The government’s computer emergency team, BGD e-GOV CIRT, issued a national cybersecurity alert on Friday. Its trigger is a post: on 31 July a hacker group announced that a “storm of cyber attacks” would hit Bangladesh’s cyberspace on 15 August. The group calls itself hacktivist, claims to be Indian, and names Bangladesh and Pakistan as its targets. CIRT’s alert, signed by project director Mohammad Saiful Alam Khan, tells banks and financial institutions, health services, critical information infrastructure and all government and private organisations to expect attacks and prepare.
What they have done so far
CIRT says its research has identified several groups of the same ideology that attack Bangladeshi organisations continuously, and it lists recent claims: on 1 August a group claimed attacks on a payment gateway, a law-enforcement agency and the banking sector; on 3 July a group claimed a one-hour DDoS attack on a transport service; on 27 June a government college’s website was defaced, with a sample published; and on 24 June the same was done to a health-sector site. This is the pattern of the “hacktivist” groups that have traded attacks across the India–Bangladesh–Pakistan triangle for years: defacements, denial-of-service floods, and claims that are larger than the damage.
What CIRT recommends
- Monitor network infrastructure 24 hours, especially outside office hours, and watch for data being moved out.
- Put a web application firewall in front of incoming HTTP/HTTPS traffic to filter malicious requests and patterns.
- Secure DNS, NTP and network middleboxes, which are used to amplify DDoS attacks.
- Validate all user input on web applications.
- Keep backups of websites.
- Enforce HTTPS with SSL/TLS.
- Run up-to-date software.
- Report anything suspicious to CIRT.
What is actually at risk
Two things should be said plainly. First, the threat is real and the date is a symbolic one — the anniversary of the 1975 assassination and India’s Independence Day — which is exactly the kind of date such groups pick. Second, the realistic damage from groups of this kind is embarrassment: defaced pages on government sites that have not been patched since they were built, and an hour or two of downtime on services that lack DDoS protection. The systems that would cause real harm if breached — the interbank network, mobile money, the power grid’s control systems — are not the ones a hacktivist crew reaches with a defacement kit. The alert’s value is that it makes a thousand IT managers apply the updates they have been postponing, which defends against the serious attackers as well as the loud ones.
How these announced operations usually go
Pre-announced hacktivist campaigns follow a recognisable script, and knowing it is the best defence against both complacency and panic.
What usually materialises is website defacement of small, poorly maintained sites, short DDoS floods against a handful of visible government domains, and the recycling of old leaked data presented as a fresh breach. What almost never materialises is the thing the announcement implies: coordinated penetration of banking or payment infrastructure, which is hard, slow and not the sort of thing a group announces three weeks in advance.
The real damage from a campaign like this is usually reputational and self-inflicted — an organisation that was warned, did nothing, and then had its homepage replaced. Patching, offline backups and knowing who to call remain the whole answer, and they are worth doing regardless of what any group announces.
Update: 15 August passed with a handful of DDoS attempts and defacements of minor sites reported; CIRT reported no breach of critical systems.
