Back to 07-129 homepage


Dr Ryan – Security







Qatar National Bank


What did attackers break into?

The attackers broke into QNB's databases and were able to download 1.6 GB of data. Leaked documents include the bank details, telephone numbers and dates of birth of several journalists from Al-Jazeera, supposed members of the ruling Al-Thani family, and government officials


How did the attackers break into it?

According to CyBureau.org "The attack was executed by penetration to the Bank’s database using SQL Injections as a result of a weakness in the online banking application, which resulted in penetration to the internal systems of the bank, together with the lack of encryption in the database."


Oddly enough, it was estimated that the hackers had access to the accounts for more than 200 days, and were only discovered when they released the information to social media.


Who was impacted?

When the breach was first discovered, many clients of QNB assumed they were impacted and decided to take proactive measures. After the details arose, it was discovered that the bank-details, contact information, dates of births and other sensitive data of just a select group was exposed.


How was it investigated?

QNB brought third party validators to ensure that all their clients' details are secure, and also ensured that the vulnerabilities were patched.

RasGas


What did attackers break into?

According to wired.com, RasGas was hit with "a virus that shut down its website and e-mail servers, according to news reports. The malware, however, did not affect the company's operational computers that control the production and delivery of gas, an official of the Ras Laffan Liquefied Natural Gas company told Bloomberg."


How did the attackers break into it?

The attackers managed to install malware onto the computers in RasGas. This malware, called Shamoon, then propagated throughout the RasGas network and infiltrated thousands of computers.


Who was impacted?

Many thousands of computers were impacted. Mail servers shut down, internet access was disabled, and employee's couldn't access the intranets inside of RasGas. Shamoon also deleted files and repeatably replaced them with images of burning US Flags.


How was it investigated?

This attack wasn't just unique to RasGas. Some 30,000 Saudi Aramco computers were also impacted. The investigation of Shamoon was widespread, and companies such as McAfee and Kaspersky Lab examined and reported on the malware.