Iran blamed for online bank attacks

SAN FRANCISCO — The attackers hit one U.S. bank after the next. As in so many previous attacks, dozens of online banking sites slowed, hiccupped or ground to a halt before recovering several minutes later.

But there was something disturbingly different about the wave of online attacks on U.S. banks in recent weeks. Security researchers said that instead of exploiting individual computers, the attackers engineered networks of computers in data centers.

The skill required to carry out attacks on this scale has convinced U.S. government officials and security researchers that they are the work of Iran, most likely in retaliation for economic sanctions and online attacks by the United States.

“There is no doubt within the U.S. government that Iran is behind these attacks,” said James Lewis, a former official in the departments of State and Commerce and a computer security expert at the Center for Strategic and International Studies in Washington.

Lewis said the amount of traffic flooding U.S. banking sites was “multiple times” the amount that Russia directed at Estonia in a month-long online assault in 2007 that nearly crippled the Baltic nation. U.S. officials have offered no technical evidence to back up their claims, but computer security experts say the recent attacks showed a level of sophistication far beyond that of amateur hackers. Also, the hackers chose to pursue disruption, not money: another earmark of state-sponsored attacks, the experts said.

“The scale, the scope and the effectiveness of these attacks have been unprecedented,” said Carl Herberger, vice president of security solutions at Radware, a security firm that has been investigating the attacks on behalf of banks and cloud-service providers. “There have never been this many financial institutions under this much duress.”

Since September, intruders have caused disruptions to the online banking sites of Bank of America, Citigroup, Wells Fargo, U.S. Bancorp, PNC, Capital One, Fifth Third Bank, BB&T and HSBC. They employed distributed denial of service attacks, named because hackers deny customers service by directing large volumes of traffic to a site until it collapses. No bank accounts were breached and no customer money was taken.

Companies and consumers are increasingly conducting their business over large-scale “clouds” of hundreds, even thousands, of networked computer servers housed in data centers. These clouds are run by Amazon and Google, but also by many smaller operators that commonly rent them to other companies. It appears the hackers remotely hijacked some of these clouds and used the computing power to take down American banking sites.

“There’s a sense now that attackers are crafting their own private clouds,” either by creating networks of individual machines or by stealing resources wholesale from poorly maintained corporate clouds, said John Kindervag, an analyst at Forrester Research.

How the attackers are hijacking data centers is still a mystery. Making matters more complex, they have simultaneously introduced another weapon: encrypted distributed denial of service attacks. Banks encrypt customers’ online transactions for security, but the encryption process consumes system resources. By flooding banking sites with encryption requests, attackers can further slow or cripple sites with fewer requests.

A hacker group calling itself Izz ad-Din al-Qassam Cyber Fighters has claimed in online posts that it was responsible for the attacks. The group said it attacked the banks in retaliation for an anti-Islam video that mocked the Prophet Muhammad, and pledged to continue its campaign until the video was scrubbed from the Internet. It called the campaign Operation Ababil, a reference to a story in the Koran in which Allah sends swallows to defeat an army of elephants dispatched by the king of Yemen to attack Mecca in A.D. 571.

But U.S. intelligence officials said the group is actually a cover for Iran. They said Iran is waging the attacks in retaliation for Western economic sanctions and for a series of attacks on its own computer systems.

In the past three years, three sophisticated computer viruses - called Flame, Duqu and Stuxnet - have hit computers in Iran. The New York Times reported last year that the United States, together with Israel, was responsible for Stuxnet, the virus used to destroy centrifuges in an Iranian nuclear facility in 2010.

“It’s a bit of a grudge match,” said Lewis of the Center for Strategic and International Studies. Researchers at Radware who investigated the attacks for several banks found that the traffic was coming from data centers around the world. They discovered various cloud services and public Web-hosting services had been infected with a sophisticatedform of malicious software, called Itsoknoproblembro, that was designed to evade detection by anti-virus programs. The malware has existed for years, but the banking attacks were the first time data centers were used via the virus to attack external victims.