Attacks/Breaches
10/22/2012
04:52 PM
50%
50%

Who Is Hacking U.S. Banks? 8 Facts

Hackers have labeled the bank website disruptions as grassroots-level reprisal for an anti-Islamic film. But is the Iranian government really backing the attacks?
Previous
2 of 8
Next


The attackers have been targeting some of the country's largest financial institutions. On Oct. 16, in the fifth week of the banking attacks, CapitalOne even saw its online banking and corporate sites get disrupted by attackers for a second time, in what was the first repeat attack. Meanwhile, on Oct. 18, HSBC confirmed that not just its U.S. websites but also some global websites had been disrupted by attackers.

"HSBC servers came under a denial of service attack which affected a number of HSBC websites around the world," according to an Oct. 18 statement issued by the bank on the day it was attacked. "This denial of service attack did not affect any customer data, but did prevent customers using HSBC online services, including internet banking." By later that day, however, the bank said it had restored service.

While the outages are annoying for customers, they could also spell lost revenue for the businesses involved. Accordingly, might these bank website attacks portend a future in which hacktivists regularly seek to cause economic damage to U.S. businesses as a form of protest, or even low-grade cyber warfare? Secretary of Defense Leon Panetta, in a recent speech delivered to the Business Executives for National Security, suggested that possibility, as he warned how "a destructive cyber terrorist attack could paralyze the nation." Speaking of the attacks on bank websites, he said: "While this kind of tactic isn't new, the scale and speed was unprecedented."

Many cybersecurity watchers saw Panetta's speech as a thinly veiled threat to Iran. In recent weeks, U.S. government officials--again, speaking anonymously in media interviews, and referencing what they said were classified intelligence reports--have said that the signature of the banking attacks has been traced to a group of fewer than 100 information security specialists, all based at Iranian universities and technology companies, who are backed by the Iranian government.

In light of those allegations, the Cyber fighters of Izz ad-din Al qassam have sought to shift the question of Iranian government backing back to the Innocence of Muslims film. "With a little searching, we still found the anti-Islamic offensive film on the Internet. Thus the chain of cyber attacks on U.S. banks will continue this week," they wrote in a Pastebin post previewing the fifth week of attacks.

RECOMMENDED READING

Iran Denies Hacking American Banks, Censors Google

PNC Bank Hit By Crowdsourced Hacktivist Attacks

Bank Site Attacks Trigger Ongoing Outages, Customer Anger

Bank Hacks: 7 Misunderstood Facts

Hackers Launch New Wave Of U.S. Bank Attacks

U.S. Bank Hacks Expand; Regions Financial Hit

Bank Hacks: Iran Blame Game Intensifies

DOD: Hackers Breached U.S. Critical Infrastructure Control Systems

Previous
2 of 8
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Leo Regulus
50%
50%
Leo Regulus,
User Rank: Apprentice
10/24/2012 | 4:52:32 PM
re: Who Is Hacking U.S. Banks? 8 Facts
Very disappointed in Editor's choice of article format. This has been extensively discussed in the past.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2010-5312
Published: 2014-11-24
Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title option.

CVE-2012-6662
Published: 2014-11-24
Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title attribute, which is not properly handled in the autocomplete combo box demo.

CVE-2014-1424
Published: 2014-11-24
apparmor_parser in the apparmor package before 2.8.95~2430-0ubuntu5.1 in Ubuntu 14.04 allows attackers to bypass AppArmor policies via unspecified vectors, related to a "miscompilation flaw."

CVE-2014-7817
Published: 2014-11-24
The wordexp function in GNU C Library (aka glibc) 2.21 does not enforce the WRDE_NOCMD flag, which allows context-dependent attackers to execute arbitrary commands, as demonstrated by input containing "$((`...`))".

CVE-2014-7821
Published: 2014-11-24
OpenStack Neutron before 2014.1.4 and 2014.2.x before 2014.2.1 allows remote authenticated users to cause a denial of service (crash) via a crafted dns_nameservers value in the DNS configuration.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?