Bank Hacks: 7 Misunderstood Facts

Who's behind the recent online attacks against multiple financial institutions including Bank of America, JPMorgan Chase, PNC, U.S. Bank, and Wells Fargo? In recent weeks, all have bit hit by large-scale distributed denial-of-service (DDoS) attacks. Cue website outages and customer outrage.

A self-described hacktivist group, the Cyber fighters of Izz ad-din Al qassam, has taken credit for organizing the related Operation Ababil, which it claims is a grassroots campaign to protest the recent release of a film that mocked the founder of Islam.

But as information security researchers review the attacks and tools used, they're finding that the claims made by the supposed hacktivist group don't all appear to add up. Here are seven facts about what's currently known about recent and forthcoming banking attacks.

1. Hacktivist Tool Claims Remain Unverified

Was a hacktivist group really behind the bank attacks, or--as some former U.S. government officials have alleged in anonymous interviews--might the government of Iran be to blame?

"In its postings, Cyber fighters of Izz ad-din Al Qassam published several attack tools including the Mobile LOIC Apache Killer version," said Ronen Kenig, director of product marketing for security products at Radware, in a blog post. "That tool was not present in the observed attack traffic, however, meaning it is possible that the Cyber fighters of Izz ad-din Al Qassam group was not behind the attack after all, or that it didn't manage to recruit supporters to its attack who were willing to use the mobile LOIC attack tool."

[ Criminals are tripling down on attack infrastructure. See Online Criminals' Best Friends: Malnets. ]

2. Servers, Not Botnets, Disrupted Bank Sites

What the attackers lacked in grassroots support, they made up for in attack strength, since they successfully disrupted the websites of leading banks, even after publicizing in advance the date and time of their attacks. Their attack power came from the use of server-infecting malware. "The majority of the attack traffic was not generated from a botnet, but rather from servers," said Carl Herberger, VP of security solutions at Radware, via phone. "The servers were compromised by the attackers prior to the attack."

Using server malware is unusual, and according to Arbor Networks researchers, the attacks don't resemble any previously seen hacktivism campaigns. "These are high-bandwidth servers that have obviously been compromised," said Dan Holden, director of security for the Arbor security engineering and respo nse team, speaking by phone. "So you're talking about probably hosting websites that have been compromised or used."

Recent hacktivist attacks have involved botnets of infected PCs--not servers. "For years and years, there have been botnets used for DDoS," said Holden. "Then you had opt-in hacktivism activity, and the 'hive mind' type of feature set. And now this is almost back to the future, where you're going back to the 1990s style of servers being leveraged, because of course they have very high bandwidth."

3. Attack Toolkit Positively Identified

One of the DDoS toolkits used in the attacks--and it may be the only one--has been identified as the 'itsoknoproblembro' tool kit. According to Prolexic Technologies, the toolkit has been used to launch "sustained floods" that have peaked at 70 Gbps and 30 million packets per second.

The tool can also be used to launch blended DDoS attacks. "The itsoknoproblembro toolkit includes multiple infrastructure and application-layer attack vectors, such as SYN floods, that can simultaneously attack multiple destination ports and targets, as well as ICMP, UDP, and SSL encrypted attack types," according to Prolexic. In addition, the toolkit can also be used to take out domain name system (DNS) infrastructure via UDP floods.

4. Banks Knocked Offline Via Encrypted SSL Floods

Beyond the volume of attacks generated, the banking website disruptions were also successful because they included SSL attacks, which can be generated by tools such as Dirt Jumper.

"Every SSL DDoS attack that we've seen has been an HTTP GET flood that's been encrypted," said Radware's Herberger. "It's been a very simple flood ... [but] the infrastructures that are in place to prevent SSL attacks are designed against intrusion events, not DDoS attacks."

Unfortunately, devices that provide SSL intrusion prevention can themselves become DDoS targets and be successfully shut down using relatively little traffic. "In one case in the last two weeks, we saw a financial services organization with 40 gigabits of external link that was taken down with 30 megabits of SSL attack," Herberger said. 5. Data Centers Don't Watch For Outgoing DDoS Attacks

Herberger said that the recent banking attacks should prompt any business with high-volume servers to review its security defenses, including its ability to spot whether its servers might be infected with itsoknoproblembro and filter traffic accordingly.

"If you're a data center, an MSSP, or a cloud provider, you generally don't do egress filtering, and if you do it's for malware--not for a volume-based attack," he said. "You may be worried about the attacks at your perimeter. But I don't think many of these folks may have come to the realization that they may have been a muzzle for the attackers."

6. DDoS Attack Toolkit Found in Saudi Arabia

Interestingly, Radware has found a version of the itsoknoproblembro DDoS toolkit on a server in Saudi Arabia. "It appears to be a clean variant, or not-so-feature-rich variant, that doesn't have all of the functionality that we've witnessed in the wild," said Herberger.

But that discovery is no smoking gun. "I don't know if we can draw too many conclusions from that. It could have been a prototype, or it could be completely innocuous and someone in the company where we found it was playing with it. But it's a data point," he said. "We're still working through what it means."

Despite identifying the toolkit used in the attacks, researchers have yet to find any accompanying command-and-control infrastructure. "It appears that the attacks were coordinated, which leads one to assume that there was a certain amount of command and control," said Herberger. "Whether it was overt--someone controlling it online--or logic, built into the malware, remains to be seen."

7. Attackers Recruiting For New Bank Campaign

In related information security news, 30 U.S. banks are set to be targeted in wire-transfer attacks by a group of 100 botmasters, using a Trojan app that appears to be a variant of the Gozi Trojan, which is designed to steal information from financial services, retail, healthcare, and government-related accounts.

"According to underground chatter, the gang plans to deploy the Trojan in an effort to complete fraudulent wire transfers via man-in-the-middle (MiTM) manual session-hijacking scenarios," said Mor Ahuvia, a cybercrime communications specialist for RSA FraudAction, in a blog post. Expect a "blitzkrieg-like series of Trojan attacks," not least because the forecasted scale of the attacks would involve about 30 times more infected PCs than on average, he told Threatpost.

Wire transfer attack campaigns are not uncommon. Last month, in a joint alert, the FBI, Financial Services Information Sharing and Analysis Center, and the Internet Crime Complaint Center, warned that online criminals have been launching phishing emails and keylogging Trojans at financial institutions to capture employees' logon credentials. Attackers have then been using the credentials to move between $400,000 and $900,000 at a time into overseas accounts.