Bank Hacks: 7 Misunderstood Facts

Who's behind the recent online attacks against multiple financial institutions including Bank of America, JPMorgan Chase, PNC, U.S. Bank, and Wells Fargo? In recent weeks, all have bit hit by large-scale distributed denial-of-service (DDoS) attacks. Cue website outages and customer outrage.

A self-described hacktivist group, the Cyber fighters of Izz ad-din Al qassam, has taken credit for organizing the related Operation Ababil, which it claims is a grassroots campaign to protest the recent release of a film that mocked the founder of Islam.

But as information security researchers review the attacks and tools used, they're finding that the claims made by the supposed hacktivist group don't all appear to add up. Here are seven facts about what's currently known about recent and forthcoming banking attacks.

1. Hacktivist Tool Claims Remain Unverified

Was a hacktivist group really behind the bank attacks, or--as some former U.S. government officials have alleged in anonymous interviews--might the government of Iran be to blame?

"In its postings, Cyber fighters of Izz ad-din Al Qassam published several attack tools including the Mobile LOIC Apache Killer version," said Ronen Kenig, director of product marketing for security products at Radware, in a blog post. "That tool was not present in the observed attack traffic, however, meaning it is possible that the Cyber fighters of Izz ad-din Al Qassam group was not behind the attack after all, or that it didn't manage to recruit supporters to its attack who were willing to use the mobile LOIC attack tool."

[ Criminals are tripling down on attack infrastructure. See Online Criminals' Best Friends: Malnets. ]

2. Servers, Not Botnets, Disrupted Bank Sites

What the attackers lacked in grassroots support, they made up for in attack strength, since they successfully disrupted the websites of leading banks, even after publicizing in advance the date and time of their attacks. Their attack power came from the use of server-infecting malware. "The majority of the attack traffic was not generated from a botnet, but rather from servers," said Carl Herberger, VP of security solutions at Radware, via phone. "The servers were compromised by the attackers prior to the attack."

Using server malware is unusual, and according to Arbor Networks researchers, the attacks don't resemble any previously seen hacktivism campaigns. "These are high-bandwidth servers that have obviously been compromised," said Dan Holden, director of security for the Arbor security engineering and respo nse team, speaking by phone. "So you're talking about probably hosting websites that have been compromised or used."

Recent hacktivist attacks have involved botnets of infected PCs--not servers. "For years and years, there have been botnets used for DDoS," said Holden. "Then you had opt-in hacktivism activity, and the 'hive mind' type of feature set. And now this is almost back to the future, where you're going back to the 1990s style of servers being leveraged, because of course they have very high bandwidth."

3. Attack Toolkit Positively Identified

One of the DDoS toolkits used in the attacks--and it may be the only one--has been identified as the 'itsoknoproblembro' tool kit. According to Prolexic Technologies, the toolkit has been used to launch "sustained floods" that have peaked at 70 Gbps and 30 million packets per second.

The tool can also be used to launch blended DDoS attacks. "The itsoknoproblembro toolkit includes multiple infrastructure and application-layer attack vectors, such as SYN floods, that can simultaneously attack multiple destination ports and targets, as well as ICMP, UDP, and SSL encrypted attack types," according to Prolexic. In addition, the toolkit can also be used to take out domain name system (DNS) infrastructure via UDP floods.

4. Banks Knocked Offline Via Encrypted SSL Floods

Beyond the volume of attacks generated, the banking website disruptions were also successful because they included SSL attacks, which can be generated by tools such as Dirt Jumper.

"Every SSL DDoS attack that we've seen has been an HTTP GET flood that's been encrypted," said Radware's Herberger. "It's been a very simple flood ... [but] the infrastructures that are in place to prevent SSL attacks are designed against intrusion events, not DDoS attacks."

Unfortunately, devices that provide SSL intrusion prevention can themselves become DDoS targets and be successfully shut down using relatively little traffic. "In one case in the last two weeks, we saw a financial services organization with 40 gigabits of external link that was taken down with 30 megabits of SSL attack," Herberger said.