Slashdot Mirror
Three Banks Lose Millions After Wire Transfer Switches Hacked
mask.of.sanity writes "Criminals have stolen millions from three unnamed U.S. banks by launching slow and stealthy denial of service attacks as a distraction before attacking wire payment switches. The switches manage and execute wire transfers and could have coughed up much more cash should the attackers have pressed on. RSA researcher Limor Kessem said, 'The service portal is down, the bank is losing money and reliability, and the security team is juggling the priorities of what to fix first. That's when the switch attack – which is very rare because those systems are not easily compromised [and require] high-privilege level in a more advanced persistent threat style case – takes place.'"
I like stories like this. If something is done really well and in a clever way (whether it was really being naughty or not) the effort, cleverness and ingenuity should indeed have its merits praised. Slashdot should have more stories like this: Hey, they did a bad thing, but look at just how WELL they did it.
Moved to http://soylentnews.org/. You are invited to join us too!
slow and stealthy denial of service attacks
I don't think a DOS can be stealthy......if it's denying service, are people going to notice?
"First they came for the slanderers and i said nothing."
I must be missing something -- did these people transfer it to an account then go withdraw millions in cash quickly? Or did it take months for it to be discovered?
I can't conceive of any other way that would insulate against a reversal, no matter how many accounts and banks around the world they forwarded it to. Even Swiss banks go along with obvious criminality investigations nowadays.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
Ok, where's the dude who's done decades of banking work who will tell us all why this was inevitable?
In reality, criminals and spies don't use high-tech equipment to break-in to facilities. They use inside knowledge, which this sounds like. Although it required a highly educated criminal to use it. I think this is the price of a well-trained work-force that is slowly down-sized. Hasn't a lot of the previous 12 months been about the lack of built-in security in networked devices? Both deliberate omission and that driven by penny-pinching.
No problem.... Just send me your bank details.
..will just use this as an excuse to hold your money even longer. Thanks Obama.
You can put authorization codes in transactions, but if they aren't digitally signed, you can alter them in transit. Maybe banks should start exchanging signing keys and not transfer authorization codes?
I was promised a flying car. Where is my flying car?
The bottom line is that we need to harden up our defences more and more. We may even have to disconnect essential financial infrastructure from the internet and bring it back onto a completely private network that it costs a substantial amount of money to join and be authenticated to. It should come with the proviso that any device connecting to it, could also not be connected to the internet or an unknown intranet device at the same time. This would not be bulletproof, but it would substantially reduce the risk.
Meus subcriptio est nocens Latin quoniam bardus populus reputo is sanus callidus
Crooks robbing crooks...
You would be amazed - or maybe shocked - to see some of the banking systems out there. I have worked for several financial institutions and their systems are usually very very old legacy crap stuck together with bubble gum and faith. One place was dealing with 70% of the countries financial messaging and they were not using transactions, if there was a problem (and there often was) messages were lost. Asked if I could change it to use transactions, couple lines here, couple lines there.
NO.
Why?
Cost to test would involve the entire country and would cost millions.
OK.
So they are still losing messages.
There are three kinds of falsehood: the first is a 'fib,' the second is a downright lie, and the third is statistics.
Why has there not been any information as to which banks were involved. That's kind of important. regardless if this directly impacts a customer or not I would like to know if it was my bank...
These banks run the crappiest OS and security systems. Then when they are cracked, they do not want it known who they are, BUT, we taxpayers will be on the hook for these idiots that refused to run secured systems.
You would think that at this time, that they would be smart enough to limit the internet's transactions, to being slower than what it takes to process the security issues.
I prefer the "u" in honour as it seems to be missing these days.
Tired of malware? Start WWIII, pissing off the rest of the planet will sure resolve all your problems.
Tomorrow is another day...
I do not think
you should have stopped there
From the article....
"The researchers said fraudsters were using Dirt Jumper, a $200 crimeware kit that launches DDoS attacks, to draw bank employees' attention away from fraudulent wire and ACH transactions ranging from $180,000 to $2.1 million in attempted transfers."
Sounds like theft to me. Now granted it says "attempted transfers," but, I think someone made themselves very rich while only giving the banking system a minor scratch. A few million is pocket change in the land of banking.
Donald Trump, on a crusade to make Nixon look respectable
I wrote:
"Any businessman will factor in all costs", especially if they only make a 1-2% profit margin.
There is just too many middle men taking cuts along the way but this is a different topic. Local agriculture and buying local is one solution to that topic. Do you practice it? It sure beats shoplifting as a solution.
https://en.wikipedia.org/wiki/Local_food
Everything I write is lies, read between the lines.
Yeah a few thousand more of these and the banks can finally receive an adequate fine for the crimes they committed a few years ago since the government doesn't have the balls to do it.
If this was a normal hold-up and they stole millions the police etc would be all over the place, but not so with this heistb and the owners of the bank wwould be on the phone to the local polcie cheif every 10 minutes, therefore it sounds like the bank can afford to loose this amount of money.
It's not superman without Lex Luther.
These comments are my personal opinions and do not necessarily reflect the opinions of the other voices in my head.
Bait and ... hit the switch ... lights out
Even when they lie through their teeth to sell junk as gold to others they don't end up in jail. We all will pay, through more bank fees, more insurance costs, more taxes to bail them out. And they will dance all the way to their own private bank.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
I hate when an article eludes to a point but never actually provides the full disclosure details.
Which three US banks?
Life takes interesting turns, but the most interest is when you're off the beaten path.
If the money is still in the account, no. But if the bank that received the transfer has transferred that money out of the jurisdiction or exchanged that record in a database for a briefcase full of large denomination notes they're not going to be particularly keen on rolling the original transaction back.
Are there any indications pointing to that this was just a trial run for something bigger or just prudent crooks that took what they could get away with?
Banks have been looking for ways to make money since there was such a thing as a bank. Who's to say that the banks didn't engineer this little event so that they could keep the money they stole from themselves (clients) and get reimbursed by the insurance companies to fill the coffers back up again?
If the switches are that difficult to hack, then just maybe it was an inside job.
I happened to be at a bank yesterday, inquiring about a bank transfer. Turns out it was cheaper for me to get a bank check and overnight it than it would be to do a bank transfer, and the bank transfer wasn't even guaranteed to be complete within 24 hours.
The young teller thought the system was as odd as I did ("hey, I just work here") and was more interested in asking me about nuclear transmutation in star formation than banking (my strange little world...) but I have to assume that when the banks are 20 years behind Western Union and Walmart that their systems are too. I wouldn't expect 20 year old systems to be robust against attack and it would surprise me if they put much effort into otherwise defending them.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
Sounds like some crooks watched the old 80's movie Prime Risk. Except they probably didn't use an Atari 800/810 combo for hacking.
I want a list of atrocities done in your name - Recoil
He probably doesn't because that takes too much effort and planning. I find you also get better quality if you buy locally since the farmers catering to that market know that their customers expect a higher quality product. The example I use is my father's friend who raises cattle, we pay the farmer for the beef and pay the butcher for the processing and it comes out to be about the same price per lb as the really cheap crappy ground beef but we get good ground beef, steaks, roasts. I have seen some meat that is somewhat comparable at the grocery store but it seems obscene to pay $10/lb for ground beef when I cut out the middle men and pay just under $4/lb and get all the cuts and ground beef.
Time to offend someone
I guess only if the bank goes bankrupt and cannot reimburse the account holders...
https://en.wikipedia.org/wiki/Federal_Deposit_Insurance_Corporation#Resolution_of_insolvent_banks
Everything I write is lies, read between the lines.
And this is why the NSA is monitoring all the internet traffic in the country, to stop things like this happening. Except it didn't work very well this time did it?
You mean over at the Farmer's Market where the fruits and vegetables are significantly higher than they are over at Safeway? Eating local like eating organic isn't cost effective (comparing the costs of the two, not the long term costs of poor health due to eating GM food, etc).
[John]
Shit better not happen!
Seriously? What bank has that setup?
you can distract the "security" team until the cows come home (even having just 1 "security" team.. that could be distracted is a bit.. odd here)
this is where having specialist in security are required for doing business. Layered defense.
the security team dealing with the DDOS and the security team watching the wire transfer systems should have been alerted when their respective domains were affected.
then when money starts going to the wrong places, a wire fraud team would be involved. if the money was coming from business accounts vs personal accounts, vs high value accounts, vs what have you.. each of those respective fraud and security teams would be working towards their own mitigation.
no.. these had to be small banks/credit unions without a proper layered defense.. OR a very very serious APT/collusion attack.
An interesting point. There is NO POSSIBILITY of ANYONE knowing the long-term costs or benefits of eating GMO products. In fact the entire concept is probably wrong, because it's likely that some GMO products will have positive benefits, some negative, and the majority neutral. Occasionally one can point to some specific benefit, as in golden rice, but even that may well be associated with long term costs that we don't know about.
Worse than that, the information about what the costs and benefits are is given to us selectively by groups that have biased opinions. Most of them will significantly benefit if the GMO products are deemed beneficial. So they tend to suppress studies that don't show them as beneficial, and promote studies that show them as beneficial. Given that, how much do you trust the available information? Why?
Mind you, I do understand that many of the changes LOOK as if they should be neutral for consumers. This isn't proof, and we are looking at complex systems. The only proof would be long term studies. And for most (all?) of the products there hasn't been time, even if they had been initiated at the time the GMO organism was developed.
Anecdotal evidence indicates that the wheat used in France is less likely to lead to allergic reactions than the wheat used in the US. There hasn't been a large enough study to demonstrate that this is a real phenomenon, but I've met two people who assert that it is true for them. When the visit france they can eat the local bread, but in the US bread produces an allergic reaction. (I'm not being specific as to which allergic reaction, because I'm not sure what's going on. It could be preservatives or something rather then the GMO wheat. That would require a good study, which hasn't, as far as I know, been done.)
I think we've pushed this "anyone can grow up to be president" thing too far.
What will he tell the IRS? That could get tricky. And if he doesn't pay his protection money, the feds could get impatient with him.
He'd better have really thought things through.
I think we've pushed this "anyone can grow up to be president" thing too far.
I would guess, without checking, that the quote is from Stalin. If so, I deny that he was ever a communist. He was a gangster, who was also good at political manipulation. Even the government he was manipulating wasn't communist, though it was trying, at least officially.
FWIW, there has never been a communist group ruling more than a small village. This is because the system doesn't scale at all well, and only works when EVERYONE knows EVERYONE. (Not everyone needs to be trusted, but you need to know how much trust to give to everyone.) Even Oneida didn't work after it got too successful. I think that was mainly a problem of size, but it could also have been wealth. Perhaps communism only works amoung groups that are really poor, as I can't think of any counter-examples.
Marx was trying to scale up something that doesn't scale well. For a really small group it may well be a nearly optimum choice. (The best, of course, is the "good king" model, but this requires a terminally violent recall method if the current kind ceases to be good.)
I think we've pushed this "anyone can grow up to be president" thing too far.
When money is stolen like this, it must be transferred to an account somewhere. Why is it not a simple matter to trace where the funds were transferred to and go after them?
yes, you fail to comprehend the meaning of:
"meant to divert the attention and resources of banks away from fraudulent wire transfers simultaneously occurring."
Donald Trump, on a crusade to make Nixon look respectable
Hi ! Maybe need to move over to simpler systems more difficult to hack. Online security is growing year by year. I can't imagine a hack, or difficult against online, server based service. More than likely, they did not use the proper technology to defend themselves, this is my opinion. Looks like a hack of an old banking system. Sure i would think about putting my money there too. No doubt. Zoltan
Mr. Zoltan Papp (Author of pocketFIT) Senior systems engineer Tel: +36 30 724 4609 Web: https://hu.linkedin.com/in/zo
Sorry, I was trying to fend off the "GM Food!1!1!!!" replies.
[John]
Shit better not happen!