Iranian cyber attacks feared after killing of top general

AP/ UNB . Boston | Published: 00:00, Jan 05,2020


Iran’s retaliation for the United States’ targeted killing of its top general is likely to include cyber attacks, security experts warned on Friday.

Iran’s state-backed hackers are already among the world’s most aggressive and could inject malware that triggers major disruptions to the US public and private sector.

Potential targets include manufacturing facilities, oil and gas plants and transit systems. A top US cyber security official is warning businesses and government agencies to be extra vigilant.

In 2012 and 2013, in response to US sanctions, Iranian state-backed hackers carried out a series of disruptive denial-of-service attacks that knocked offline the web sites of major US banks including the Bank of America as well as the New York Stock Exchange and NASDAQ. Two years later, they wiped servers at the Sands Casino in Las Vegas, crippling hotel and gambling operations.

The destructive attacks on US targets ebbed when Tehran reached a nuclear deal with the Obama administration in 2015.

The killing early Friday in Iraq of Quds Force commander General Qassam Soleimani — long after Trump scrapped the nuclear deal — completely alters the equation.

‘Our concern is essentially that things are going to go back to the way they were before the agreement,’ said John Hultquist, director of intelligence analysis at the cyber security firm FireEye. ‘There are opportunities for them to cause real disruption and destruction.’

Iran has been doing a lot of probing of critical US industrial systems in recent years — trying to gain access — but has limited its destructive attacks to targets in the Middle East, experts say.

It’s not known whether Iranian cyber agents have planted destructive payloads in US infrastructure that could now be triggered.

‘It’s certainly possible,’ Hultquist said. ‘But we haven’t actually seen it.’

Robert M Lee, chief executive of Dragos Inc, which specialises in industrial control system security, said that Iranian hackers have been very aggressive in trying to gain access to utilities, factories, and oil and gas facilities. That doesn’t mean they’ve succeeded, however.

In one case in 2013 where they did break into the control system of a US dam — garnering significant media attention — Lee said that they probably didn’t know the compromised target was a small flood control structure 20 miles north of New York City.

Iran has been increasing its cyber capabilities but is not in the same league as China or Russia — who have proved most adept at sabotaging critical infrastructure, witnessed in attacks on Ukraine’s power grid and elections, experts agree.

And while the US power grid is among the most secure and resilient in the world, plenty of private companies and local governments haven’t made adequate investments in cyber security and are highly vulnerable, experts say.

‘My worst-case scenario is a municipality or a cooperative-type attack where power is lost to a city or a couple of neighbourhoods,’ Lee said.

Consider the havoc an epidemic of ransomware attacks has caused US local governments, crippling services as vital as tax collection. While there’s no evidence of coordinated Iranian involvement, imagine if the aggressor — instead of scrambling data and demanding ransoms — simply wiped hard drives clean, said Hultquist.

‘ You could see many cities and hospitals targeted at once with ransomware that encrypts data to make it unusable, but there is no way to decrypt it by paying a ransom,’ said cyber security veteran Chris Wysopal, the chief technical officer of Veracode.

The only known cyber security survey of US local governments, county and municipal, found that the networks of 28 per cent were being attacked at least hourly — and that nearly the same percentage said they didn’t even know how frequently they were being attacked. Although the study was done in 2016, the authors at the University of Maryland-Baltimore County don’t believe the situation has improved since.

The top cyber security official at the Department of Homeland Security, Christopher Krebs, urged companies and government agencies to refresh their knowledge of Iranian state-backed hackers’ past exploits and methods after Soleimani’s death was announced. ‘Pay close attention to your critical systems,’ he tweeted.

In June, Krebs warned of a rise in malicious Iranian cyber activity, particularly attacks using common methods like spear-phishing that could erase entire networks: ‘What might start as an account compromise, where you think you might just lose data, can quickly become a situation where you’ve lost your whole network.’

Wysopal said that the Iranians are apt to have learned a lot from the 2017 NotPetya attack, which the US and Britain have attributed to state-backed Russian hackers and which caused at least $10 billion in damage globally. The worst cyber attack to date, it exploited unpatched software after being delivered through an unwitting Ukrainian tax software provider and spread on networks without human intervention.

When then-director of National Intelligence James Clapper blamed Iran for the Sands Casino attack, it was one of the first cases of American intelligence agencies identifying a specific country as hacking for political reasons: The casino’s owner, Sheldon Adelson, is a big Israel backer. Clapper also noted the value of hacking for collecting intelligence. North Korea’s hack of Sony Pictures in retaliation for a movie that mocked its leader followed.

The vast majority of the nearly 100 Iranian targets leaked online last year by a person or group known as Lab Dookhtegan — a defector, perhaps — were in the Middle East, said Charity Wright, a former National Security Agency analyst at the threat intelligence firm InSights. She said that it’s highly likely Iran will focus its retaliation on US targets in the region as well as in Israel and the US.

Iran is widely believed to have been behind a devastating 2012 attack on Aramco, the Saudi oil company that wiped the data from more than 30,000 computers. It was also a victim of the Stuxnet computer virus.

First uncovered in 2010, it destroyed thousands of centrifuges involved in Iran’s contested nuclear programme and is widely reported to have been a US-Israeli invention.

More about:

Want stories like this in your inbox?

Sign up to exclusive daily email