No Proof That Iran Is Behind U.S. Bank Attacks

A recent New York Times article reported that the U.S. government was convinced that the government of Iran was responsible for DDoS attacks against U.S. banks. No specific names of U.S. officials were mentioned which is troubling for several reasons:

1. Government policy makers and administration officials are generally not very astute about the complexities of cyber attacks, incident response, and attribution. 
2. The article's authors failed to interview any of the multiple cyber security experts who disagree with the sources quoted and/or referred to in the article.
3. The reasons given by the Times' sources didn't exclude other possibilities besides the government of Iran.

On the other hand, multiple informed, authoritative sources have expressed skepticism about these attacks being state-sponsored, let alone by Tehran. Here are two authorities who were quoted in this Mashable article "Is Iran Behind A Wave Of Cyber Attacks Against U.S. Banks?":

Roel Schouwenberg, senior researcher at Kaspersky Labs (which identified several recent cyberattacks against Iran), didn't confirm or deny the attacks' origins. However, he doesn't believe the attacks are so complicated they must be the work of a government. 

“We can confirm that the attacks being reported are happening; however, the malware being used, known as ItsOKNoProblemBro, is far from sophisticated," wrote Schouwenberg in an e-mail. "It's really rather simple. It’s also only one part of the puzzle but it seems to be effective, which is all that matters to the attackers. Going strictly by the publicly known technical details, we don't see enough evidence that would categorize this operation as something only a nation-state sponsored actor could pull off.” 

Claudio Guarnieri, security researcher at Rapid7, agreed the complexity of the attacks is "disputable" and doesn't necessarily mean a government is behind them. 

"The malicious code involved is effective but very simple," wrote Guarnieri. "The link with state-sponsored entities could be justified by the fact that there is no direct gain for the attackers besides the disruption of the targets' operations. However, considering that there is no obvious evidence and that it could potentially be the work of generic cybercriminals, it's hard to confirm it.”

Then there's Dancho Danchev's expertly written article "Dissecting 'Operation Ababil' - an OSINT Analysis" which cast doubt on who was actually behind Operation Ababil, my article "Fact-checking the Iranian DDoS Attacks Against US Banks", and Anthony Freed's article "Bank DDoS Attacks: Is it the Russian Mob, Iran, or a False Flag?"

The public statements made by this group sound more like an Anonymous operation than something run by paramilitary Basij members or the IRGC, who's responsible for Iran's offensive cyber operations. The group's announcement of an equation based on page views of the offending film to determine the duration of attacks against the banks is too clever by half to be an official strategy. And at least one announcement failed to use proper punctuation for the word "God" and "Prophet" when referring to Allah and Mohammad (the author used lower case "g" and "p" instead of capital letters):

"The table below shows the result of search for the movie that insulted the god, his prophet and Muslims:"

I can't imagine a devout Muslim forgetting to capitalize God or Prophet but remembering to capitalize Muslim. I can imagine that mistake being done by someone who was using religious outrage as a pretense to support a false flag operation with Iran as the victim.

Relations with Iran are already tense. What we don't need is an internationally respected newspaper like the New York Times adding fuel to the fire by putting their name behind a story that presents no evidence and no objective examination of the facts by actual authorities in threat research, forensics, and incident response. You guys can and should do a lot better.

Add to Cart View detail

Taia Global's Report On Huawei's Bank Loan Controversy

Yesterday, I wrote about a little-reported story of how Huawei is under investigation by Chinese authorities for allegedly abusing its employees' stock purchasing program to effectively generate bank loans without having to report them to the government. My post surprised Huawei US VP for Government Affairs William Plummer who wasn't aware of the scandal but in a private email to me, Mr. Plummer expressed skepticism on the accuracy of the report. Consequently I've tasked some of Taia Global's China experts (all native speakers) to take a deeper look at Huawei's employee incentive plan and how it impacts the company's debt ratio, which depending upon the math involved could go as high as 82% rather than the very low 61% figure provided in Mr. Plummer's Huawei Overview .ppt deck.

Taia Global's Report on Huawei's Bank Loan controversy

Internal financing has been part of Huawei’s employee incentive plan since the 1990s, but this program has become an indirect method for Huawei to borrow money from banks. According to a blog on Tianya, an online community for Chinese overseas, before 2007, the amount of internal stock allocated to each employee was based on the number of years the employee had served and the economic contribution the employee had made in the corresponding year.

Internal stock was one of the three key benefits for employees, in addition to salary and stock dividends.  In recent years, each employee was allowed to purchase a higher proportion of internal stock shares with 15% down payment, and the remainder was paid via bank loans borrowed at a 6% interest rate in the name of the employee, who must pay back at least 20% of the loan’s net value each year.  The down payment ratio was increased to 40% in 2010.  Although dividends were high, most were used to pay back loans for internal stock purchase.  If an employee left Huawei, the employee would only sell the stock share at the original purchase price, with no capital gain for such an internal investment. 



Huawei’s approach (which has been in place since at least 2000 and perhaps earlier) has two consequences.  First, Huawei, as the company entity, received borrowed money in its employees’ names and avoided having to identify it as debt on their balance sheet, which enabled the company to polish its financial performance.  A Chinese blogger –Kuai Dao Hong Qi, whose real name is Chen Hui Min陈惠民, an influential media professional – listed financial data from Huawei’s financial statement from 2008 to 2010.  According to his blog, in 2010, the debt ratio (debt in 105.6 billion yuan/ assets in 160.8 billion yuan) of Huawei was 66%, a little lower than 70%, the financial warning line.  If Huawei added back 11.4 billion yuan, the accumulated borrowed money through this employee incentive plan, the debt ratio would be 68% (adjust debt in 117 billion yuan/adjusted assets in 172.2 billion yuan).

Second, this plan is very risky for employees. In order to receive more dividends in the future, employees borrowed money to buy stock shares and then used received dividends to pay back loans, so they were giving up short-term benefits in pursuit of long-term rewards.  Their assumption is that Huawei will maintain high growth rates as they have had historically, which is not easy due to slow market expansion and high research expenses for exploring new business sectors.



Another potential and well-hidden problem about Huawei’s financial performance is the accelerated recognition of sales revenue. By 2010, Huawei had sold its account receivables of 84 billion yuan in total to banks so the company could recognize revenue quickly. However, Huawei is still liable for sustaining losses if banks fail to collect money back from Huawei’s clients. According to both Chinese and American accounting standards, this is a type of contingency and should be classified as debt. If Huawei also followed this rule, its adjusted debt ratio in 2010 would be 82%, much higher than the warning line of 70%.

No Chinese official media reports on Huawei’s financial issues, although some information can be found online. Meanwhile, according to a person working in Huawei, the employee incentive plan was approved by the Guangdong government, so most people inside Huawei do not think it is risky.

Add to Cart View detail