Late last week in a formal press statement, Alfa Bank, a privately owned Russian bank, disclosed that it was subjected to three recent cyberattack attempts on its servers made to appear that it was communicating with the Trump Organization. According to Alfa Bank, “In the attacks, multiple domain name server DNS requests were made by unidentified individuals, mostly using U.S. server providers, to a Trump Organization server. The DNS requests were made to appear as if they originated from Alfa Bank. The DNS responses from the Trump server were then erroneously returned to Alfa Bank, activating Alfa Bank’s automated security systems on February 18 and again on March 11 and 13.”
Alfa Bank’s believes these attacks are being launched from a botnet resulting in “more than 1,340 DNS responses containing mail.trump-email.com.moscow.alfaintra.net”, and that these attacks were created to give the false impression that Alfa Bank has a secretive relationship with the Trump Organization. Mark McArdle, CTO at Cyber Security Company eSentire commented below.
Mark McArdle, CTO at Cyber Security Company eSentire:
Spoofing DNS lookups is not very difficult, since DNS is not authenticated, and the ability to spoof source addresses is unfortunately still available – all you need is a system to launch your attack from that is connected to the Internet via an ISP that doesn’t filter out spoofed source addresses. While this type of attack has been around for a while, what’s new in this case is that someone is using it to try and contrive evidence of a relationship where neither party sought one.
Additionally, there is also reference in Alfa Bank’s statement about Spam messages from marketing@trumphotels.com. It’s also possible to spoof email (spammers do this all the time). A spoofed email could include a reference to a legitimate Trump Org server and a real connection would be established if a user clicked on it (or selected “show images” in the email). Again, this does not mean the email came from Trump Org, just that it was sent in order to attempt to solicit “a connection” between Trump Org and Alfa-Bank.”
The opinions expressed in this post belongs to the individual contributors and do not necessarily reflect the views of Information Security Buzz.