Cyberwarfare / Nation-State Attacks , Fraud Management & Cybercrime , Multi-factor & Risk-based Authentication

DHS: Conflict With Iran Could Spur 'Wiper' Attacks

US Reportedly Responded to Drone Downing With Cyber Strike
DHS: Conflict With Iran Could Spur 'Wiper' Attacks
The U.S. Department of Homeland Security's building in Washington (Source: Wikipedia/CC)

Iran is increasing its malicious cyber activity against the U.S, which could manifest in "wiper" attacks that render computers unusable, a top U.S. cybersecurity official said on Sunday.

See Also: Webinar | Passwords: Here Today, Gone Tomorrow? Be Careful What You Wish For.

As a result, U.S. institutions should shore up their basic cybersecurity defenses, including using multifactor authentication, said Christopher C. Krebs, director of the Department of Homeland Security's Cybersecurity and Infrastructure Agency.

"Iranian regime actors and proxies are increasingly using destructive 'wiper' attacks, looking to do much more than just steal data and money," Krebs said. "These efforts are often enabled through common tactics like spear phishing, password spraying and credential stuffing. What might start as an account compromise where you think you might just lose data can quickly become a situation where you've lost your whole network."

One of the most devastating wiper attacks occurred against the oil giant Saudi Aramco in 2012. The malware, called Shamoon, disabled tens of thousands of workstations. U.S. officials blamed Iran for the attack.

Krebs' warning comes as tension between the U.S. and Iran has risen, both in the cyber and physical realms. Last year, President Donald Trump nixed an Obama-era agreement with Iran intended to curb its development of nuclear weapons. He also reinstated sanctions.

Earlier this month, the U.S. accused Iran of planting magnetic mines that damaged commercial Japanese and Norwegian shipping vessels sailing in the Persian Gulf. Then on Thursday, Iran fired a surface-to-air missile that destroyed an unmanned U.S. Global Hawk surveillance drone flying near the Strait of Hormuz.

Iran claims the drone was in its territory, although the U.S says it flew over international waters. Iran says it held off firing on a U.S. P-8 surveillance plane, which it claimed also entered its airspace.

The White House says it prepared a kinetic response to Iran's downing of the drone. But President Donald Trump reportedly called off the strike after learning it could kill up to 150 people. Trump said the response wouldn't be proportionate.

Report: US Digital Strike

But on Saturday, Yahoo News reported that the U.S. Cyber Command launched a retaliatory digital strike on an Iranian spy group that aided with the mine attacks.

The Washington Post subsequently reported that the attacks disabled the command-and-control systems Iran uses to control rocket and missile launches. The strike was aimed at the Islamic Revolutionary Guard Corps, which is part of Iran's military and which the U.S. designates as being a foreign terrorist organization.

Yahoo News reports that Iran is also capable of interfering with GPS navigation systems in drones and possibly ships. In 2011, Iran said it captured an RQ-170 Sentinel drone, which looks like a giant, flying wing, after a cyber operation.

Thomas Rid, a professor of strategic studies at Johns Hopkins University, writes on Twitter that there could be more to the Yahoo News story related to potential U.S. ship hacking.

"Big ships are hackable swimming networks - many connected devices, very bored users, little open pen-testing, likely change-averse admins, likely bad patching, likely bad air-gapping on the water, even navigation and other control systems likely hooked up to legacy boxes," he writes.

Formidable Hacking Power

Cybersecurity companies and the U.S. government have warned for years that Iran is a capable offensive operator.

The U.S. National Counterintelligence and Security Center put Iran in a basket of three countries - including China and Russia - that it labels as being "the most capable and active cyber actors tied to economic espionage and the potential theft of U.S. trade secrets and proprietary information."

In February, the Justice Department announced the indictment of four Iranians along with a former U.S. Air Force counterintelligence agent. The former servicewoman, Monica Witt, defected to Iran in 2013 (see: US Air Force Veteran Charged in Iran Hacking Scheme).

Part of the FBI's wanted poster for Monica Witt, a former U.S. Air Force counterintelligence agent who is accused of aiding Iran with hacking

Witt is accused of aiding the Iranians in phishing campaigns by developing target packages, or batches of information that could be useful for social engineering victims. The campaigns sought to compromise the computers of U.S. intelligence agents.

Also on the Iran front, DHS issued an urgent warning in January over attacks that sought to modify domain name system records. Modifying those DNS records can allow for a range of attacks, including collecting account credentials and redirecting email traffic (see: DHS Issues More Urgent Warning on DNS Hijacking).

The computer security company FireEye wrote at the time that whoever was behind the DNS attack appeared to have a "nexus to Iran" based on older attack data. DHS gave government agencies 10 days to ensure their DNS settings were correct and that they'd enabled two-step verification on all accounts used to control DNS settings.


About the Author

Jeremy Kirk

Jeremy Kirk

Managing Editor, Security and Technology, ISMG

Kirk is a veteran journalist who has reported from more than a dozen countries. Based in Sydney, he is Managing Editor for Security and Technology for Information Security Media Group. Prior to ISMG, he worked from London and Sydney covering computer security and privacy for International Data Group. Further back, he covered military affairs from Seoul, South Korea, and general assignment news for his hometown paper in Illinois.




Around the Network

Our website uses cookies. Cookies enable us to provide the best experience possible and help us understand how visitors use our website. By browsing govinfosecurity.com, you agree to our use of cookies.