Attacks/Breaches
1/9/2013
11:07 AM
50%
50%

U.S. Bank Hack Attack Techniques Identified

Security researchers detail how poorly secured, hosted servers helped launch botnet-based attacks; U.S. government continues to blame Iran.

Self-proclaimed Muslim hacktivists that have been disrupting U.S. banks' websites since September are compromising poorly secured, hosted servers to sustain their large-scale attacks.

That warning comes by way of security firm Incapsula, which said it recently discovered that "a small and seemingly harmless general interest U.K. website" that it was monitoring had been compromised and made part of a botnet that's been used, in part, to attack U.S. banks' websites.

After Incapsula was hired to monitor the site earlier this month, its security team soon began seeing a suspicious amount of "requests with encoded PHP code payload" directed at the site, said Ronen Atias, a security analyst at Incapsula, in a blog post. After investigating, Incapsula found that the website had been previously compromised, and that the traffic was being directed from a botnet command-and-control (C&C) server to a backdoor installed by attackers on the website server.

"The backdoor was instructed to launch HTTP and UDP flood attacks against several U.S. banks, including PNC, HSBC and Fifth Third Bank," said Atias. How had attackers managed to compromise the site, which Incapsula declined to name? According to Atias, the site was access-controlled using a username and password that were both set to "admin."

The attack requests spotted by Incapsula occurred after a New Year's Day post from the Izz ad-Din al-Qassam Cyber Fighters Muslim hacktivist group, promising to continue the months-long campaign of U.S. financial website disruptions. "Rulers and officials of American banks must expect our massive attacks! From now on, none of the U.S. banks will be safe from our attacks," read the post.

Since September, the distributed denial of service (DDoS) attacks launched by the hacktivists -- under the banner of "Operation Ababil" -- have disrupted the websites of numerous financial institutions, including Bank of America, BB&T, Capital One, HSBC, JPMorgan Chase, New York Stock Exchange, Regions Financial, SunTrust, U.S. Bank and Wells Fargo. The attackers say the attacks are in retaliation for YouTube continuing to host Innocence of Muslims, a film that mocks the founder of Islam.

[ Bank hackers were big news last year, but they had company. See 9 Ways Hacktivists Shocked The World In 2012. ]

Despite the attackers generally previewing attack times and targets in advance, the sheer scale of the DDoS attacks has overwhelmed banks' websites. While the typical small and midsize business (SMB) website might handle 1 Gbps, and an enterprise or government data center support 10 Gbps, according to Prolexic Technologies, the attackers have achieved massive, sustained packet floods of 70 Gbps.

But many U.S. government officials and information security experts say that they continue to believe that the attacks have been launched not by hacktivists, but the Iranian government, likely as retaliation for economic sanctions, as well as the United States' own cyber attacks against Iran.

"There is no doubt within the U.S. government that Iran is behind these attacks," James A. Lewis, a former official at the State and Commerce Departments who's a cybersecurity expert at the Center for Strategic and International Studies in Washington, told The New York Times. In large part, that's due to the apparent skill and sophistication behind the attacks, as well as the fact that they're designed not for financial gain, which is the typical modus operandi of criminals, but rather disruption, which instead suggests the work of a nation state.

Through Pastebin pronouncements and media interviews, however, the Izz ad-Din al-Qassam Cyber Fighters have long maintained that their group is not sponsored by any government, and that its members hail from multiple countries.

Regardless, one example of the group's technological sophistication is the apparent ease with which it's overwhelmed the websites of some of the world's largest financial institutions -- and according to Incapsula, the attack code it discovered was designed for just that purpose. "The PHP [DDoS] code was designed to multiply itself, so it could take advantage of the full capacity available on the server," said Atias. "Since this is a server on [a] hoster's backbone, it was potentially capable of producing much more traffic volume than a regular 'old school' botnet zombie."

The botnet's controllers also cycled the DDoS attacks for maximum effectiveness. "As we continued to monitor the incoming [DDoS] commands, we saw that the attacks were precisely timed, limited for periods that varied from 7 minutes to an hour," said Atias. "The botnet C&C was commanding it to work in 'shifts,' maximizing its efficiency and ordering it to renew the attack just as the target would start to recover. During some of these shifts the backdoor was instructed to change target and attack unrelated commercial and e-commerce sites. This all led us to believe that we were monitoring the activities of a botnet for hire."

Expect the attacks against bank websites to continue. Indeed, the hacktivists promised Tuesday to continue their campaign for at least 56 more weeks, or else until YouTube had removed the offending film. "We have repeatedly stated that removal of the offensive video, Innocence Of Muslims, from YouTube is the simplest solution to stop the cyber-attacks. But ... decision-makers in America have adopted the toughest, most expensive and least effective method," according to a Pastebin post uploaded Tuesday by the hacktivists.

In September, the Obama administration did ask Google to review its rules on hate speech and banning YouTube videos. Google officials responded that the video criticized the religion of Islam, but not Muslim people, reported The New York Times. As a result, Google said that the video would remain online, except in India and Indonesia, where it had violated local laws.

As of Tuesday morning, Sitedown website users were reporting higher than normal levels of disruption at the websites of Bank of America, Capital One, Citibank and Fifth Third banks.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
The Changing Face of Identity Management
Mobility and cloud services are altering the concept of user identity. Here are some ways to keep up.
Flash Poll
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio

The cybersecurity profession struggles to retain women (figures range from 10 to 20 percent). It's particularly worrisome for an industry with a rapidly growing number of vacant positions.

So why does the shortage of women continue to be worse in security than in other IT sectors? How can men in infosec be better allies for women; and how can women be better allies for one another? What is the industry doing to fix the problem -- what's working, and what isn't?

Is this really a problem at all? Are the low numbers simply an indication that women do not want to be in cybersecurity, and is it possible that more women will never want to be in cybersecurity? How many women would we need to see in the industry to declare success?

Join Dark Reading senior editor Sara Peters and guests Angela Knox of Cloudmark, Barrett Sellers of Arbor Networks, Regina Wallace-Jones of Facebook, Steve Christey Coley of MITRE, and Chris Roosenraad of M3AAWG on Wednesday, July 13 at 1 p.m. Eastern Time to discuss all this and more.