US banks under cyberattack say Iran is a suspect


Fri, Jan 11, 2013 - Page 7

US financial institutions are being pounded with high-powered cyberattacks that some suspect are being orchestrated by Iran as payback for political sanctions.

“There is no doubt within the US government that Iran is behind these attacks,” James Lewis, a former official in the State and Commerce departments and now a computer security expert at the Center for Strategic and International Studies, told the New York Times.

While the identities of those behind the online onslaught officially remain a mystery, it was clear they were using a new weapon for slamming bank Web sites with overwhelming numbers or requests for information.

The attackers infected datacenters used to host services in the Internet “cloud” and commandeered massive computing power to back distributed denial of service (DDoS) attacks, according to security experts.

DDoS attacks have been a basic hacker weapon for quite some time, but they have typically involved armies of personal computers tainted with viruses and coordinated to make simultaneous requests at Web sites.

“They are essentially going from a pistol to a cannon,” Carl Herberger, Radware vice president of security solutions, said of cyberattackers using datacenters.

The top 20 US banks on Wednesday were being hit with a third wave of attacks, each of which has been preceded by a claim of responsibility by a group calling itself Izz ad-Din al-Qassam Cyber Fighters.

The attacks began in September last year, according to Radware, which specializes in commercial computer security and has been investigating the cyberassaults.

“The landscape we are seeing is essentially a persistent industry sector attack that is unprecedented,” Herberger said.

Attackers have shrewdly tailored requests to target encrypted pages or data, which are more complicated to process and therefore tax Web sites more, according to Radware.

Such requests are particularly nefarious because encrypted exchanges are often shielded from security software intended to guard against attacks.

Herberger described how hackers sometimes use DDoS attacks to trigger fail systems that can sometimes allow invaders to get to data.

“I call it the battering ram effect,” Herberger said. “They literally batter in the front door; that is a really dark side of this world.”

Attacks on banks could also be test runs for assaults on other business sectors or even smart systems controlling vital infrastructure.

“Let’s suppose this is state sponsored,” Herberger said. “Could these not be dry runs? If the banks are permeable what is the likelihood that other systems are?

John Bumgarner of the US Cyber Consequences Unit, a non-profit group that studies the impact of cyberthreats, cautioned against rushing to assign blame for the attacks.

“There is no irrefutable evidence that the Iranian government was responsible,” Bumgarner said.