Slashdot Mirror
Three Banks Lose Millions After Wire Transfer Switches Hacked
mask.of.sanity writes "Criminals have stolen millions from three unnamed U.S. banks by launching slow and stealthy denial of service attacks as a distraction before attacking wire payment switches. The switches manage and execute wire transfers and could have coughed up much more cash should the attackers have pressed on. RSA researcher Limor Kessem said, 'The service portal is down, the bank is losing money and reliability, and the security team is juggling the priorities of what to fix first. That's when the switch attack – which is very rare because those systems are not easily compromised [and require] high-privilege level in a more advanced persistent threat style case – takes place.'"
I like stories like this. If something is done really well and in a clever way (whether it was really being naughty or not) the effort, cleverness and ingenuity should indeed have its merits praised. Slashdot should have more stories like this: Hey, they did a bad thing, but look at just how WELL they did it.
Moved to http://soylentnews.org/. You are invited to join us too!
slow and stealthy denial of service attacks
I don't think a DOS can be stealthy......if it's denying service, are people going to notice?
"First they came for the slanderers and i said nothing."
No guns, no foul.
I must be missing something -- did these people transfer it to an account then go withdraw millions in cash quickly? Or did it take months for it to be discovered?
I can't conceive of any other way that would insulate against a reversal, no matter how many accounts and banks around the world they forwarded it to. Even Swiss banks go along with obvious criminality investigations nowadays.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
Ok, where's the dude who's done decades of banking work who will tell us all why this was inevitable?
I hope to see much more of this.
In reality, criminals and spies don't use high-tech equipment to break-in to facilities. They use inside knowledge, which this sounds like. Although it required a highly educated criminal to use it. I think this is the price of a well-trained work-force that is slowly down-sized. Hasn't a lot of the previous 12 months been about the lack of built-in security in networked devices? Both deliberate omission and that driven by penny-pinching.
..will just use this as an excuse to hold your money even longer. Thanks Obama.
You can put authorization codes in transactions, but if they aren't digitally signed, you can alter them in transit. Maybe banks should start exchanging signing keys and not transfer authorization codes?
I was promised a flying car. Where is my flying car?
The bottom line is that we need to harden up our defences more and more. We may even have to disconnect essential financial infrastructure from the internet and bring it back onto a completely private network that it costs a substantial amount of money to join and be authenticated to. It should come with the proviso that any device connecting to it, could also not be connected to the internet or an unknown intranet device at the same time. This would not be bulletproof, but it would substantially reduce the risk.
Meus subcriptio est nocens Latin quoniam bardus populus reputo is sanus callidus
Crooks robbing crooks...
You would be amazed - or maybe shocked - to see some of the banking systems out there. I have worked for several financial institutions and their systems are usually very very old legacy crap stuck together with bubble gum and faith. One place was dealing with 70% of the countries financial messaging and they were not using transactions, if there was a problem (and there often was) messages were lost. Asked if I could change it to use transactions, couple lines here, couple lines there.
NO.
Why?
Cost to test would involve the entire country and would cost millions.
OK.
So they are still losing messages.
There are three kinds of falsehood: the first is a 'fib,' the second is a downright lie, and the third is statistics.
I do not think these banking attacks are significant from a global economic-financial point of view. Else the NSA, GCHQ and Unit 8200 would be hunting down the perpetrators and either turning them or hanging them in Haifa.
Even if the perps are russians, the USAF/CIA could just as easily execute missile strikes with drones to take them out. The russian air defence is like cheese, full of holes, especially in the Far East. Hacker havens like the Baltics or Moldavia (part of ex-USSR) effectively have no air defence or even radar coverage. The chinese hackers should also be culled to teach PRC a lesson about who is boss.
I am pretty convinced the entire cybercrime and malware phenomenon could be ended in under 24 hours by extrajudically exterminating less than 1000 VXer people in drone strikes. One must wonder why this isn't done? But of course antivirus companies would also cease to exist without a protection market.
Why has there not been any information as to which banks were involved. That's kind of important. regardless if this directly impacts a customer or not I would like to know if it was my bank...
These banks run the crappiest OS and security systems. Then when they are cracked, they do not want it known who they are, BUT, we taxpayers will be on the hook for these idiots that refused to run secured systems.
You would think that at this time, that they would be smart enough to limit the internet's transactions, to being slower than what it takes to process the security issues.
I prefer the "u" in honour as it seems to be missing these days.
Aaaand still in many products you pay 300-400% or even more of what many small farmers get paid for them.
From the article....
"The researchers said fraudsters were using Dirt Jumper, a $200 crimeware kit that launches DDoS attacks, to draw bank employees' attention away from fraudulent wire and ACH transactions ranging from $180,000 to $2.1 million in attempted transfers."
Sounds like theft to me. Now granted it says "attempted transfers," but, I think someone made themselves very rich while only giving the banking system a minor scratch. A few million is pocket change in the land of banking.
Donald Trump, on a crusade to make Nixon look respectable
Reading comprehension: Fail.
Let me emphasize the relevant part from the article:
"Gartner vice president Avivah Litan said at least three banks were struck in the past few months using "low-powered" distributed denial-of-service (DDoS) attacks meant to divert the attention and resources of banks away from fraudulent wire transfers simultaneously occurring."
He won't slip up at all. He'll just go on quietly taking the bread from our mouths. unless he's a total ignoramus, he'll keep a low profile and won't do a thing to call attention to himself.
Unless he is an utter moron...
If this was a normal hold-up and they stole millions the police etc would be all over the place, but not so with this heistb and the owners of the bank wwould be on the phone to the local polcie cheif every 10 minutes, therefore it sounds like the bank can afford to loose this amount of money.
So first of, the "systems are not easily compromised [and require] high-privilege level in a more advanced persistent threat style case" is bullshit. Every coded program of any sort as bugs which lead to vulns which in turn become zero-days for those ballzy enough to use them. Alas, these people just used them while they flooded the servers from a different aspect. Not really surprising. The only surprising thing is that it hasn't been reported more. Also banks don't die in the US. The money doesn't come out of the end customers pocket either. If a bank gets fucked then its just a excuse to fuck their customers.
"What's the crime of robbing a bank against that of founding one?" Apologies for quoting a communist, but then everybody's favorite "ist" bogeyman nowadays is the "terror-ist".
Bait and ... hit the switch ... lights out
In the real world.. stealing something involves taking and possessing something physical. Electronic money transfers are just that - electronic.. Just a set of records in a database.
In terms of electronic transfer of money - a transfer goes from one bank account to another. If they worked out the transfer was fraudulent and they can see where it has gone from and to, then can it just not be reversed?
Am i missing something here?
RSA keen to prove that Advanced Persistent Threat is really a thing and that they're not the only ones to fall victim.
Even when they lie through their teeth to sell junk as gold to others they don't end up in jail. We all will pay, through more bank fees, more insurance costs, more taxes to bail them out. And they will dance all the way to their own private bank.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Millions of dollars? That's like... 38 minutes of what banks scrape off the top.
I hate when an article eludes to a point but never actually provides the full disclosure details.
Which three US banks?
Life takes interesting turns, but the most interest is when you're off the beaten path.
Are there any indications pointing to that this was just a trial run for something bigger or just prudent crooks that took what they could get away with?
Banks have been looking for ways to make money since there was such a thing as a bank. Who's to say that the banks didn't engineer this little event so that they could keep the money they stole from themselves (clients) and get reimbursed by the insurance companies to fill the coffers back up again?
If the switches are that difficult to hack, then just maybe it was an inside job.
I happened to be at a bank yesterday, inquiring about a bank transfer. Turns out it was cheaper for me to get a bank check and overnight it than it would be to do a bank transfer, and the bank transfer wasn't even guaranteed to be complete within 24 hours.
The young teller thought the system was as odd as I did ("hey, I just work here") and was more interested in asking me about nuclear transmutation in star formation than banking (my strange little world...) but I have to assume that when the banks are 20 years behind Western Union and Walmart that their systems are too. I wouldn't expect 20 year old systems to be robust against attack and it would surprise me if they put much effort into otherwise defending them.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
Sounds like some crooks watched the old 80's movie Prime Risk. Except they probably didn't use an Atari 800/810 combo for hacking.
I want a list of atrocities done in your name - Recoil
Where do you think those US banks are going to take the money to make it up? In their customer pockets maybe? It's like insurance fraud, shoplifting etc. The end consumer ends up paying for that. We might think; well they already make enough money so, good for them but don't let that fool you. They are going to make up for that to keep investors happy and their stock healthy.
Worse, they may have insurance coverage and insurance companies may raise premium for all banks making sure everybody pays for it.
Sure, it looks nice as a hacker movie scenario although...
Wouldn't this be covered by FDIC.
Which is the bank's insurance, funded by the US federal government, paid by taxes or the US printing more money, nevermind...
And this is why the NSA is monitoring all the internet traffic in the country, to stop things like this happening. Except it didn't work very well this time did it?
Seriously? What bank has that setup?
you can distract the "security" team until the cows come home (even having just 1 "security" team.. that could be distracted is a bit.. odd here)
this is where having specialist in security are required for doing business. Layered defense.
the security team dealing with the DDOS and the security team watching the wire transfer systems should have been alerted when their respective domains were affected.
then when money starts going to the wrong places, a wire fraud team would be involved. if the money was coming from business accounts vs personal accounts, vs high value accounts, vs what have you.. each of those respective fraud and security teams would be working towards their own mitigation.
no.. these had to be small banks/credit unions without a proper layered defense.. OR a very very serious APT/collusion attack.
When money is stolen like this, it must be transferred to an account somewhere. Why is it not a simple matter to trace where the funds were transferred to and go after them?
yes, you fail to comprehend the meaning of:
"meant to divert the attention and resources of banks away from fraudulent wire transfers simultaneously occurring."
Donald Trump, on a crusade to make Nixon look respectable
What about FEDWIRE or ACH?
Between NSA and criminal hackers, we may just have to go back to cursive and postage stamps.
Hi ! Maybe need to move over to simpler systems more difficult to hack. Online security is growing year by year. I can't imagine a hack, or difficult against online, server based service. More than likely, they did not use the proper technology to defend themselves, this is my opinion. Looks like a hack of an old banking system. Sure i would think about putting my money there too. No doubt. Zoltan
Mr. Zoltan Papp (Author of pocketFIT) Senior systems engineer Tel: +36 30 724 4609 Web: https://hu.linkedin.com/in/zo
The question is who did it and what are they going to use the money for?