FBI briefs US bank executives on wave of cyberattacks

The FBI has reportedly briefed US bank executives on a wave of cyberattacks that have lashed the industry since last summer as part of a new policy designed to foster co-operation between the state and private sectors.

According to comments made at a Reuters event by FBI executive assistant director Richard McFeely, the Bureau had carried out a large videoconference with dozens of bank heads across the US last month to urge them to share data on the attacks they are experiencing.

In the past the organisation had conducted its investigations without keeping victim firms – in this case banks – informed, he admitted.

“That’s 180 degrees from where we are now,” Reuters reported him as saying of the FBI’s change of approach.

For their part, many private sector organisations were still reluctant to offer up attack data, probably because they saw little tangible point in doing so.

Exactly what McFeely told the bank bosses about the attacks is still confidential.

He refused to be drawn on their origin but sources close to US officials have previously privately accused Iran of being behind them as part of a low-key cyberwar that probably represents retaliation for the US’s unleashing of a clutch of Stuxnetlike cyberweapons against Iran since 2007.

Malware is said to have been involved in the recent attacks although the most obvious evidence has been the waves of large and sophisticated realtime DDoS attacks battering customer-facing bank websites.

These started last summer and have spiked at intervals ever since with a peak in January. One public ‘campaigning’ face of these attacks is the Izz ad-Din al-Qassam Cyber Fighters hacker group which is seen as being half Iranian Anonymous and half an arm of the Iranian State.

For its part Iran has also fired back accusations that it nuclear programme is still under attack even in the post-Stuxnet period.

To many in the security industry the two-way exchange is nothing less than the first sustained cyberwar between two states, neither of which is yet prepared to admit as much.

That could turn out to be an unexpected feature of early cyberwar – its invisbility.