Attackers targeting major U.S. banks with distributed denial of service attacks are using a number of toolkits to automate the job. Prolexic Technologies, a security company specializing in DDoS protection services, identified one toolkit called itsoknoproblembro, a kit that attacks multiple ports and network targets.
Meanwhile, Arbor Networks told Threatpost via email that itsoknoproblembro isn’t the only tool being used in these attacks, and that this isn’t the first time it has seen the kit used in a large-scale DDoS attack. Experts have said the scale of these attacks is massive, unlike any seen previously.
During the past 10 days, PNC, Wells Fargo, J.P. Morgan Chase & Co, and Bank of America have been either taken offline or had intermittent outages interrupting services. A group using the name Mrt. Izz ad-Din al-Qassam Cyber Fighters has claimed responsibility for the attacks as retaliation for the portrayal of Muslims in a series of movie trailers posted to YouTube for the film “Innocence of Muslims.”
Prolexic said today that it has recorded sustained floods hitting 70 Gbps and more than 30 million packets per second in some of the attacks. Expert Dmitri Alperovich of CloudStrike told Threatpost last week his company had seen some attacks reach 100 Gbps. Most observed DDoS attacks require 5-10 Gbps of traffic to take down a site.
“These are not super sophisticated attacks, but we’re seeing very large, almost historic, attacks from the standpoint of the volume of traffic we’re seeing, “ Alperovich said. “And these banks are not tiny. They have massive infrastructures and they’re coming under DDoS attacks regularly. The fact that these attacks are able to shut them down is quite remarkable.”
Itsoknoproblembro, Prolexic said, attacks both the infrastructure and application layers. It uses SYN floods that can hit multiple entry points on the network, as well as ICMP, UDP and SSL encrypted attacks. Primarily, the attackers are deploying large UDP flood attacks, sending packets at the banks’ DNS infrastructures. The attacks are being carried out by legitimate IP addresses, which enables them to bypass detection, Prolexic said.
“Only a handful of companies around the world could survive a hit of 70 Gbps in conjunction with the complex blend of attack vectors we have witnessed,” said Prolexic Chief Executive Officer Scott Hammack.
Attacks of this size and complexity require months of planning and resource gathering, experts said, but aren’t necessarily overly sophisticated.
The attackers posted their motivations on Pastebin last week, promising to hit a bank a day for a particular stretch in retaliation for the movie trailers. Experts, however, dispute this and other theories that the attacks were a cover for a series of wire transfer fraud, as reported by the FBI and Financial Services ISAC, as well as a theory pushed forth by Conn. Senator Joe Lieberman, who pointed the finger at a secret Iranian military outfit called the Qud Force. Alperovich, for one, said the attackers are flexing their muscle and demonstrating what they’re capable of.
“Banks have high bandwidth connections into their data centers. They can take a lot of traffic, plus they all use security and DDoS protection services,” he said. “This is massively higher than what we see on a normal basis.”
