Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

Bank Hacks: 7 Misunderstood Facts

As security researchers review recent bank hacks--affecting Bank of America, JPMorgan Chase, PNC, U.S. Bank, and Wells Fargo--claims made by supposed hacktivists don't all add up.

Who's behind the recent online attacks against multiple financial institutions including Bank of America, JPMorgan Chase, PNC, U.S. Bank, and Wells Fargo? In recent weeks, all have bit hit by large-scale distributed denial-of-service (DDoS) attacks. Cue website outages and customer outrage.

A self-described hacktivist group, the Cyber fighters of Izz ad-din Al qassam, has taken credit for organizing the related Operation Ababil, which it claims is a grassroots campaign to protest the recent release of a film that mocked the founder of Islam.

But as information security researchers review the attacks and tools used, they're finding that the claims made by the supposed hacktivist group don't all appear to add up. Here are seven facts about what's currently known about recent and forthcoming banking attacks.

1. Hacktivist Tool Claims Remain Unverified

Was a hacktivist group really behind the bank attacks, or--as some former U.S. government officials have alleged in anonymous interviews--might the government of Iran be to blame?

"In its postings, Cyber fighters of Izz ad-din Al Qassam published several attack tools including the Mobile LOIC Apache Killer version," said Ronen Kenig, director of product marketing for security products at Radware, in a blog post. "That tool was not present in the observed attack traffic, however, meaning it is possible that the Cyber fighters of Izz ad-din Al Qassam group was not behind the attack after all, or that it didn't manage to recruit supporters to its attack who were willing to use the mobile LOIC attack tool."

[ Criminals are tripling down on attack infrastructure. See Online Criminals' Best Friends: Malnets. ]

2. Servers, Not Botnets, Disrupted Bank Sites

What the attackers lacked in grassroots support, they made up for in attack strength, since they successfully disrupted the websites of leading banks, even after publicizing in advance the date and time of their attacks. Their attack power came from the use of server-infecting malware. "The majority of the attack traffic was not generated from a botnet, but rather from servers," said Carl Herberger, VP of security solutions at Radware, via phone. "The servers were compromised by the attackers prior to the attack."

Using server malware is unusual, and according to Arbor Networks researchers, the attacks don't resemble any previously seen hacktivism campaigns. "These are high-bandwidth servers that have obviously been compromised," said Dan Holden, director of security for the Arbor security engineering and respo nse team, speaking by phone. "So you're talking about probably hosting websites that have been compromised or used."

Recent hacktivist attacks have involved botnets of infected PCs--not servers. "For years and years, there have been botnets used for DDoS," said Holden. "Then you had opt-in hacktivism activity, and the 'hive mind' type of feature set. And now this is almost back to the future, where you're going back to the 1990s style of servers being leveraged, because of course they have very high bandwidth."

3. Attack Toolkit Positively Identified

One of the DDoS toolkits used in the attacks--and it may be the only one--has been identified as the 'itsoknoproblembro' tool kit. According to Prolexic Technologies, the toolkit has been used to launch "sustained floods" that have peaked at 70 Gbps and 30 million packets per second.

The tool can also be used to launch blended DDoS attacks. "The itsoknoproblembro toolkit includes multiple infrastructure and application-layer attack vectors, such as SYN floods, that can simultaneously attack multiple destination ports and targets, as well as ICMP, UDP, and SSL encrypted attack types," according to Prolexic. In addition, the toolkit can also be used to take out domain name system (DNS) infrastructure via UDP floods.

4. Banks Knocked Offline Via Encrypted SSL Floods

Beyond the volume of attacks generated, the banking website disruptions were also successful because they included SSL attacks, which can be generated by tools such as Dirt Jumper.

"Every SSL DDoS attack that we've seen has been an HTTP GET flood that's been encrypted," said Radware's Herberger. "It's been a very simple flood ... [but] the infrastructures that are in place to prevent SSL attacks are designed against intrusion events, not DDoS attacks."

Unfortunately, devices that provide SSL intrusion prevention can themselves become DDoS targets and be successfully shut down using relatively little traffic. "In one case in the last two weeks, we saw a financial services organization with 40 gigabits of external link that was taken down with 30 megabits of SSL attack," Herberger said.

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
progan01
50%
50%
progan01,
User Rank: Apprentice
10/8/2012 | 1:20:00 AM
re: Bank Hacks: 7 Misunderstood Facts
Looks like cyberwar has begun in earnest. How do you respond when you don't have a smokestack to send a missile down?
Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
Exploits Released for As-Yet Unpatched Critical Citrix Flaw
Jai Vijayan, Contributing Writer,  1/13/2020
Microsoft to Officially End Support for Windows 7, Server 2008
Kelly Sheridan, Staff Editor, Dark Reading,  1/13/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-15625
PUBLISHED: 2020-01-18
A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the victim's memory processes to extract sensitive information.
CVE-2019-19696
PUBLISHED: 2020-01-18
A RootCA vulnerability found in Trend Micro Password Manager for Windows and macOS exists where the localhost.key of RootCA.crt might be improperly accessed by an unauthorized party and could be used to create malicious self-signed SSL certificates, allowing an attacker to misdirect a user to phishi...
CVE-2019-19697
PUBLISHED: 2020-01-18
An arbitrary code execution vulnerability exists in the Trend Micro Security 2019 (v15) consumer family of products which could allow an attacker to gain elevated privileges and tamper with protected services by disabling or otherwise preventing them to start. An attacker must already have administr...
CVE-2019-20357
PUBLISHED: 2020-01-18
A Persistent Arbitrary Code Execution vulnerability exists in the Trend Micro Security 2020 (v160 and 2019 (v15) consumer familiy of products which could potentially allow an attacker the ability to create a malicious program to escalate privileges and attain persistence on a vulnerable system.
CVE-2020-7222
PUBLISHED: 2020-01-18
An issue was discovered in Amcrest Web Server 2.520.AC00.18.R 2017-06-29 WEB 3.2.1.453504. The login page responds with JavaScript when one tries to authenticate. An attacker who changes the result parameter (to true) in this JavaScript code can bypass authentication and achieve limited privileges (...