The Shoe Drops: Iran DDOS Attacks Hit Clouds

Sometimes, people just do not know what to do with what they can do. It looks like kids behaviour- ok, we  have done it, what's next? Eeh, have no idea,that's why lets show eveyone our buttocks-what a fun.

I see this situation like this

That's an excellent question, Mashka.  The disruption was limited, nothing was stolen.  Are they just flexing their muscles to deter more exploits like Stuxnet?

Kim,  is it more psychological reason to do that or some practical  meaning?

What's the point for Iran to block  work of USA Banks- to show something like" we are so cool hackers that we can do that?"

On your specific points, we certainly have reports saying things like: "the recent attacks showed a level of sophistication far beyond that of amateur hackers."

Radware, the security company investigating on behalf of some of the banks, has said:

"The scale, the scope and the effectiveness of these attacks have been unprecedented. There have never been this many financial institutions under this much duress."

More from Radware's Herberger on the cloud angle:

Experts also say the attackers have infected varied cloud computing facilities with a malicious program dubbed Itsoknoproblembro, which can mask the source of the volleys. Attackers have used the bot to commandeer armies of servers that can flood banks' websites with a digital tsunami. "You have an artillery piece instead of a pea shooter," Herberger said.

Herberger says the perpetrators have exploited the trend in which banks and other companies lease processing power and software from remote servers. The result is that banks and cloud computing facilities become intertwined electronically, which can complicate a bank's ability to simply block data from particular Internet addresses when the bank comes under cyberattack. "There's a lot of brilliance in how the 'bro bot has been conceived and executed," Herberger said. Banks have "to figure out what is legitimate traffic versus illegitimate traffic."

You raise some interesting points, Kenton, although I honestly think you're problem is with the original reporting rather than my commentary.  I was fairly careful:

Iran has reportedly launched a series of attacks on US banks, raising dire implications not just for geopolitics, but also for cloud security...

Today, the New York Times is reporting that unnamed "government officials" are saying the attacks are the work of Iran, "most likely in retaliation for economic sanctions and online attacks by the United States." A former official, and security expert, James A. Lewis, has said there is "no doubt within the U.S. government that Iran is behind these attacks."

Now, of course, the government officials may be mistaken, or may be lying for some reason, but it's fairly unlikely that what they are saying has been misreported.  (The story went around the Internet, and there haven't been any denials from the US government.)

"a potential nation-state enemy was disrupting networks by accessing cloud computing centers"

There's where I have a problem with the article. If you had changed "was" to "could be" I likely wouldn't have stopped to question it. No one has come out with any kind of proof that this is a nation state. In fact, many people have come out and said that it could easily be done by a "hacker" group. I've done a bunch of reading on it this afternoon and here is the only thing I can find as a common thread:

Someone (or a group) has compromised a few servers in data centers with high bandwidth and pointed them at bank websites.

No where have I read anything to support it being cloud infrastructure (vs. a few data centers). No where have I read any evidence that it is nation-state sponsored. No where have I read that it was a super sophisticated attack.

I have read a whole lot of; "un-named sources", "not enough understanding", "could be", etc. I've also read that CloudFlare sees attacks of 60Gb/sec on a monthly basis. That the software doesn't require root/administrator privileges opening it up to a huge variety of potential exploit vectors (Ruby on Rails anyone?). I also found that for a few hundred bucks I could rent enough servers to easily push out this kind of bandwidth.

I have no doubt that attacks like this will increase, nor that there could be nation states that will take advantage of the opportunity to hijack large swaths of bandwidth. I just think that you've tried to prove your stance by using a bunch of media hype rather than actual facts. That's very atypical of your articles.

The thud to which I referred is the realization that a potential nation-state enemy was disrupting networks by accessing cloud computing centers.  I had identified cloud security and cyberwar as the two big threats which never fully materialized in 2012.

I was wrong: in fact, before the end of the year, they had come together in a very threatening way.

Bringing down bank customer-facing bank websites may be no more than an inconvenience, but what other capabilities might the intruder's have?

Kim, while most people use their bank's website to interact with them, it isn't the only way. If I can't get through to the bank website to transfer my money, I can either walk across the street or pick up the phone. It isn't like the website that I connect to is the one that is handling all of the internal and inter-bank functions. Is it awkward and an inconvenience? Sure, but it isn't going to stop people from spending money nor banks from doing business.
Again, maybe it's that Im misunderstanding things, and I'll go read the NYT article, but I'm not so sure why this is seen as such a "thud".

Not sure if I understand you correctly, Kenton, but if DDOS attacks could bring down banking websites for extended periods, that would surely be disruptive to the banking system.

The New York Times published the newsworthy detail that officials are saying Iran is responsible.  Now whether you believe the officials or not is another question, but generally speaking the Times can be relied on to report what they are saying accurately.

The details of the exploit were actually revealed a few months ago, but kept a low profile, partly because nothing was stolen, partly because there was no suggestion of nation state involvement.  See, for example, the article I linked to: "Recent Bank Cyber Attacks Originated From Hacked Data Centers, Not Large Botnet".

The majority of the banking attack traffic does not appear to have been generated by client bots, but rather from compromised servers in data centers...

See also Bloomberg.