Warnings Ratchet Over Iranian Cyberattack

Warnings about Iranian hacking following the United States’ Saturday bombing of Iranian nuclear weapon development sites ratcheted sharply upward even after weeks of admonitions that Iran could respond to ongoing missile strikes with virtual assaults.

See Also: OnDemand | North Korea’s Secret IT Army and How to Combat It

Iran responded Monday to American targeting of nuclear sites at Fordow, Isfahan and Natanz with bunker-busting munitions by lobbing missiles at U.S. forces at Al Udeid Air Base in Qatar in a failed attack. Iranian officials quoted by the New York Times said Qatar received advance notice of the missile launch, making the attack more symbolic than harmful. The U.S. bombing came after Israel initiated on June 13 a shooting conflict with Tehran by attacking military sites. Real-life munitions easily trump hacking as a method of real-life destruction, but cyber defenders say the possibility of digital retaliation shouldn’t be overlooked (see: Israeli Strikes Raise Fears of Cyberattacks and Retaliation).

The Department of Homeland Security warned Sunday that conflict between Israel and Iran brings a “possibility of increased threat to the homeland in the form of possible cyberattacks, acts of violence and anti-Semitic hate crimes.”

Former U.S. Cybersecurity and Infrastructure Security Agency head Jen Easterly advised critical infrastructure operators in a Sunday LinkedIn post to protect system with multifactor authentication and ensure systems are up-to-date on patches. “Iran has a track record of retaliatory cyber operations targeting civilian infrastructure, including: water systems; financial institutions; energy pipelines; government networks and more,” she said (see: Beware the CyberAv3ngers).

How much Iran can truly wreak damage on American infrastructure is an open question. “Iran has had mixed results with disruptive cyberattacks and they frequently fabricate and exaggerate their effects in an effort to boost their psychological impact,” said John Hulquist, chief analyst at Google-owned threat intel firm Mandiant.

As far as nation-state hackers go, Iran is second tier and relies heavily on social engineering, password spraying and multifactor push bombing to penetrate systems. But it wields those tools effectively – and has shown some signs of sophistication, as in the development of custom malware targeting fuel management systems made by U.S. firm Gilbarco Veeder-Root (see: Researchers: Iranian Custom Malware Targets Fuel Systems).

Iranian hackers will almost certainly attempt to penetrate U.S. critical infrastructure, said Ryan Sherstobitoff, ScurityScorecard field chief threat intelligence officer. Whether they do so – and whether they’re then able to do anything dangerous – is a different matter, Sherstobitoff told Information Security Media Group.

Iranian hackers might even post screenshots of an operational technology system with the intent of getting “on the nerves of people who aren’t that educated on cyber,” he said. “It’s a show of force – ‘Hey, we did this here, we could go further, turn off your power,’ even though that may not even be possible.”

Online Iranian proxies and aligned hacktivists are already heavily invested in the psychological dimension of hacking, having ramped up significantly online chatter over the past few days.

A Shia hacking group operating in Iraq called 313 Team claimed to have crashed “U.S. ‘sident Donald Trump’s Truth Social network shortly after the ‘sident announced the bombing.” It also said it stole thousands of records containing information about visitors and athletes from Saudi Games, a major sports event in Saudi Arabia. Iranian-aligned groups additionally claimed to have temporarily disrupted internet service in Israel and the United States following the Saturday bombing.

“Probably 2% to 5% is actually real. The rest of it is psychological propaganda,” Sherstobitoff said.

Iran’s propensity for exaggerating its cyber prowess doesn’t mean cyber defenders should relax. Unpatched software and firmware, admin panels exposed to the internet, weak credentials and systems lacking multifactor authentication all offer opportunities for hacking. And, cautioned Sherstobitoff, the worst may be yet to come. Iranian hackers in the past have deployed wipers to destructive effect. Another similar attack could be in the making. “If we were to see a wiper like Shamoon, we’d probably seen it a month later. It’s not an overnight process,” he said.