Presentation on theme: "Denial of Service Attacks Targeting U.S. Financial Institutions"— Presentation transcript:
1 Denial of Service Attacks Targeting U.S. Financial Institutions January 2013
2 Agenda What is DDoS Who’s Behind the Attacks and Why Timeline of the AttacksWhat Do the Attacks Look LikeHow are the Attacks ChangingWhat are Banks Doing About It
3 Types of DoS AttacksICMP Flood (Ping) – AKA SmurfRelies on misconfigured network devices that allow packets to be sent to all computer hosts on a particular network via the broadcast address of the network, rather than a specific machine. The network then serves as a smurf amplifier.Teardrop AttacksOlder attack that sends mangled IP fragments with overlapping, over-sized payloads to the target machine. This can crash various older operating systems due to a bug in their TCP/IP fragmentation re-assembly code.Peer-to-Peer AttacksNo botnet and the attacker does not have to communicate with the clients it subverts. Instead, the attacker acts as a 'puppet master,' instructing clients of large peer-to-peer file sharing hubs to disconnect from their peer-to-peer network and to connect to the victim’s website instead.Permanent Denial of Service – AKA PhlashingDamages a system so badly that it requires replacement or reinstallation of hardware. Unlike the distributed denial-of-service attack, a PDoS attack exploits security flaws which allow remote administration on the management interfaces of the victim's hardware, usually messing with firmware to render it inoperable.NukeOld denial-of-service attack against computer networks consisting of fragmented or otherwise invalid ICMP packets sent to the target, achieved by using a modified ping utility to repeatedly send this corrupt data, thus slowing down the affected computer until it comes to a complete stop.DistributedMultiple systems flood the bandwidth or resources of a targeted system.ReflectiveSending forged requests of some type to a very large number of computers that will reply to the requests. Using Internet protocol spoofing, the source address is set to that of the targeted victim, which means all the replies will go to (and flood) the target.Degradation-of-ServiceCompromised computers are directed to launch intermittent and short-lived flooding's of victim websites to slow it down rather than crashing it.UnintentionalUnforeseen outages due to unplanned events, such as power failure, hardware/software bugs, or a sites sudden enormous spike in popularity.BlindAttacker must be able to receive traffic from the victim, then the attacker must either subvert the routing fabric or use the attacker's own IP address. Attacker uses a forged IP addresses, making it extremely difficult for the victim to filter out those packets. The TCP SYN flood attack is an example of a blind attack.Level IICause a launching of a defense mechanism which blocks the network segment from which the attack originated.For audience reference only. There are many types of DOS attacks. We will focus on the primary one used against U.S. Financial Institutions… DDoS
4 What is a DDoS? Distributed Denial of Service (DDoS) Attack DDoS has nothing to do with the Operating System Acronym made popular by Microsoft in the 80’s/90’s (Disk Operating System)
5 How DDoS Looks Through the Eyes of Your Technology
6 DDoS Threat is not Temporary… Thanks to the increasing availability of custom coded DDoS modules within popular malware and crimeware releases, opportunistic cybercriminals are easily developing managed DDoS for hire, also known as “rent a botnet” services, next to orchestrating largely under-reported DDoS extortion campaigns against financial institutions and online gambling web sites.DDoS is here to stay… Not just a threat for Financial Services. DDoS is the new high tech protest method, similar to the “Sit In” of the 60’s…
7 Mainstream: Rent a BotNet Anyone with a cause and a little money can rent a botnet.
8 The Attacks: The “Who” is Important The ancient Chinese warrior Sun Tzu taught his men to "know your enemy" before going into battle.If "you know your enemy and know yourself," he wrote, "you need not fear the result of a hundred battles."But, "If you know yourself but not the enemy, for every victory gained you will also suffer a defeat."Understand your opponent;FundingTechniquesCapabilitiesWeaponsScaleFocus/DriversWhyWhen have you “Won”?
9 Who and Why? Izz ad-Din al-Qassam Cyber Fighters Pastebin Post - protest against the “Innocence of Muslims” trailer that ridiculed the Prophet Mohammad. (Available on MetaTube)“Insult to a prophet is not acceptable especially when it is the Last prophet Muhammad”* DO NOT GO TO THIS SITE WITHOUT ANONOMYZING *
10 Attackers Country Affiliation NOT Proven to be State sponsored at this time.Interesting statement in a recent post says “..continue to insult Muslim saints” may provide a better understanding of the source.Likely indicates Shia Muslim origin. Research indicates that the vast majority of Muslims are Sunni (85%), who vehemently reject the concept of sainthood, while the Shia accept this term.Previous posts implied all Muslims are offended and participating in these attacks. This new term indicates only a small geographic region, centered on Iran, may be offended.Previous guesses at attribution have indicated Iran with no evidence to support those claims. One could presume that the pastebin posts and the translation are under the control of the originator (as they use it as an official channel), so this is not a mistake.Shia Muslims believe that an Imam (Islamic leadership position) is sinless by nature, and that his authority is infallible as it comes directly from God. Therefore, Shia Muslims often honor the Imams as saints and perform pilgrimages to their tombs and shrines in the hopes of divine intercession.Sunni Muslims counter that there is no basis in Islam for a hereditary privileged class of spiritual leaders, and certainly no basis for the veneration or intercession of saints. Sunni Muslims contend that leadership of the community is not a birthright, but a trust that is earned and which may be given or taken away by the people themselves.
11 Public Reaction OMG… What are we going to do? ….Where’d they go? OMG… There Back…Who’s on first… They are very disorganized… There is no real “Leader” of this group… primarily only contributors communicating over chat.
12 Who Has Been Targeted?May not be a comprehensive list… The news reports on the impact identified by large numbers of consumers. Financial Institutions are generally not reporting these outages. Only a few larger institutions have proactively communicated to their customers (web pages, or social media venues).
13 Timeline of Attacks Targeting US Financial Institutions (Americans) January 3-6, 2012Muslim Cyber Fighters Announce attacks against JPMorgan Chase, Bank of America, Citibank, Wells Fargo, US Banc, PNC Financial Services Group, BB&T, SunTrust and RegionsSeptember 18, 2012Muslim Cyber Fighters claim responsibility for BoA, CITI, and NYSE Hack in retaliation for the Innocence of Muslim MovieSeptember 19, 2012Muslim Cyber Fighters Attack Chase BankDecember 19-20, 2012Muslim Cyber Fighters target BB&T, US Bank, and PNCSeptember 27, 2012Muslim Cyber Fighters Attack Wells Fargo and US BankSeptember 28, 2012Muslim Cyber Fighters Attack PNCDecember 11-14, 2012Muslim Cyber Fighters Announce PHASE 2 targeting U.S. Bancorp, JP Morgan Chase, Bank of America, PNC, and SunTrust BanksTargeting Banks to Hurt Americans, not the Banks… Americans are seen as being highly driven by money, so they see this as the best target. They believe that by doing this, Americans will demand their leaders to remove the content from the Internet.October 9 -11, 2012Muslim Cyber Fighters Attack CapitalOne, SunTrust and RegionsNovember, 2012Muslim Cyber Fighters acquire different infrastructure and enhances tools usedLate October, 2012Muslim Cyber Fighters infrastructure taken down by US Law Enforcement, Carriers, and Private Sector
14 What do the Attacks Look Like? Up to 80GBpsThe attacks started with HTTP and HTTPS traffic targeting the institutions public websitesFollowed by attacks against the customer login site which caused a significant spike in the firewall state tables.Next wave of attacks changed over to DNS server over loading.Next the logic and database layers are attacked by performing many large full site searches.If more is needed, targeting of the download of large files is used.
15 Impact from the Attacks Local Internet Services around FI DatacentersCustomer ImpactsNothing/Slow/DownRetail Online BankingWWW Site (Login Page?)Reduced Website FunctionalityMobile Not Targeted (Yet)Call Center DDoSAlternate Communication ChannelsSocial Media
17 Tools are They Using LOIC (Low Orbit Ion Cannon) Open source network stress testing and denial-of-service attack application. LOIC was initially developed by Praetox Technologies for the purposes of network load testing, but was later released into the public domain.itsoknoproblembro – AKA brobotDesigned and implemented as a general purpose PHP script injected into a victim’s machine allowing the attacker to upload and execute arbitrary Perl scripts on the target’s machine. It injects an encrypted payload, in order to bypass IPS and Malware gateways into the website main file index.php, allowing the attacker to upload new Perl scripts at any time. Initial server infection is usually done by using the well known Remote File Inclusion (RFI) technique.
18 Sophistication is Changing InitiallyTargets AnnouncedScheduled and AutomatedSame Attack for all FI’sFinger Printed User Agent StringInvalid Keep Alive (= 0)RecentAttacks target specific likely site weaknessesUnannouncedLong Lasting / No ScheduleHashing (masking) Uniquely Identifiable InformationEST - 9 / 12 / 3 / 5
19 What are Banks Doing About It? Acquire / Refine Current MitigationCloud Service ProvidersDDoS Mitigation (BlackHole)DNS OutsourcingContent Delivery Networks (CDN’s)Premise TechnologyFirewalls and Intrusion Prevention Systems to Block bad TrafficTurn off/down non mission critical services (Search, File Downloading, etc…)Add more capacity (Internet, Servers, Network)Mitigation TestingIncident Management ExercisingCommunication Plans
20 Final Thought: Remember it’s Mitigation NOT Elimination The goal is to stay afloat while under attack. Current US Law prohibits using offensive forces while being attacked via a cyber channel.