Introduction to Cyber-Warfare - Proiect SEMPER FIDELIS

58 5. CYBER ATTACK AGAINST INTERNAL DISSIDENTSare usually visited by dissidents. Most botnets allow the botmaster not only to control the botsfor a DDoS but also access to their systems. Hence, the ICA might as well gather informationon dissident systems.Who Controls the ICA?All that is currently known for sure about the ICA is that they are a pro-Iranian hackergroup, which has performed the aforementioned attacks. Though there has been no real evidenceshowing them to be subordinate to the Iranian government, an Iranian dissident Website known as “The Green Voice of Freedom” claims that the ICA was created in 2005 as partof the Iranian Revolutionary Guard Corps (IRGC). The “Green Voice” also asserts that theIranian government forced hackers into the ICA by threatening with imprisonment. 123 Analternate hypothesis ponders that the ICA is actually a Russian group—not Iranian. The Centerfor Strategic and International Studies (CSIS) rejects this notion, stating that the domainname hijacking efforts are a lower skill-level attack—as opposed to the technical prowess heldby Russian hackers. 124 However, the CSIS analysis does not take into account that the organizationlikely used the domain name hijacking efforts to create a botnet.Alleged Iranian Botnet StrikesWhether or not the ICA is affiliated with the Iranian government, one thing is clear:the hacking group launches cyber attacks that align well with the politics of the currentIranian regime. Therefore, if the ICA or other pro-government Iranian hackers were workingto build a botnet, we would suspect the targets to be political in nature. In the fall of 2012,botnet DDoS attacks occurred against several major U.S. banks including Bank of AmericaCorp., JPMorgan Chase & Co, Wells Fargo & Co, U.S. Bancorp and PNC Financial Services. 125Security researchers concluded that the attacks were the work of a botnet.In late September, a group identifying itself as “The Izz ad-Din al-Qassam Cyber Fighters”posted a declaration on Pastebin. j They stated that the DDoS attacks against the banks werepart of what they called “Operation Ababil” (“Swallow”). The “Cyber Fighters” claimed thatthe attacks were in response to the low-budget anti-Islamic video “Innocence of Muslims”that stoked the ire of the Muslim world. 126 However, U.S. Senator Joseph Lieberman publicallydisagreed with this motivation, stating that he believed the attacks to be sponsored bythe Iranian government and executed in response to increased economic sanctions against theIslamic Republic. 127The attack on the American banks was not the only cyber operation in the fall of 2012 thatwere claimed by hackers on Pastebin and attributed to Iran. In August, the Saudi Arabian oilfirm Saudi Aramco revealed that it was a victim of a cyber attack that led to 30,000 of its workstationsbecoming disabled. The attack was the result of a piece of malware that erased themaster boot record (MBR) of the target systems which would cause them to be unable to startup. 128 The Master Boot Record is the first part of the hard drive that is accessed when aj Pastebin is a site used by hacker groups to post unattributed communication. Hackers from the groupAnonymous often use this site. We discuss this more in Chapter 6.