This article is from the source 'guardian' and was first published or seen on . It last changed over 40 days ago and won't be checked again for changes.

You can find the current article at its original source at http://www.theguardian.com/world/2016/mar/24/us-charges-iranian-hackers-cyber-attacks-banks

The article has changed 2 times. There is an RSS feed of changes available.

Version 0 Version 1
US charges seven Iranian hackers over cyber-attacks on banks US charges seven Iranian hackers over cyber-attacks on banks
(about 3 hours later)
The US Department of Justice has unsealed charges against seven Iranian hackers with disrupting computer systems at American banks and a small dam north of New York between 2011 and 2013, accusing the men of working on behalf of the Iranian government. The US Department of Justice has unsealed an indictment against seven Iranian hackers, charging them with disrupting computer systems at American banks and a small dam north of New York between 2011 and 2013, accusing the men of working on behalf of the Iranian government.
The allegations mark a shift in US-Iranian relations after a relative detente as the two countries negotiated a nuclear treaty. News reports have long linked the attacks to the Islamic Republic, and though the indictment against the men has been sitting on Justice Department shelves for more than a year it was unsealed partly due to congressional pressure, people familiar with the case said.The allegations mark a shift in US-Iranian relations after a relative detente as the two countries negotiated a nuclear treaty. News reports have long linked the attacks to the Islamic Republic, and though the indictment against the men has been sitting on Justice Department shelves for more than a year it was unsealed partly due to congressional pressure, people familiar with the case said.
But on Thursday, US attorney general Loretta Lynch became the first law enforcement official to accuse specific Iranians of engaging in cyber-attacks against US infrastructure. She blamed the men, linked to two Iranian technology companies, for blocking access to 46 US financial institution websites, including those of PNC, Bank of America, the New York Stock Exchange and Capital One.But on Thursday, US attorney general Loretta Lynch became the first law enforcement official to accuse specific Iranians of engaging in cyber-attacks against US infrastructure. She blamed the men, linked to two Iranian technology companies, for blocking access to 46 US financial institution websites, including those of PNC, Bank of America, the New York Stock Exchange and Capital One.
The accused include Ahmad Fathi, Hamid Firoozi, Amin Shokohi, Sadegh Ahmadzadegan, Omid Ghaffarinia, Sina Keissar and Nader Saedi, who went by the name “Turk Server” online. They worked for two companies: ITSec Team and Mersad Co.The accused include Ahmad Fathi, Hamid Firoozi, Amin Shokohi, Sadegh Ahmadzadegan, Omid Ghaffarinia, Sina Keissar and Nader Saedi, who went by the name “Turk Server” online. They worked for two companies: ITSec Team and Mersad Co.
The bank attacks relied on bombarding the websites with useless traffic from drone computers, sometimes making it impossible for customers to access the sites.The bank attacks relied on bombarding the websites with useless traffic from drone computers, sometimes making it impossible for customers to access the sites.
So-called denial of service attacks are the equivalent of a telephone’s busy signal on the internet. Lynch said remediating the attacks cost the banks tens of millions of dollars.So-called denial of service attacks are the equivalent of a telephone’s busy signal on the internet. Lynch said remediating the attacks cost the banks tens of millions of dollars.
The disruptions have since stopped, but at the time were considered a major escalation in a low-grade cyberwar between the US and Iran. Americans started the conflict early in the Obama presidency when they used a sophisticated computer worm, called Stuxnet, to disrupt an Iranian nuclear reactor.The disruptions have since stopped, but at the time were considered a major escalation in a low-grade cyberwar between the US and Iran. Americans started the conflict early in the Obama presidency when they used a sophisticated computer worm, called Stuxnet, to disrupt an Iranian nuclear reactor.
US officials became especially alarmed in 2013 when they found the bank hackers inside the control system of a small dam outside New York City. US investigators had been tracking the computers of the hackers and noticed they were accessing systems linked to the Bowman Dam in Rye, New York.US officials became especially alarmed in 2013 when they found the bank hackers inside the control system of a small dam outside New York City. US investigators had been tracking the computers of the hackers and noticed they were accessing systems linked to the Bowman Dam in Rye, New York.
The target, at the time, seemed odd. The dam plays no key significance in US waterways. At one point, US officials concluded the Iranians had stumbled into the dam’s systems and may have thought they were accessing the Arthur R Bowman Dam in Oregon, a much larger structure that irrigates local agriculture and prevents flooding in Prineville, Oregon.The target, at the time, seemed odd. The dam plays no key significance in US waterways. At one point, US officials concluded the Iranians had stumbled into the dam’s systems and may have thought they were accessing the Arthur R Bowman Dam in Oregon, a much larger structure that irrigates local agriculture and prevents flooding in Prineville, Oregon.
Nevertheless, the intrusion put Washington on alert because it showed Iran was capable of hacking into infrastructure control systems. Contemporary dams, power plants and drawbridges are all connected to the internet, which makes them easier to control but can also become targets for hackers if unprotected.Nevertheless, the intrusion put Washington on alert because it showed Iran was capable of hacking into infrastructure control systems. Contemporary dams, power plants and drawbridges are all connected to the internet, which makes them easier to control but can also become targets for hackers if unprotected.
In this case, the Bowman dam’s system was protected with a password consisting of a repeating single digit, people familiar with the investigation said.In this case, the Bowman dam’s system was protected with a password consisting of a repeating single digit, people familiar with the investigation said.
After the investigation, US investigators were discouraged from charging the Iranians as the US tried to negotiate a treaty governing the country’s nuclear program. In recent years, cyber-attacks like these from Iran have been less common, US officials said.After the investigation, US investigators were discouraged from charging the Iranians as the US tried to negotiate a treaty governing the country’s nuclear program. In recent years, cyber-attacks like these from Iran have been less common, US officials said.
They decided to make the indictment public after the Bowman incident was disclosed in a December Wall Street Journal article. The story enraged US senator Chuck Schumer, an influential Democrat from New York, sources said.They decided to make the indictment public after the Bowman incident was disclosed in a December Wall Street Journal article. The story enraged US senator Chuck Schumer, an influential Democrat from New York, sources said.
“We bring a case when it’s right to bring a case,” said US attorney Preet Bharara of the southern district of New York, whose office brought the indictment, during a press conference on Thursday.“We bring a case when it’s right to bring a case,” said US attorney Preet Bharara of the southern district of New York, whose office brought the indictment, during a press conference on Thursday.
Because the accused are in Iran, it is unlikely they will ever appear in an American court. Despite that, FBI director James Comey cautioned reporters Thursday to “never say never”.Because the accused are in Iran, it is unlikely they will ever appear in an American court. Despite that, FBI director James Comey cautioned reporters Thursday to “never say never”.
“The world is small and our memories are long,” Comey said, adding its possible one of the defendants may travel for vacation or education to a country more friendly to the US. “We want them looking over their shoulder.”“The world is small and our memories are long,” Comey said, adding its possible one of the defendants may travel for vacation or education to a country more friendly to the US. “We want them looking over their shoulder.”
Most of the men remain unknown in the Persian cyberspace, although the identities of a few were previously revealed online. Ahmadzadegan, aka Nitr0jen26, is described as the founder of Mersad by the website Roshangarane Asr, which was set up specifically to reveal the identities of those collaborating with Iran’s cyber army.Most of the men remain unknown in the Persian cyberspace, although the identities of a few were previously revealed online. Ahmadzadegan, aka Nitr0jen26, is described as the founder of Mersad by the website Roshangarane Asr, which was set up specifically to reveal the identities of those collaborating with Iran’s cyber army.
According to the website, Ahmadzadegan is a founding member of Ashiyaneh, a group of Iranian hackers believed to make up the bulk of the Islamic Republic’s cyber army.According to the website, Ahmadzadegan is a founding member of Ashiyaneh, a group of Iranian hackers believed to make up the bulk of the Islamic Republic’s cyber army.
Ashiayneh is run by Behrouz Kamalian, who is not indicted, but has publicly boasted about the activities of his group. Iranian semi-official state news agencies have extensively reported about Kamalian and Ashiayneh, which is believed to have previously carried out cyber-attacks on foreign films, including a Danish website carrying the caricature of the Prophet Muhammad.Ashiayneh is run by Behrouz Kamalian, who is not indicted, but has publicly boasted about the activities of his group. Iranian semi-official state news agencies have extensively reported about Kamalian and Ashiayneh, which is believed to have previously carried out cyber-attacks on foreign films, including a Danish website carrying the caricature of the Prophet Muhammad.
“In protest at the supporters of terrorism, especially the US and Britain, we have resorted to new ways to confront them to prove to the world that we always stand by the oppressed people and their rights,” Kamalian is quoted as saying by local agencies.“In protest at the supporters of terrorism, especially the US and Britain, we have resorted to new ways to confront them to prove to the world that we always stand by the oppressed people and their rights,” Kamalian is quoted as saying by local agencies.