Washington: Iran may be waging an escalating campaign of cyber attacks against US companies in response to American actions perceived as hostile, according to a US senator and cybersecurity analysts.

Iran’s government and its elite Quds Force were probably responsible for cyber attacks launched last week against JPMorgan Chase & Co. and Bank of America Corp, Senator Joseph Lieberman said yesterday in an interview on C-SPAN’s “Newsmakers” programme.

“I don’t believe that these were just hackers,” Lieberman, an independent from Connecticut who’s chairman of the Homeland Security Committee, said in the interview scheduled to air tomorrow. “I think that this was done by Iran and the Quds Force, which has its own developing cyber attack capacity.”

The attacks may have come in response to US-led economic sanctions on Iran aimed at preventing it from developing the capability to build a nuclear weapon, said Lieberman, a sponsor of comprehensive cybersecurity legislation in the Senate. Iran also has accused the US and Israel of trying to sabotage the nuclear programme through a malware virus known as Stuxnet.

The US and Iran risk engaging in increasingly destructive exchanges of cyber attacks, according to Jacob Olcott, a principal at Good Harbor Consulting LLC in Arlington, Virginia.

“The problem with launching attacks is that you never know who’s going to hit back,” Olcott, who consults companies on cybersecurity risks, said yesterday in a telephone interview. “It shouldn’t be surprising because the Iranians are likely to want revenge against a country that they believe conducted an attack against them.”

‘Credible Intelligence’

The banking industry’s Financial Services Information Sharing and Analysis Center posted a warning on its website dated September 19 that cited “recent credible intelligence regarding” potential cyber attacks.

Patrick Linehan, a spokesman for New York-based JPMorgan, and Mark Pipitone, a spokesman for Charlotte, North Carolina-based Bank of America, declined to respond to inquiries about Lieberman’s comments. Also declining to comment were FBI spokesman Paul Bresson, White House National Security Council spokeswoman Caitlin Hayden and Department of Homeland Security spokesman Peter Boogaard.

Iran’s nuclear programme and oil facilities have been subject to a succession of cyber attacks that the country’s Foreign Ministry said in May were launched by hostile governments as part of a broader “soft war”. Iran has blamed the US and Israel.

Damaging centrifuges

In 2010, the malware virus Stuxnet damaged Iran’s computer systems and centrifuges used to enrich uranium.

This year, Iran said in May that it had produced a tool to combat a newly detected virus, known as Flame, that has been described as the most complex cyber menace to date.

In July, Iran’s nuclear facilities suffered a cyber attack that shut down computers and played music from the rock band AC/DC, according to the F-Secure Security Labs, which is linked to F-Secure Oyj, the Helsinki-based maker of security and cloud-computing software.

NBC News last week cited national security officials it didn’t identify as saying the Iranian government was behind “denial-of-service” attacks on US banks. Such attacks, which are intended to overwhelm a website by flooding it with requests, require only rudimentary computer-hacking skills.

“Cyberweapons are widely available and you don’t have to be overly sophisticated to cause harm,” Frank Cilluffo, director of George Washington University’s Homeland Security Policy Institute and a former special assistant to President George W. Bush for homeland security, said yesterday in a telephone interview.

‘Bad news’

“The good news is Iran is not at the level of sophistication of China, Russia, us and some of our allies,” Cilluffo said. “The bad news is what they lack in capability, they more than make up for in intent.”

US policy on whether cyber attacks should be considered an act of war and how to respond to them isn’t fully defined, Harold Koh, the State Department’s legal adviser said in a September 18 speech at the US Cyber Command in Maryland.

“Cyberspace is not a law-free zone where anyone can conduct hostile activities without rules or restraint,” Koh said. He said a country has a right to defend itself in response to a computer assault that it considers to be on a par with an armed attack or represents an imminent threat.

“Because of the interconnected, interoperable nature of cyberspace, operations targeting networked information infrastructures in one country may create effects in another country,” he said. “Whenever a state contemplates conducting activities in cyberspace, the sovereignty of other states needs to be considered.”