Attacks/Breaches
10/22/2012
04:52 PM
50%
50%

Who Is Hacking U.S. Banks? 8 Facts

Hackers have labeled the bank website disruptions as grassroots-level reprisal for an anti-Islamic film. But is the Iranian government really backing the attacks?
Previous
2 of 8
Next


The attackers have been targeting some of the country's largest financial institutions. On Oct. 16, in the fifth week of the banking attacks, CapitalOne even saw its online banking and corporate sites get disrupted by attackers for a second time, in what was the first repeat attack. Meanwhile, on Oct. 18, HSBC confirmed that not just its U.S. websites but also some global websites had been disrupted by attackers.

"HSBC servers came under a denial of service attack which affected a number of HSBC websites around the world," according to an Oct. 18 statement issued by the bank on the day it was attacked. "This denial of service attack did not affect any customer data, but did prevent customers using HSBC online services, including internet banking." By later that day, however, the bank said it had restored service.

While the outages are annoying for customers, they could also spell lost revenue for the businesses involved. Accordingly, might these bank website attacks portend a future in which hacktivists regularly seek to cause economic damage to U.S. businesses as a form of protest, or even low-grade cyber warfare? Secretary of Defense Leon Panetta, in a recent speech delivered to the Business Executives for National Security, suggested that possibility, as he warned how "a destructive cyber terrorist attack could paralyze the nation." Speaking of the attacks on bank websites, he said: "While this kind of tactic isn't new, the scale and speed was unprecedented."

Many cybersecurity watchers saw Panetta's speech as a thinly veiled threat to Iran. In recent weeks, U.S. government officials--again, speaking anonymously in media interviews, and referencing what they said were classified intelligence reports--have said that the signature of the banking attacks has been traced to a group of fewer than 100 information security specialists, all based at Iranian universities and technology companies, who are backed by the Iranian government.

In light of those allegations, the Cyber fighters of Izz ad-din Al qassam have sought to shift the question of Iranian government backing back to the Innocence of Muslims film. "With a little searching, we still found the anti-Islamic offensive film on the Internet. Thus the chain of cyber attacks on U.S. banks will continue this week," they wrote in a Pastebin post previewing the fifth week of attacks.

RECOMMENDED READING

Iran Denies Hacking American Banks, Censors Google

PNC Bank Hit By Crowdsourced Hacktivist Attacks

Bank Site Attacks Trigger Ongoing Outages, Customer Anger

Bank Hacks: 7 Misunderstood Facts

Hackers Launch New Wave Of U.S. Bank Attacks

U.S. Bank Hacks Expand; Regions Financial Hit

Bank Hacks: Iran Blame Game Intensifies

DOD: Hackers Breached U.S. Critical Infrastructure Control Systems

Previous
2 of 8
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Leo Regulus
50%
50%
Leo Regulus,
User Rank: Apprentice
10/24/2012 | 4:52:32 PM
re: Who Is Hacking U.S. Banks? 8 Facts
Very disappointed in Editor's choice of article format. This has been extensively discussed in the past.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-7912
Published: 2015-07-29
The get_option function in dhcp.c in dhcpcd before 6.2.0, as used in dhcpcd 5.x in Android before 5.1 and other products, does not validate the relationship between length fields and the amount of data, which allows remote DHCP servers to execute arbitrary code or cause a denial of service (memory c...

CVE-2014-7913
Published: 2015-07-29
The print_option function in dhcp-common.c in dhcpcd through 6.9.1, as used in dhcp.c in dhcpcd 5.x in Android before 5.1 and other products, misinterprets the return value of the snprintf function, which allows remote DHCP servers to execute arbitrary code or cause a denial of service (memory corru...

CVE-2015-2977
Published: 2015-07-29
Webservice-DIC yoyaku_v41 allows remote attackers to create arbitrary files, and consequently execute arbitrary code, via unspecified vectors.

CVE-2015-2978
Published: 2015-07-29
Webservice-DIC yoyaku_v41 allows remote attackers to bypass authentication and complete a conference-room reservation via unspecified vectors, as demonstrated by an "unintentional reservation."

CVE-2015-2979
Published: 2015-07-29
Webservice-DIC yoyaku_v41 allows remote attackers to execute arbitrary OS commands via unspecified vectors.

Dark Reading Radio
Archived Dark Reading Radio
What’s the future of the venerable firewall? We’ve invited two security industry leaders to make their case: Join us and bring your questions and opinions!