The cyber war counter attack by Iran begins on Citi, BOA and JP Morgan Chase

[BigRedChief]

http://news.yahoo.com/exclusive-iran...6--sector.html

(Reuters) - Iranian hackers have repeatedly attacked Bank of America Corp , JPMorgan Chase & Co and Citigroup Inc over the past year, as part of a broad cyber campaign targeting the United States, according to people familiar with the situation.


The attacks, which began in late 2011 and escalated this year, have primarily been "denial of service" campaigns that disrupted the banks' websites and corporate networks by overwhelming them with incoming web traffic, said the sources.


Whether the hackers have been able to inflict more serious damage on computer networks or steal critical data is not yet known. The sources said there was evidence suggesting the hackers targeted the banks in retaliation for their enforcement of Western economic sanctions against Iran.


Iran has beefed up its cyber capabilities after its nuclear program was damaged in 2010 by the Stuxnet virus, widely believed to have been developed by the United States. Tehran has publicly advertised its intentions to build a cyber army and encouraged private citizens to hack against Western countries.


The attacks on the three largest U.S. banks originated in Iran, but it is not clear if they were launched by the state, groups working on behalf of the government, or "patriotic" citizens, according to the sources, who requested anonymity as they were not authorized to discuss the matter.
They said the attacks shed new light on the potential for Iran to lash out at Western nations' information networks.


"Most people didn't take Iran seriously. Now most people are taking them very seriously," said one of the sources, referring to Iran's cyber capabilities.


Iranian officials were not available for comment. Bank of America, JPMorgan and Citigroup declined to comment, as did officials with the Pentagon, U.S. Department of Homeland Security, Federal Bureau of Investigation, National Security Agency and Secret Service.
A U.S. financial services industry group this week warned banks, brokerages and insurers to be on heightened alert for cyber attacks after the websites of Bank of America and JPMorgan Chase's experienced unexplained service disruptions.
NBC reported late on Thursday that the Iranian government was behind these attacks, citing U.S. national security sources. Reuters could not verify that independently.
Tensions between the United States and Iran, which date back to the revolution in 1979 that resulted in the current Islamic republic, have escalated in recent years as Washington led the effort to prevent Tehran from getting a nuclear bomb and imposed tough economic sanctions.
DISRUPTIVE CAMPAIGN
Denial-of-service campaigns are among the oldest types of cyber attacks and do not require highly skilled computer programmers or advanced expertise, compared with sophisticated and destructive weapons like Stuxnet.
But denial-of-service attacks can still be very disruptive: If a bank's website is repeatedly shut down, the attacks can hurt its reputation, affect customer retention and cause revenue losses as customers cannot open accounts or conduct other business.


Bank of America, Citigroup and JPMorgan Chase have consulted the FBI, Department of Homeland Security and National Security Agency on how to strengthen their networks in the face of the Iranian attacks, the sources said. It was not clear whether law enforcement agencies are formally investigating the attacks.


The Iranian attackers may have used denial-of-service to distract the victims from other, more destructive assaults that have yet to be uncovered, the sources said.


Frank Cilluffo, who served as homeland security adviser to U.S. President George W. Bush, told Reuters that he knows of "cyber reconnaissance" missions that have come from Iran but declined to give specifics.
"It is yet to be seen whether they have the wherewithal to cause significant damage," said Cilluffo, who is now director of the Homeland Security Policy Institute at George Washington University.


security experts said Iran's cyber capabilities are not as sophisticated as those of the China, Russia, the United States or many of its Western allies. Jim Lewis, a former U.S. Foreign Service officer, said Iran has been testing its cyber technology against Israel and other Gulf states in recent years
.
"It's like the nuclear program: It isn't particularly sophisticated but it makes progress every year," said Lewis, who is a senior fellow at the Center for Strategic & International Studies.

[LiveSteam]

Originally Posted by BigRedChief

Twitter hacked. 250K account passwords compromised. China is responsible.
http://www.bloomberg.com/news/2013-0...user-data.html

Lets put together an army of Trolls,& go **** these guys up.

[Fish]

Hacking Twitter? LOL... What's the point?

That's like a car thief stealing this:

[blaise]

Guess what, as long as there's an internet there's going to be hackers. Good luck trying to stop it.

[BigRedChief]

Originally Posted by Fish

Hacking Twitter? LOL... What's the point?

That's like a car thief stealing this:

it is better to remain stupid in silence than open your mouth and confirm it.

/some smart old dude

[ClevelandBronco]

Originally Posted by BigRedChief

it is better to remain stupid in silence than open your mouth and confirm it.

/some smart old dude

I don't mind admitting that I can't figure out why anyone would bother hacking Twitter. Can you explain to me why this is might be important?

[BigRedChief]

Originally Posted by ClevelandBronco

I don't mind admitting that I can't figure out why anyone would bother hacking Twitter. Can you explain to me why this is might be important?

In general using public information and standard cyber security practices.

You are using a known state sponsored IP range to perform the attack. People are going to know who it was. First question? Why do you want other countries to know you did this?

Twitter supposedly has state of the art security due to a hack a couple of years ago. It's been touted in cyber security seminars.

If you wanted to let your enemies know of your capabilities to deter them from harming you. You need to publically show them those capabilities. A don't **** with us statement. But, you didn't really harm your enemy.

By choosing a non military or essential part of the infrastruture a statement can be made without also a tremendous retribution from the cyber arm of the military in the territory that you invaded.

This is subtle genius. As opposed to the stupid ass lumbering hacks on the banks from Iran.

[DaveNull]

I don't mind admitting that I can't figure out why anyone would bother hacking Twitter. Can you explain to me why this is might be important?

- snagging direct messages
- pulling credentials so that they could pivot to other accounts
- watching GPS coordinates for posts
- lulz

It's been touted in cyber security seminars.

Wut?

[ChiliConCarnage]

Originally Posted by ClevelandBronco

I don't mind admitting that I can't figure out why anyone would bother hacking Twitter. Can you explain to me why this is might be important?

Information

If it was indeed China then it's probably so they could spy on their own people. China blocked twitter years ago. China has popular micro-blogging services like Sina Weibo. If you're circumventing their firewall in order to communicate over twitter they surely want to know why.

There's really only two reasons to do that. The largest percentage are going to be tech savvy people who just want to follow or interact with foreigners. Maybe you're a big soccer fan and want to follow Lionel Messi, etc.

The others are purposefully looking to communicate without the government being able to monitor them. Political dissidents, people trading in state secrets, tibetan supporters

[BigRedChief]

Originally Posted by ChiliConCarnage

The others are purposefully looking to communicate without the government being able to monitor them. Political dissidents, people trading in state secrets, tibetan supporters

Do you even read what you write? If you are in I.T. you need some more education.

They are going to use twitter to communicate without the government knowing?

[ClevelandBronco]

Originally Posted by BigRedChief

In general using public information and standard cyber security practices.

You are using a known state sponsored IP range to perform the attack. People are going to know who it was. First question? Why do you want other countries to know you did this?

Twitter supposedly has state of the art security due to a hack a couple of years ago. It's been touted in cyber security seminars.

If you wanted to let your enemies know of your capabilities to deter them from harming you. You need to publically show them those capabilities. A don't **** with us statement. But, you didn't really harm your enemy.

By choosing a non military or essential part of the infrastruture a statement can be made without also a tremendous retribution from the cyber arm of the military in the territory that you invaded.

This is subtle genius. As opposed to the stupid ass lumbering hacks on the banks from Iran.

Maybe. I appreciate the answer.

Originally Posted by ChiliConCarnage

Information

If it was indeed China then it's probably so they could spy on their own people. China blocked twitter years ago. China has popular micro-blogging services like Sina Weibo. If you're circumventing their firewall in order to communicate over twitter they surely want to know why.

There's really only two reasons to do that. The largest percentage are going to be tech savvy people who just want to follow or interact with foreigners. Maybe you're a big soccer fan and want to follow Lionel Messi, etc.

The others are purposefully looking to communicate without the government being able to monitor them. Political dissidents, people trading in state secrets, tibetan supporters

I suspect that your answer is closer to the fact of the matter, and I have no problem with China spying on its own dissidents.

[ChiliConCarnage]

Originally Posted by BigRedChief

Do you even read what you write? If you are in I.T. you need some more education.

They are going to use twitter to communicate without the gover nment knowing?

I've re-read it and I don't know what you're referring to unless you've never used twitter; you can direct message people privately just like e-mail.

[BigRedChief]

Originally Posted by ChiliConCarnage

I've re-read it and I don't know what you're referring to unless you've never used twitter; you can direct message people privately just like e-mail.

Do you not think there are other avenues to message others privately?

Why would you use something so easily hacked? No underground taking it to the man would use Twitter for private conversations. That ship sailed years ago.

[Buzz_TinBalls]

be sure to wear safety goggles

[LiveSteam]

It just one of a 1000 coincidences. Nothing to worry about

[ChiliConCarnage]

Originally Posted by BigRedChief

Do you not think there are other avenues to message others privately?

I don't know why you asked this but of course there are many options. Perhaps, they migrated over from gmail after the 2010 hacking of Chinese human rights activists accounts.

Originally Posted by BigRedChief

Why would you use something so easily hacked? No underground taking it to the man would use Twitter for private conversations. That ship sailed years ago.

Since when is Twitter easily hacked? This is the first time they've had their data breached and they caught it in the act and stopped it. Most companies don't know until months or years later. I think of twitter as having a strong reputation in terms of security and protecting privacy of user data.

Twitter’s efforts to recruit two of the security community’s most high profile hackers may seem a bit puzzling. But Twitter has been taking pains to prove to users that it aims to protect their privacy and, in some cases, anonymity, to a degree that trumps Facebook and even Google. It remains one of the only mainstream social media services that allows the use of pseudonyms. And it’s currently fighting a landmark legal battle to avoid having to turn over the tweets of Malcolm Harris, an Occupy Wall Street protestor who was charged with disorderly conduct last year.

All of those moves seem designed to define Twitter as a place where users–especially political vulnerable ones–can let loose with controversial political speech without worrying about being identified by government requests or kicked off the service. With the addition of security stars like Miller and Marlinspike, it seems Twitter is aiming to make sure those users are protected from less benevolent hackers, too.