Bank Attacker Iran Ties Questioned By Security Pros

U.S. government officials continue to blame Iran for launching attacks against U.S. banks, but some information security experts see only circumstantial evidence.

If Iran is masterminding the online attacks against U.S. banks, wheres the hard evidence?
Numerous current and former U.S. officials have accused the Iranian government of sponsoring the
distributed denial-of-service (DDoS) attacks
, which began in September and recently restarted. For four months, the attacks have disrupted the websites of many of the United States leading financial institutions, including Bank of America, Citigroup, JPMorgan Chase and Wells Fargo.
Shortly after the first wave of attacks began, U.S. officials
began blaming Iran
, and have continued to do so. There is no doubt within the U.S. government that Iran is behind these attacks, James A. Lewis, whos a former official at the State and Commerce Departments,
told
the
The New York Times
.
Officials have also noted that the attacks are so sophisticated and unstoppable that only a nation state could have launched them. Others have said that the attackers have pursued disruption, rather than personal enrichment, which further suggests nation state involvement. But to date, government officials have
produced no evidence
that links Iran to the attacks.
Many information security experts, however, see no irrefutable signs of Iranian involvement. You can tell that it was planned and executed pretty well, said Carl Herberger, VP of security solutions at Radware, which has been investigating the attacks on behalf of its customers.
But Herberger noted that project management skills arent evidence of Iranian backing. The best way I can probably say this is weve seen no irrefutable evidence that its a single nation state or single actor thats participating in the attacks, he said. Theres nothing weve seen that cant be perpetrated by a small amount of knowledgeable individuals, whether they be associated with a nation state or otherwise.
What is clear is that the attacks arent the work of amateurs. The attacks have a couple of attributes attached to them which lead people to believe theyre a little more professional, he said. Some of the attacks are very well organized, choreographed and obfuscated. They have nice cloaking mechanisms, including the ability to masquerade the origin of the command-and-control infrastructure. ... Theres clearly a management effort, and there are some beautifully designed tools able to perpetrate this attack.
But while the
attack tools are effective
, they arent necessarily the product of an
advanced cyber-weapons laboratory
. The tool being used isnt particularly impressive, based on what our threat hunter tells me. But then, if it works, it works -- so why invest more resources into it? said Sean Sullivan, security advisor at F-Secure Labs, via email. The simple nature of the tool, though, causes me to read the analysis [suggesting state sponsorship] with a heavy grain of salt.
What of the fact that the bank attackers have managed to compromise servers at data centers, thus
unleashing high-volume DDoS attacks
that have reached sustained packet floods of 70 Gbps?
The numbers are impressive, and there does appear to be good coordination, but that doesnt necessarily mean state-sponsored, at least in the sense that a state agency is responsible, said Sullivan. It could very well be useful idiots which receive funding somehow, or else are acting on their own, but with the passive approval of a nation state.
A 70-gpbs attack against banks is trivially easy for any individual, said Robert David Graham, head of Errata Security, in a
blog post
. Whats new with this attack is that it doesnt come from a botnet of thousands of machines, but from a few data centers. This is an easy attack. Data centers have 10 gbps+ connections to the Internet and hundreds of vulnerable servers. Just run nmap or Nessus or any hacking tool targeting the data center, and youll compromise several servers to run your attacks from. According to Graham, for about $1,000 per month attackers could simply be renting the cloud-based resources required to sustain their 70 Gbps attacks. I guess $1,000 is more than most individuals might want to pay, but its not at the state sponsored level, he said. Its more at the level of some rich dude giving a credit card to his son telling him you and your friends, go have some fun.
What of the ideological basis of the attacks -- instead of financial gain -- which some experts have cited as evidence of state sponsorship? Regardless of whether thats true, Herberger said it means that more than one group of actors is likely now involved. The attack is an ideological call to arms -- or cyber attack -- so it begs the question, were there no people who subscribed to the call, and who have conscripted themselves to the call, and actually participated in the call? he said. In other words, the
success
of the self-described Muslim hacktivists attacks against U.S. banks has likely led to more people signing up to participate.
Is there any other potential evidence of Iranian government involvement? In November, social engineering specialist Jennifer Emick, who runs Asherah Research Group and was previously part of
Backtrace Security
, published an
analysis of the supposed hackers
involved in the attacks, based on a close reading of the social networking ties for the owner of the
Hilf-ol-Fozoul
blog, which has championed Operation Ababil.
This is definitely an Iranian operation, without a doubt, said Emick. Also, curiously, these [social networking] accounts do not appear to be hackers, and pro-Anonymous and pro hacking groups are notably absent from the genuine Facebook groups/accounts, which she read as evidence of the blogs owner and friends identifying strongly with the Iranian government.
In late November, however, the bank attackers issued a Pastebin post
denying that they were sponsored
by any state, and implying that the owner of the Hilf-ol-Fozoul blog is essentially just a fanboy. Furthermore, they said that the only official communications from the group have come from its
Pastebin account
.
Finally, what if Iran did launch the attacks; what might be done? According to Karen Greenberg, who directs the Center on National Security at Fordham Law School, if hacking is deemed to be the work of state governments, in this case, Iran, then the crime rises to the level of international diplomacy. In other words, the State Department will sort it out. Until then, Greenberg cautioned against rushing to judgment, given the difficulty involved in tracing attacks back to their source. Careful, skillful attribution is crucial and exceedingly difficult, she said via email.
Whats required is non-repudiation, said Radwares Herberger, referring to the technical term in information security that means clearly documenting that someone did something. But with the bank attacks, he said, its a very technically difficult situation, and such evidence has yet to be publicly produced.
Now if youre the U.S. government, maybe youre hearing chatter, or have other evidence that suggests this is a campaign organized by a nation state, he said. But if so, were not privy to that information.

Last News
▸ Nigerian scammers now turning into mediocre malware pushers. ◂ Discovered: 23/12/2024 Category: security	▸ Beware EMV may not fully protect against skilled thieves. ◂ Discovered: 23/12/2024 Category: security	▸ Hack Your Hotel Room ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Bank Attacker Iran Ties Questioned By Security Pros