Cyberattacks on banking websites subside -- for now

Prolexic, which says it protects the top financial institutions, says the attackers have done their homework

The wave of cyberattacks against a half-dozen U.S. financial institutions has subsided this week, but the recent demonstration of force shows a careful honing of destructive techniques that could continue to cause headaches.

The attacks against Wells Fargo, U.S. Bancorp, PNC Financial Services Group, Citigroup, Bank of America and JPMorgan Chase succeeded in drawing ire from consumers trying to use the sites for regular banking.

But customer-facing websites are just a small part of very complicated banking systems consisting of sometimes thousands of back-end applications that are being prodded by attackers, said Scott Hammack, CEO of Prolexic, a company based in Hollywood, Florida, which specializes in defending against distributed denial-of-service (DDOS) attacks.

The attackers "have absolutely done their homework on these large companies," Hammack said. "They've found many, many weak spots, and their attacks are very focused on those weak links."

Prolexic is in a unique position to observe the attacks. The financial institutions victimized by the attacks last week are its customers, although confidentiality agreements with the banks prevent Prolexic from directly naming the companies, said Prolexic's president, Stuart Scholly.

The attacks have consumed up to 70Gbps of bandwidth, well beyond the 1Gbps to 10Gbps circuits that large companies tend to rent, Scholly said.

"There are very few companies that can afford to buy that kind of bandwidth," Scholly said.

Within a few minutes of the start of an attack, DNS (Domain Name System) or BGP (Border Gateway Protocol) routing changes are used to direct malicious traffic through Prolexic's data centers in London; Hong Kong; San Jose, California; and Ashburn, Virginia. The bad traffic is scrubbed, while non-attack traffic is passed along to customers.

As exhibited by last week's problems, it doesn't mean in every case that a site's hiccups are immediately cured. The hackers are using between six and eight different types of attacks originating from small armies of compromised computers. Those botnets are often in the U.S. and China, which are countries with large numbers of computers without up-to-date patches, making those machines vulnerable to hackers to install DDOS toolkits.

Prolexic called out one of those toolkits, called "itsoknoproblembro," in a recent statement, but declined to say if that toolkit was used in last week's attacks.

The hackers are taking steps to make each attacking computer within those botnets look different. Prolexic tries to identify an attacking computer by its "signature," or a set of characteristics that make it look unique. But if those parameters vary over time, it's more difficult to block an attack.

The vast range of IP addresses used by banks also makes defense more difficult, as hackers try different attack techniques against applications and ports, testing for latency, or how long it takes the bank's systems to respond.

"It's not like protecting mom and pop's ABC hardware store with a single IP [address] and a couple of ports," Hammack said.

Prolexic executives won't speculate on the motivation for the attacks or what group may be responsible, but Hammack said he is "frustrated when people say this is a dumb attack by some kid in an apartment in Brooklyn."

Send news tips and comments to jeremy_kirk@idg.com

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?