Attacks/Breaches
10/22/2012
04:52 PM
50%
50%

Who Is Hacking U.S. Banks? 8 Facts

Hackers have labeled the bank website disruptions as grassroots-level reprisal for an anti-Islamic film. But is the Iranian government really backing the attacks?
Previous
2 of 8
Next


The attackers have been targeting some of the country's largest financial institutions. On Oct. 16, in the fifth week of the banking attacks, CapitalOne even saw its online banking and corporate sites get disrupted by attackers for a second time, in what was the first repeat attack. Meanwhile, on Oct. 18, HSBC confirmed that not just its U.S. websites but also some global websites had been disrupted by attackers.

"HSBC servers came under a denial of service attack which affected a number of HSBC websites around the world," according to an Oct. 18 statement issued by the bank on the day it was attacked. "This denial of service attack did not affect any customer data, but did prevent customers using HSBC online services, including internet banking." By later that day, however, the bank said it had restored service.

While the outages are annoying for customers, they could also spell lost revenue for the businesses involved. Accordingly, might these bank website attacks portend a future in which hacktivists regularly seek to cause economic damage to U.S. businesses as a form of protest, or even low-grade cyber warfare? Secretary of Defense Leon Panetta, in a recent speech delivered to the Business Executives for National Security, suggested that possibility, as he warned how "a destructive cyber terrorist attack could paralyze the nation." Speaking of the attacks on bank websites, he said: "While this kind of tactic isn't new, the scale and speed was unprecedented."

Many cybersecurity watchers saw Panetta's speech as a thinly veiled threat to Iran. In recent weeks, U.S. government officials--again, speaking anonymously in media interviews, and referencing what they said were classified intelligence reports--have said that the signature of the banking attacks has been traced to a group of fewer than 100 information security specialists, all based at Iranian universities and technology companies, who are backed by the Iranian government.

In light of those allegations, the Cyber fighters of Izz ad-din Al qassam have sought to shift the question of Iranian government backing back to the Innocence of Muslims film. "With a little searching, we still found the anti-Islamic offensive film on the Internet. Thus the chain of cyber attacks on U.S. banks will continue this week," they wrote in a Pastebin post previewing the fifth week of attacks.

RECOMMENDED READING

Iran Denies Hacking American Banks, Censors Google

PNC Bank Hit By Crowdsourced Hacktivist Attacks

Bank Site Attacks Trigger Ongoing Outages, Customer Anger

Bank Hacks: 7 Misunderstood Facts

Hackers Launch New Wave Of U.S. Bank Attacks

U.S. Bank Hacks Expand; Regions Financial Hit

Bank Hacks: Iran Blame Game Intensifies

DOD: Hackers Breached U.S. Critical Infrastructure Control Systems

Previous
2 of 8
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Leo Regulus
50%
50%
Leo Regulus,
User Rank: Apprentice
10/24/2012 | 4:52:32 PM
re: Who Is Hacking U.S. Banks? 8 Facts
Very disappointed in Editor's choice of article format. This has been extensively discussed in the past.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-9710
Published: 2015-05-27
The Btrfs implementation in the Linux kernel before 3.19 does not ensure that the visible xattr state is consistent with a requested replacement, which allows local users to bypass intended ACL settings and gain privileges via standard filesystem operations (1) during an xattr-replacement time windo...

CVE-2014-9715
Published: 2015-05-27
include/net/netfilter/nf_conntrack_extend.h in the netfilter subsystem in the Linux kernel before 3.14.5 uses an insufficiently large data type for certain extension data, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) via outbound network traffic that trig...

CVE-2015-2666
Published: 2015-05-27
Stack-based buffer overflow in the get_matching_model_microcode function in arch/x86/kernel/cpu/microcode/intel_early.c in the Linux kernel before 4.0 allows context-dependent attackers to gain privileges by constructing a crafted microcode header and leveraging root privileges for write access to t...

CVE-2015-2830
Published: 2015-05-27
arch/x86/kernel/entry_64.S in the Linux kernel before 3.19.2 does not prevent the TS_COMPAT flag from reaching a user-mode task, which might allow local users to bypass the seccomp or audit protection mechanism via a crafted application that uses the (1) fork or (2) close system call, as demonstrate...

CVE-2015-2922
Published: 2015-05-27
The ndisc_router_discovery function in net/ipv6/ndisc.c in the Neighbor Discovery (ND) protocol implementation in the IPv6 stack in the Linux kernel before 3.19.6 allows remote attackers to reconfigure a hop-limit setting via a small hop_limit value in a Router Advertisement (RA) message.

Dark Reading Radio
Archived Dark Reading Radio
After a serious cybersecurity incident, everyone will be looking to you for answers -- but you’ll never have complete information and you’ll never have enough time. So in those heated moments, when a business is on the brink of collapse, how will you and the rest of the board room executives respond?