Vulnerabilities / Threats
10/4/2012
10:17 PM
Connect Directly
RSS
E-Mail
50%
50%

Serious Attackers Paired With Online Mob In Bank Attacks

The denial-of-service attacks chalked up to crowdsourced hacktivism had little impact, except to camouflage much more effective packet floods using compromised content-management servers

At first blush, the recent attacks against major U.S. financial institutions appear to be a textbook case of hacktivism: Under the name "Operation Ababil," a group of alleged Iranian protestors called for supporters to attack banks and Google's YouTube, citing the Internet giant's refusal to take down a movie that offended some Muslims.

Yet the resulting distributed denial-of-service (DDoS) attacks that caused disruptions at major banks -- including Bank of America, JPMorgan, Citigroup, and Wells Fargo -- did not emanate from the widespread home computers of hacktivists, but from hundreds -- or, at most, thousands -- of servers running vulnerable content management software, say security experts familiar with the attacks. Using the servers and customized malware, the attackers leveled between 70 Gbps and 100 Gbps of peak traffic at the targeted sites and tailored the campaign to get around defenses specifically designed to stop floods of data.

The overall picture emerging from investigations into the attack is that of not just a successful campaign by hacktivists, but of something more, says Rodney Joffe, senior vice president and senior technologist at Internet infrastructure provider Neustar.

"This was a very well done attack, and the key thing is that this was not an attack that was easily survivable," he says. "They effectively took down or disrupted major financial organizations."

The details emerging from the investigation contradict the notion that the denial-of-service (DoS) attack came from a multitude of hacktivist computers during Operation Ababil. Using the name "Cyber fighters of Izz ad-din Al qassam," someone -- or some group -- posted a call to action on Pastebin on Sept. 18, calling for Muslims to attack the Bank of America and the New York Stock Exchange. Four days earlier, messages linked to the same group called for attacks against Google's YouTube.

Yet the Web requests from individuals' systems counted for the minority of traffic in the attack, experts say. The servers that formed the backbone of the attack, and which accounted for the majority of the traffic directed at the targets, were content management servers -- most, if not all, running the Joomla CMS, according to sources who asked not to be named. The attackers infected vulnerable content-management servers with a customized version of the "itsoknoproblembro" DDoS toolkit, likely using a vulnerability in the default Bluestork Joomla template.

Reports of compromises started appearing in the Joomla forums in mid-August, far before the release of the controversial movie on YouTube. The timing suggests that the attackers decided to participate in the hacktivist's operation or used the hacktivism as a smokescreen to camouflage their own activities.

[ After years of focusing mainly on the malware used in data breaches and financially motivated hacks, some security experts have begun to turn the spotlight on the attacker himself. See Turning Tables: ID'ing The Hacker Behind The Keyboard ]

The attackers likely had high-profile targets in mind when they created the network of compromised servers, says Dan Holden, director of security for Arbor Network, a network security company.

"I would say this [set of tools] was custom-built and put together for this particular type of attack: going after targets that would have DDoS defenses and would know how to defend themselves," Holden says. "If you compromise the right servers with the right bandwidth, you can be quite successful."

The average DoS attack falls far short of the volume of traffic leveled at targeted sites during Operation Ababil. While Arbor declined to give bandwidth figures, DDoS mitigation firm Prolexic stated that the attack reached 70 Gbps and 30 million packets per second against some of its customers. Another source familiar with the attacks, who asked not to be named, pegged the bandwidth as high as 100 Gbps.

Such volumes far outstrip previous attacks. In a presentation (PDF) at the North American Network Operators Group in February, Arbor's Jose Nazario asserted that large attacks were the new normal, but defined "large" as attacks with sustained bandwidths of 1 Gbps, two orders of magnitude smaller than those leveled at the U.S. financial institutions. More than 40 percent of companies surveyed by Arbor had encountered attacks greater than 1 Gbps, and 13 percent had suffered attack topping 10 Gbps.

Next Page: Government officials worry about size and skill of attacks

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
MarkB305
50%
50%
MarkB305,
User Rank: Apprentice
8/31/2013 | 12:41:59 PM
re: Serious Attackers Paired With Online Mob In Bank Attacks
I am a little late, but just found this article. It reads like a fiction story, not based on real evidence. "Appearing...", "likely...", "statement from anonymous source" makes this essay not very thrustworthy. Ofcourse hacked sites (through outdated CMS software) might be used in a botnet, but maybe "DNS Amplification Attacks" are used even more to reach the same ddos effect.
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3409
Published: 2014-10-25
The Ethernet Connectivity Fault Management (CFM) handling feature in Cisco IOS 12.2(33)SRE9a and earlier and IOS XE 3.13S and earlier allows remote attackers to cause a denial of service (device reload) via malformed CFM packets, aka Bug ID CSCuq93406.

CVE-2014-4620
Published: 2014-10-25
The EMC NetWorker Module for MEDITECH (aka NMMEDI) 3.0 build 87 through 90, when EMC RecoverPoint and Plink are used, stores cleartext RecoverPoint Appliance credentials in nsrmedisv.raw log files, which allows local users to obtain sensitive information by reading these files.

CVE-2014-4623
Published: 2014-10-25
EMC Avamar 6.0.x, 6.1.x, and 7.0.x in Avamar Data Store (ADS) GEN4(S) and Avamar Virtual Edition (AVE), when Password Hardening before 2.0.0.4 is enabled, uses UNIX DES crypt for password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force a...

CVE-2014-4624
Published: 2014-10-25
EMC Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) 6.x and 7.0.x through 7.0.2-43 do not require authentication for Java API calls, which allows remote attackers to discover grid MCUser and GSAN passwords via a crafted call.

CVE-2014-6151
Published: 2014-10-25
CRLF injection vulnerability in IBM Tivoli Integrated Portal (TIP) 2.2.x allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.