Vulnerabilities / Threats
10/4/2012
10:17 PM
50%
50%

Serious Attackers Paired With Online Mob In Bank Attacks

The denial-of-service attacks chalked up to crowdsourced hacktivism had little impact, except to camouflage much more effective packet floods using compromised content-management servers

At first blush, the recent attacks against major U.S. financial institutions appear to be a textbook case of hacktivism: Under the name "Operation Ababil," a group of alleged Iranian protestors called for supporters to attack banks and Google's YouTube, citing the Internet giant's refusal to take down a movie that offended some Muslims.

Yet the resulting distributed denial-of-service (DDoS) attacks that caused disruptions at major banks -- including Bank of America, JPMorgan, Citigroup, and Wells Fargo -- did not emanate from the widespread home computers of hacktivists, but from hundreds -- or, at most, thousands -- of servers running vulnerable content management software, say security experts familiar with the attacks. Using the servers and customized malware, the attackers leveled between 70 Gbps and 100 Gbps of peak traffic at the targeted sites and tailored the campaign to get around defenses specifically designed to stop floods of data.

The overall picture emerging from investigations into the attack is that of not just a successful campaign by hacktivists, but of something more, says Rodney Joffe, senior vice president and senior technologist at Internet infrastructure provider Neustar.

"This was a very well done attack, and the key thing is that this was not an attack that was easily survivable," he says. "They effectively took down or disrupted major financial organizations."

The details emerging from the investigation contradict the notion that the denial-of-service (DoS) attack came from a multitude of hacktivist computers during Operation Ababil. Using the name "Cyber fighters of Izz ad-din Al qassam," someone -- or some group -- posted a call to action on Pastebin on Sept. 18, calling for Muslims to attack the Bank of America and the New York Stock Exchange. Four days earlier, messages linked to the same group called for attacks against Google's YouTube.

Yet the Web requests from individuals' systems counted for the minority of traffic in the attack, experts say. The servers that formed the backbone of the attack, and which accounted for the majority of the traffic directed at the targets, were content management servers -- most, if not all, running the Joomla CMS, according to sources who asked not to be named. The attackers infected vulnerable content-management servers with a customized version of the "itsoknoproblembro" DDoS toolkit, likely using a vulnerability in the default Bluestork Joomla template.

Reports of compromises started appearing in the Joomla forums in mid-August, far before the release of the controversial movie on YouTube. The timing suggests that the attackers decided to participate in the hacktivist's operation or used the hacktivism as a smokescreen to camouflage their own activities.

[ After years of focusing mainly on the malware used in data breaches and financially motivated hacks, some security experts have begun to turn the spotlight on the attacker himself. See Turning Tables: ID'ing The Hacker Behind The Keyboard ]

The attackers likely had high-profile targets in mind when they created the network of compromised servers, says Dan Holden, director of security for Arbor Network, a network security company.

"I would say this [set of tools] was custom-built and put together for this particular type of attack: going after targets that would have DDoS defenses and would know how to defend themselves," Holden says. "If you compromise the right servers with the right bandwidth, you can be quite successful."

The average DoS attack falls far short of the volume of traffic leveled at targeted sites during Operation Ababil. While Arbor declined to give bandwidth figures, DDoS mitigation firm Prolexic stated that the attack reached 70 Gbps and 30 million packets per second against some of its customers. Another source familiar with the attacks, who asked not to be named, pegged the bandwidth as high as 100 Gbps.

Such volumes far outstrip previous attacks. In a presentation (PDF) at the North American Network Operators Group in February, Arbor's Jose Nazario asserted that large attacks were the new normal, but defined "large" as attacks with sustained bandwidths of 1 Gbps, two orders of magnitude smaller than those leveled at the U.S. financial institutions. More than 40 percent of companies surveyed by Arbor had encountered attacks greater than 1 Gbps, and 13 percent had suffered attack topping 10 Gbps.

Next Page: Government officials worry about size and skill of attacks

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
MarkB305
50%
50%
MarkB305,
User Rank: Apprentice
8/31/2013 | 12:41:59 PM
re: Serious Attackers Paired With Online Mob In Bank Attacks
I am a little late, but just found this article. It reads like a fiction story, not based on real evidence. "Appearing...", "likely...", "statement from anonymous source" makes this essay not very thrustworthy. Ofcourse hacked sites (through outdated CMS software) might be used in a botnet, but maybe "DNS Amplification Attacks" are used even more to reach the same ddos effect.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8802
Published: 2015-01-23
The Pie Register plugin before 2.0.14 for WordPress does not properly restrict access to certain functions in pie-register.php, which allows remote attackers to (1) add a user by uploading a crafted CSV file or (2) activate a user account via a verifyit action.

CVE-2014-9623
Published: 2015-01-23
OpenStack Glance 2014.2.x through 2014.2.1, 2014.1.3, and earlier allows remote authenticated users to bypass the storage quote and cause a denial of service (disk consumption) by deleting an image in the saving state.

CVE-2014-9638
Published: 2015-01-23
oggenc in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (divide-by-zero error and crash) via a WAV file with the number of channels set to zero.

CVE-2014-9639
Published: 2015-01-23
Integer overflow in oggenc in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (crash) via a crafted number of channels in a WAV file, which triggers an out-of-bounds memory access.

CVE-2014-9640
Published: 2015-01-23
oggenc/oggenc.c in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted raw file.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
If youíre a security professional, youíve probably been asked many questions about the December attack on Sony. On Jan. 21 at 1pm eastern, you can join a special, one-hour Dark Reading Radio discussion devoted to the Sony hack and the issues that may arise from it.