Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

U.S. Bank Hack Attack Techniques Identified

Security researchers detail how poorly secured, hosted servers helped launch botnet-based attacks; U.S. government continues to blame Iran.

Self-proclaimed Muslim hacktivists that have been disrupting U.S. banks' websites since September are compromising poorly secured, hosted servers to sustain their large-scale attacks.

That warning comes by way of security firm Incapsula, which said it recently discovered that "a small and seemingly harmless general interest U.K. website" that it was monitoring had been compromised and made part of a botnet that's been used, in part, to attack U.S. banks' websites.

After Incapsula was hired to monitor the site earlier this month, its security team soon began seeing a suspicious amount of "requests with encoded PHP code payload" directed at the site, said Ronen Atias, a security analyst at Incapsula, in a blog post. After investigating, Incapsula found that the website had been previously compromised, and that the traffic was being directed from a botnet command-and-control (C&C) server to a backdoor installed by attackers on the website server.

"The backdoor was instructed to launch HTTP and UDP flood attacks against several U.S. banks, including PNC, HSBC and Fifth Third Bank," said Atias. How had attackers managed to compromise the site, which Incapsula declined to name? According to Atias, the site was access-controlled using a username and password that were both set to "admin."

The attack requests spotted by Incapsula occurred after a New Year's Day post from the Izz ad-Din al-Qassam Cyber Fighters Muslim hacktivist group, promising to continue the months-long campaign of U.S. financial website disruptions. "Rulers and officials of American banks must expect our massive attacks! From now on, none of the U.S. banks will be safe from our attacks," read the post.

Since September, the distributed denial of service (DDoS) attacks launched by the hacktivists -- under the banner of "Operation Ababil" -- have disrupted the websites of numerous financial institutions, including Bank of America, BB&T, Capital One, HSBC, JPMorgan Chase, New York Stock Exchange, Regions Financial, SunTrust, U.S. Bank and Wells Fargo. The attackers say the attacks are in retaliation for YouTube continuing to host Innocence of Muslims, a film that mocks the founder of Islam.

[ Bank hackers were big news last year, but they had company. See 9 Ways Hacktivists Shocked The World In 2012. ]

Despite the attackers generally previewing attack times and targets in advance, the sheer scale of the DDoS attacks has overwhelmed banks' websites. While the typical small and midsize business (SMB) website might handle 1 Gbps, and an enterprise or government data center support 10 Gbps, according to Prolexic Technologies, the attackers have achieved massive, sustained packet floods of 70 Gbps.

But many U.S. government officials and information security experts say that they continue to believe that the attacks have been launched not by hacktivists, but the Iranian government, likely as retaliation for economic sanctions, as well as the United States' own cyber attacks against Iran.

"There is no doubt within the U.S. government that Iran is behind these attacks," James A. Lewis, a former official at the State and Commerce Departments who's a cybersecurity expert at the Center for Strategic and International Studies in Washington, told The New York Times. In large part, that's due to the apparent skill and sophistication behind the attacks, as well as the fact that they're designed not for financial gain, which is the typical modus operandi of criminals, but rather disruption, which instead suggests the work of a nation state.

Through Pastebin pronouncements and media interviews, however, the Izz ad-Din al-Qassam Cyber Fighters have long maintained that their group is not sponsored by any government, and that its members hail from multiple countries.

Regardless, one example of the group's technological sophistication is the apparent ease with which it's overwhelmed the websites of some of the world's largest financial institutions -- and according to Incapsula, the attack code it discovered was designed for just that purpose. "The PHP [DDoS] code was designed to multiply itself, so it could take advantage of the full capacity available on the server," said Atias. "Since this is a server on [a] hoster's backbone, it was potentially capable of producing much more traffic volume than a regular 'old school' botnet zombie."

The botnet's controllers also cycled the DDoS attacks for maximum effectiveness. "As we continued to monitor the incoming [DDoS] commands, we saw that the attacks were precisely timed, limited for periods that varied from 7 minutes to an hour," said Atias. "The botnet C&C was commanding it to work in 'shifts,' maximizing its efficiency and ordering it to renew the attack just as the target would start to recover. During some of these shifts the backdoor was instructed to change target and attack unrelated commercial and e-commerce sites. This all led us to believe that we were monitoring the activities of a botnet for hire."

Expect the attacks against bank websites to continue. Indeed, the hacktivists promised Tuesday to continue their campaign for at least 56 more weeks, or else until YouTube had removed the offending film. "We have repeatedly stated that removal of the offensive video, Innocence Of Muslims, from YouTube is the simplest solution to stop the cyber-attacks. But ... decision-makers in America have adopted the toughest, most expensive and least effective method," according to a Pastebin post uploaded Tuesday by the hacktivists.

In September, the Obama administration did ask Google to review its rules on hate speech and banning YouTube videos. Google officials responded that the video criticized the religion of Islam, but not Muslim people, reported The New York Times. As a result, Google said that the video would remain online, except in India and Indonesia, where it had violated local laws.

As of Tuesday morning, Sitedown website users were reporting higher than normal levels of disruption at the websites of Bank of America, Capital One, Citibank and Fifth Third banks.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 5/28/2020
The Problem with Artificial Intelligence in Security
Dr. Leila Powell, Lead Security Data Scientist, Panaseer,  5/26/2020
10 iOS Security Tips to Lock Down Your iPhone
Kelly Sheridan, Staff Editor, Dark Reading,  5/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-13660
PUBLISHED: 2020-05-28
CMS Made Simple through 2.2.14 allows XSS via a crafted File Picker profile name.
CVE-2020-11079
PUBLISHED: 2020-05-28
node-dns-sync (npm module dns-sync) through 0.2.0 allows execution of arbitrary commands . This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This has been fixed in 0.2.1.
CVE-2020-13245
PUBLISHED: 2020-05-28
Certain NETGEAR devices are affected by Missing SSL Certificate Validation. This affects R7000 1.0.9.6_1.2.19 through 1.0.11.100_10.2.10, and possibly R6120, R7800, R6220, R8000, R6350, R9000, R6400, RAX120, R6400v2, RBR20, R6800, XR300, R6850, XR500, and R7000P.
CVE-2020-4248
PUBLISHED: 2020-05-28
IBM Security Identity Governance and Intelligence 5.2.6 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 175484.
CVE-2020-8329
PUBLISHED: 2020-05-28
A denial of service vulnerability was reported in the firmware prior to version 1.01 used in Lenovo Printer LJ4010DN that could be triggered by a remote user sending a crafted packet to the device, causing an error to be displayed and preventing printer from functioning until the printer is rebooted...