Attacks/Breaches
10/22/2012
04:52 PM
50%
50%

Who Is Hacking U.S. Banks? 8 Facts

Hackers have labeled the bank website disruptions as grassroots-level reprisal for an anti-Islamic film. But is the Iranian government really backing the attacks?
Previous
2 of 8
Next


The attackers have been targeting some of the country's largest financial institutions. On Oct. 16, in the fifth week of the banking attacks, CapitalOne even saw its online banking and corporate sites get disrupted by attackers for a second time, in what was the first repeat attack. Meanwhile, on Oct. 18, HSBC confirmed that not just its U.S. websites but also some global websites had been disrupted by attackers.

"HSBC servers came under a denial of service attack which affected a number of HSBC websites around the world," according to an Oct. 18 statement issued by the bank on the day it was attacked. "This denial of service attack did not affect any customer data, but did prevent customers using HSBC online services, including internet banking." By later that day, however, the bank said it had restored service.

While the outages are annoying for customers, they could also spell lost revenue for the businesses involved. Accordingly, might these bank website attacks portend a future in which hacktivists regularly seek to cause economic damage to U.S. businesses as a form of protest, or even low-grade cyber warfare? Secretary of Defense Leon Panetta, in a recent speech delivered to the Business Executives for National Security, suggested that possibility, as he warned how "a destructive cyber terrorist attack could paralyze the nation." Speaking of the attacks on bank websites, he said: "While this kind of tactic isn't new, the scale and speed was unprecedented."

Many cybersecurity watchers saw Panetta's speech as a thinly veiled threat to Iran. In recent weeks, U.S. government officials--again, speaking anonymously in media interviews, and referencing what they said were classified intelligence reports--have said that the signature of the banking attacks has been traced to a group of fewer than 100 information security specialists, all based at Iranian universities and technology companies, who are backed by the Iranian government.

In light of those allegations, the Cyber fighters of Izz ad-din Al qassam have sought to shift the question of Iranian government backing back to the Innocence of Muslims film. "With a little searching, we still found the anti-Islamic offensive film on the Internet. Thus the chain of cyber attacks on U.S. banks will continue this week," they wrote in a Pastebin post previewing the fifth week of attacks.

RECOMMENDED READING

Iran Denies Hacking American Banks, Censors Google

PNC Bank Hit By Crowdsourced Hacktivist Attacks

Bank Site Attacks Trigger Ongoing Outages, Customer Anger

Bank Hacks: 7 Misunderstood Facts

Hackers Launch New Wave Of U.S. Bank Attacks

U.S. Bank Hacks Expand; Regions Financial Hit

Bank Hacks: Iran Blame Game Intensifies

DOD: Hackers Breached U.S. Critical Infrastructure Control Systems

Previous
2 of 8
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Leo Regulus
50%
50%
Leo Regulus,
User Rank: Apprentice
10/24/2012 | 4:52:32 PM
re: Who Is Hacking U.S. Banks? 8 Facts
Very disappointed in Editor's choice of article format. This has been extensively discussed in the past.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2037
Published: 2014-11-26
Openswan 2.6.40 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon restart) via IKEv2 packets that lack expected payloads. NOTE: this vulnerability exists because of an incomplete fix for CVE 2013-6466.

CVE-2014-6609
Published: 2014-11-26
The res_pjsip_pubsub module in Asterisk Open Source 12.x before 12.5.1 allows remote authenticated users to cause a denial of service (crash) via crafted headers in a SIP SUBSCRIBE request for an event package.

CVE-2014-6610
Published: 2014-11-26
Asterisk Open Source 11.x before 11.12.1 and 12.x before 12.5.1 and Certified Asterisk 11.6 before 11.6-cert6, when using the res_fax_spandsp module, allows remote authenticated users to cause a denial of service (crash) via an out of call message, which is not properly handled in the ReceiveFax dia...

CVE-2014-7141
Published: 2014-11-26
The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and crash) via a crafted type in an (1) ICMP or (2) ICMP6 packet.

CVE-2014-7142
Published: 2014-11-26
The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (crash) via a crafted (1) ICMP or (2) ICMP6 packet size.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?