Slashdot Mirror
Hackers Steal $6.7M In Bank Cyber Heist
Orome1 writes "A perfectly planned and coordinated bank robbery was executed during the first three days of the new year in Johannesburg, and left the targeted South African Postbank — part of the nation's Post Office service — with a loss of some $6.7 million. The cyber gang behind the heist was obviously very well informed about the post office's IT systems, and began preparing the ground for the heist a few months before, by opening accounts in post offices across the country and compromising an employee computer in the Rustenburg Post Office."
It's not whether you can get into a bank, or even out of it, it's how long you can keep the money.
It will teach them to not have so many holidays I hope!
"Hey, can I check my Facebook real quick?"
He only expects further trolling, which has been granted.
When the foot seeks the place of the head, the line is crossed. Know your place. Keep your place. Be a shoe.
I was part of a small team that described a pretty similar attack scenario to a customer almost 10 years back. It is no surprise at all that this worked and it would work in a lot of other places as well. The only really tricky part is coordinating the mules (and keeping them quiet) as you do not know how much money is available at each specific ATM. But you can guess by observing usage patterns (counting customers) and how often they are re-stocked.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
42m Rand is not 6.7m USD, it is more like 5.2m.
Wall Street CEO's have been stealing much larger amounts from their own banks for years.
I'm much more surprised by the fact that they managed to take about 1% of the entire assets of the wanna-be bank. That's pretty disturbing - because that means that nothing was working right. Not their security, not their required privileges, not their fraud detection, nothing. Note to self: don't do business in SA.
Those who can, do. Those who can't, sue.
Not to be pedantic, but "devil dogs" is a nickname for the United States Marines.
Politicians have been stealing much larger amounts for years.
No brain, no pain.
I could understand the mass media using the word "hackers" here but /. should know better. These guys are just bank robbers and we dont differentiate between bank robbers who use handguns vs those with knives vs those who claim to have a bomb strapped to them.
How could an investigation rule out a possible inside job?
In Soviet Russia, inside job rules out possible investigation.
My very wealthy American uncle, who was the American consulate attache to Guyana, recently passed away. While we are very sad for his passing, he has left a great fortune in the Bank of Amerika that, unfortunately, cannot be transferred back to Guyana without completing the probate process. Since my wealthy American Uncle (Sam was his name) was too big to fail (er I mean die), I stand to inherit a great deal of wealth. I will gladly share with you this windfall at the Bank of Guyana if you will help me complete the probate. If you will kindly Paypal 52m Rand to help defray the cost of the probate, I will in turn send you 52billion US dollars. Please respond in confidence to my email address: Angelo.Mozilo@Countrywide.com.
And to back it up
....$telnet www.postbank.co.za 80
....
Trying 165.8.13.24...
Connected to www.postbank.co.za.
Escape character is '^]'.
GET / HTTP/1.0
HTTP/1.1 404 Not Found
Content-Length: 1635
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Wed, 18 Jan 2012 03:35:38 GMT
Connection: close
The page cannot be found
Anybody running windows on their website is highly likely running it inside.
I prefer the "u" in honour as it seems to be missing these days.
Didn't you hear? Everyone else on the internet is just one big fat guy.
Bio questions? Ask me to start a Q&A journal. Computer analogies available for most topics!
Wow, I wish I had mod points so I could mod parent "Flamebait."
When will idiots understand that windows is the best friends of terrorist and criminals?
With an opening statement like that, all the following dialogue is rendered irrelevant.
I do this with my web servers. Make them report as if they were IIS while it's really apache or lighttpd.
im guessing that the main reason it seems like an 'unusual south africa thing' is because US banks never, ever talk about this kind of thing.
partly out of embarassment, partly because the entire system is based on 'security through obscurity'.
----
of course, oblig. comment about how thousands of US banks failed in 2008/9/10 due to the CDO fraud system - which directly involved and benefited the ratings agencies. but its almost like nobody cares about that. they care about 5 million stolen from ATMs, but not about 2 trillion stolen from the taxpayers.
The whole book is this heist.
Literally.
Just check out the summary.
The thing that makes this book series special is that they don't say, "I ran nmap and knew from the output they were running a webserver."
They say "I ran nmap with 'sudo nmap -P0 -T3 -p 80 127.0.0.1 -oA localscan'
And got:
Starting Nmap 5.21 ( http://nmap.org/ ) at 2012-01-17 20:55 PST Nmap scan report for localhost (127.0.0.1) Host is up (0.000083s latency). PORT STATE SERVICE 80/tcp open http Nmap done: 1 IP address (1 host up) scanned in 0.07 seconds And could see from the line "80/tcp open http"
http://www.amazon.com/Stealing-Network-How-Own-Continent/dp/1931836051
"Chinese Amazons, power armor, laser swords.... things just meant to be." - Shampoo, A Very Scary Bet
The correct conclusion is that incompetent governments should not be involved in banking.
But incompetent corporations should?
I do this with my web servers. Make them report as if they were IIS while it's really apache or lighttpd.
I do this too... and then check my logs for attempted exploits which I can use against real IIS and ASP sites...
Asked if there were concerns about the risk the security breach posed to government departments using the Trust Centre hosted by the post office...
If that's what I think it is, look forward to another wave of MITM-facilitating rogue certificates, this time from South Africa...
, Pule said: "The centre has high security parameters to protect all the services delivered through it."
oh, after that much buzz-word laden alphabet soup, I feel so much better. Hopefully their flux capacitors are fully charged or else there high security parameters might unload.
I'm much more surprised by the fact that they managed to take about 1% of the entire assets of the wanna-be bank.
At least, that means that their ATMs were well-stocked for the long New Years' break. Around here they'd have run out of money on the second day...
Are they sure it wasn't just a penny rounding scheme gone terribly awry?
Monstar L
Is this the one where George sets up a house to be tilted, no wait, that was the second? .....
Oh yeah, ok, they rent a whole bunch of small mini coopers and.....nope...
Ok, I got it....she has to go under all the infrareds and slowly stealth her way through to the
Ok, nevermind, I think I am overloaded as it is...movin on....nothin I want to see here.
I agree that running windows on IIS does not mean that all of their inside processes are on windows. However, as a contractor, I have seen that if a company runs non-windows on their front-end, than their back end is most likely close to 100% non-windows with the possible exception of desktops. But even those will be locked down fairly tightly.
But, when companies run IIS on the front-end, then their process servers will very likely be heavily into windows. Their DB may actually be oracle on sun, mainframe, or something else. However, what is important, are the desktops or process servers since they are normally the cracked items.
I prefer the "u" in honour as it seems to be missing these days.
It didn't:
http://inaudit.com/audit/it-audit/online-theft-that-sucked-13m-from-financial-firm-in-florida-unmasked-9888/
This was in Florida last year.