U.S. Bank Hack Attack Techniques Identified

Self-proclaimed Muslim hacktivists that have been disrupting U.S. banks' websites since September are compromising poorly secured, hosted servers to sustain their large-scale attacks.

That warning comes by way of security firm Incapsula, which said it recently discovered that "a small and seemingly harmless general interest U.K. website" that it was monitoring had been compromised and made part of a botnet that's been used, in part, to attack U.S. banks' websites.

After Incapsula was hired to monitor the site earlier this month, its security team soon began seeing a suspicious amount of "requests with encoded PHP code payload" directed at the site, said Ronen Atias, a security analyst at Incapsula, in a blog post. After investigating, Incapsula found that the website had been previously compromised, and that the traffic was being directed from a botnet command-and-control (C&C) server to a backdoor installed by attackers on the website server.

"The backdoor was instructed to launch HTTP and UDP flood attacks against several U.S. banks, including PNC, HSBC and Fifth Third Bank," said Atias. How had attackers managed to compromise the site, which Incapsula declined to name? According to Atias, the site was access-controlled using a username and password that were both set to "admin."

The attack requests spotted by Incapsula occurred after a New Year's Day post from the Izz ad-Din al-Qassam Cyber Fighters Muslim hacktivist group, promising to continue the months-long campaign of U.S. financial website disruptions. "Rulers and officials of American banks must expect our massive attacks! From now on, none of the U.S. banks will be safe from our attacks," read the post.

Since September, the distributed denial of service (DDoS) attacks launched by the hacktivists -- under the banner of "Operation Ababil" -- have disrupted the websites of numerous financial institutions, including Bank of America, BB&T, Capital One, HSBC, JPMorgan Chase, New York Stock Exchange, Regions Financial, SunTrust, U.S. Bank and Wells Fargo. The attackers say the attacks are in retaliation for YouTube continuing to host Innocence of Muslims, a film that mocks the founder of Islam.

[ Bank hackers were big news last year, but they had company. See 9 Ways Hacktivists Shocked The World In 2012. ]

Despite the attackers generally previewing attack times and targets in advance, the sheer scale of the DDoS attacks has overwhelmed banks' websites. While the typical small and midsize business (SMB) website might handle 1 Gbps, and an enterprise or government data center support 10 Gbps, according to Prolexic Technologies, the attackers have achieved massive, sustained packet floods of 70 Gbps.

But many U.S. government officials and information security experts say that they continue to believe that the attacks have been launched not by hacktivists, but the Iranian government, likely as retaliation for economic sanctions, as well as the United States' own cyber attacks against Iran.

"There is no doubt within the U.S. government that Iran is behind these attacks," James A. Lewis, a former official at the State and Commerce Departments who's a cybersecurity expert at the Center for Strategic and International Studies in Washington, told The New York Times. In large part, that's due to the apparent skill and sophistication behind the attacks, as well as the fact that they're designed not for financial gain, which is the typical modus operandi of criminals, but rather disruption, which instead suggests the work of a nation state.

Through Pastebin pronouncements and media interviews, however, the Izz ad-Din al-Qassam Cyber Fighters have long maintained that their group is not sponsored by any government, and that its members hail from multiple countries.

Regardless, one example of the group's technological sophistication is the apparent ease with which it's overwhelmed the websites of some of the world's largest financial institutions -- and according to Incapsula, the attack code it discovered was designed for just that purpose. "The PHP [DDoS] code was designed to multiply itself, so it could take advantage of the full capacity available on the server," said Atias. "Since this is a server on [a] hoster's backbone, it was potentially capable of producing much more traffic volume than a regular 'old school' botnet zombie."

The botnet's controllers also cycled the DDoS attacks for maximum effectiveness. "As we continued to monitor the incoming [DDoS] commands, we saw that the attacks were precisely timed, limited for periods that varied from 7 minutes to an hour," said Atias. "The botnet C&C was commanding it to work in 'shifts,' maximizing its efficiency and ordering it to renew the attack just as the target would start to recover. During some of these shifts the backdoor was instructed to change target and attack unrelated commercial and e-commerce sites. This all led us to believe that we were monitoring the activities of a botnet for hire."

Expect the attacks against bank websites to continue. Indeed, the hacktivists promised Tuesday to continue their campaign for at least 56 more weeks, or else until YouTube had removed the offending film. "We have repeatedly stated that removal of the offensive video, Innocence Of Muslims, from YouTube is the simplest solution to stop the cyber-attacks. But ... decision-makers in America have adopted the toughest, most expensive and least effective method," according to a Pastebin post uploaded Tuesday by the hacktivists.

In September, the Obama administration did ask Google to review its rules on hate speech and banning YouTube videos. Google officials responded that the video criticized the religion of Islam, but not Muslim people, reported The New York Times. As a result, Google said that the video would remain online, except in India and Indonesia, where it had violated local laws.

As of Tuesday morning, Sitedown website users were reporting higher than normal levels of disruption at the websites of Bank of America, Capital One, Citibank and Fifth Third banks.