived insult. "We have not pursued any hit or destruction in the United States. We have selected the banks because we should have done something proportional to what has happened against us," they said. "In the system where ... religion and sacred things are not honorable, and only material, money and finance have value, this seems a suitable and effective ... [action] and can influence governors and decision makers."

What are the hacktivists' overall political aims? The name of their group apparently references "Izz ad-Din al-Qassam, a Muslim holy man who fought against European forces and Jewish settlers in the Middle East in the 1920s and 1930s," according to The New York Times. But in the interview, the group's representative said the choice of name was apolitical. "We don't have connection with any fractional or political structure," according to the group. "Also we are not aware of nationality composition of our group's members. Our unifying and gathering factor is protesting against insulting sanctities."

U.S. government officials have blamed Iran for sponsoring the banking website disruptions for which the group has claimed credit. But in the interview, the hacktivists disputed that assertion. "We are not dependent on any government. We merely wanted to protest against the insulting movie," they said. "But there are some ones who want to portray this action as political. So they are deflecting the issue to the side of their political leanings."

Interestingly, the group also distanced itself from the Hilf-ol-Fozoul blog, which had suggested that the hacktivist group's attacks were the work of a crowdsourced, Anonymous-like operation. Instead, the Izz ad-Din al-Qassam Cyber Fighters said the only official communications from their group are disseminated via their Pastebin account.

Asked whether or not the group was using botnets to attack service providers and hosting companies, as some security experts have suggested -- and other security experts have disputed -- the group said that "any of [the] technical comments during the attacks have made us doubtful about [the] technical competence of American companies' security consultants" and noted that "many of [the] technical statements about this case are not scientific, reliable or significant."

Has Operation Ababil now run its course? In the interview, the group of "volunteer hackers" threatened that unless the Innocence of Muslims film gets excised from the Internet, it could resume its attacks.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-4807
Published: 2014-11-22
Sterling Order Management in IBM Sterling Selling and Fulfillment Suite 9.3.0 before FP8 allows remote authenticated users to cause a denial of service (CPU consumption) via a '\0' character.

CVE-2014-6183
Published: 2014-11-22
IBM Security Network Protection 5.1 before 5.1.0.0 FP13, 5.1.1 before 5.1.1.0 FP8, 5.1.2 before 5.1.2.0 FP9, 5.1.2.1 before FP5, 5.2 before 5.2.0.0 FP5, and 5.3 before 5.3.0.0 FP1 on XGS devices allows remote authenticated users to execute arbitrary commands via unspecified vectors.

CVE-2014-8626
Published: 2014-11-22
Stack-based buffer overflow in the date_from_ISO8601 function in ext/xmlrpc/libxmlrpc/xmlrpc.c in PHP before 5.2.7 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code by including a timezone field in a date, leading to improper XML-RPC encoding...

CVE-2014-8710
Published: 2014-11-22
The decompress_sigcomp_message function in epan/sigcomp-udvm.c in the SigComp UDVM dissector in Wireshark 1.10.x before 1.10.11 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted packet.

CVE-2014-8711
Published: 2014-11-22
Multiple integer overflows in epan/dissectors/packet-amqp.c in the AMQP dissector in Wireshark 1.10.x before 1.10.11 and 1.12.x before 1.12.2 allow remote attackers to cause a denial of service (application crash) via a crafted amqp_0_10 PDU in a packet.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?