U.S. Bank Hack Attack Techniques Identified

Security researchers detail how poorly secured, hosted servers helped launch botnet-based attacks; U.S. government continues to blame Iran.

Self-proclaimed Muslim hacktivists that have been disrupting U.S. banks websites since September are compromising poorly secured, hosted servers to sustain their large-scale attacks.
That warning comes by way of security firm Incapsula, which said it recently discovered that a small and seemingly harmless general interest U.K. website that it was monitoring had been compromised and made part of a botnet thats been used, in part, to attack U.S. banks websites.
After Incapsula was hired to monitor the site earlier this month, its security team soon began seeing a suspicious amount of requests with encoded PHP code payload directed at the site, said Ronen Atias, a security analyst at Incapsula, in a
blog post
. After investigating, Incapsula found that the website had been previously compromised, and that the traffic was being directed from a botnet command-and-control (C&C) server to a backdoor installed by attackers on the website server.
The backdoor was instructed to launch HTTP and UDP flood attacks against several U.S. banks, including PNC, HSBC and Fifth Third Bank, said Atias. How had attackers managed to compromise the site, which Incapsula declined to name? According to Atias, the site was access-controlled using a username and password that were both set to admin.
The attack requests spotted by Incapsula occurred after a
New Years Day post
from the
Izz ad-Din al-Qassam Cyber Fighters
Muslim hacktivist group, promising to continue the months-long campaign of U.S. financial website disruptions. Rulers and officials of American banks must expect our massive attacks! From now on, none of the U.S. banks will be safe from our attacks, read the post.
Since September, the
distributed denial of service (DDoS) attacks
launched by the hacktivists -- under the banner of Operation Ababil -- have disrupted the websites of numerous financial institutions, including Bank of America, BB&T, Capital One, HSBC, JPMorgan Chase, New York Stock Exchange, Regions Financial, SunTrust, U.S. Bank and Wells Fargo. The attackers say the attacks are in retaliation for YouTube continuing to host
Innocence of Muslims
, a film that mocks the founder of Islam.
[ Bank hackers were big news last year, but they had company. See
9 Ways Hacktivists Shocked The World In 2012
. ]
Despite the attackers generally previewing attack times and targets in advance, the
sheer scale of the DDoS attacks
has overwhelmed banks websites. While the typical small and midsize business (SMB) website might handle 1 Gbps, and an enterprise or government data center support 10 Gbps, according to Prolexic Technologies, the attackers have achieved massive, sustained packet floods of 70 Gbps.
But many U.S. government officials and information security experts say that they continue to believe that the attacks have been launched not by hacktivists, but the Iranian government, likely as retaliation for economic sanctions, as well as the United States own
cyber attacks against Iran
.
There is
no doubt within the U.S. government
that Iran is behind these attacks, James A. Lewis, a former official at the State and Commerce Departments whos a cybersecurity expert at the Center for Strategic and International Studies in Washington, told
The New York Times
. In large part, thats due to the apparent skill and sophistication behind the attacks, as well as the fact that theyre designed not for financial gain, which is the typical modus operandi of criminals, but rather disruption, which instead suggests the work of a nation state.
Through Pastebin pronouncements and media interviews, however, the Izz ad-Din al-Qassam Cyber Fighters have long maintained that their group is
not sponsored by any government
, and that its members hail from multiple countries.
Regardless, one example of the groups technological sophistication is the apparent ease with which its overwhelmed the websites of some of the worlds largest financial institutions -- and according to Incapsula, the attack code it discovered was designed for just that purpose. The PHP [DDoS] code was designed to multiply itself, so it could take advantage of the full capacity available on the server, said Atias. Since this is a server on [a] hosters backbone, it was potentially capable of producing much more traffic volume than a regular old school botnet zombie.
The botnets controllers also cycled the DDoS attacks for maximum effectiveness. As we continued to monitor the incoming [DDoS] commands, we saw that the attacks were precisely timed, limited for periods that varied from 7 minutes to an hour, said Atias. The botnet C&C was commanding it to work in shifts, maximizing its efficiency and ordering it to renew the attack just as the target would start to recover. During some of these shifts the backdoor was instructed to change target and attack unrelated commercial and e-commerce sites. This all led us to believe that we were monitoring the activities of a botnet for hire.
Expect the attacks against bank websites to continue. Indeed, the hacktivists promised Tuesday to continue their campaign for at least 56 more weeks, or else until YouTube had removed the offending film. We have repeatedly stated that removal of the offensive video,
Innocence Of Muslims
, from YouTube is the simplest solution to stop the cyber-attacks. But ... decision-makers in America have adopted the toughest, most expensive and least effective method, according to a
Pastebin post
uploaded Tuesday by the hacktivists.
In September, the Obama administration did ask Google to review its rules on hate speech and banning YouTube videos.
Google officials responded
that the video criticized the religion of Islam, but not Muslim people, reported
The New York Times
. As a result, Google said that the video would remain online, except in India and Indonesia, where it had violated local laws.
As of Tuesday morning,
Sitedown website users
were reporting higher than normal levels of disruption at the websites of Bank of America, Capital One, Citibank and Fifth Third banks.

Last News
▸ DHS-funded SWAMP scans code for bugs. ◂ Discovered: 23/12/2024 Category: security	▸ Debunking Machine Learning in Security. ◂ Discovered: 23/12/2024 Category: security	▸ Researchers create BlackForest to gather, link threat data. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
U.S. Bank Hack Attack Techniques Identified