Slashdot Mirror
Three Banks Lose Millions After Wire Transfer Switches Hacked
mask.of.sanity writes "Criminals have stolen millions from three unnamed U.S. banks by launching slow and stealthy denial of service attacks as a distraction before attacking wire payment switches. The switches manage and execute wire transfers and could have coughed up much more cash should the attackers have pressed on. RSA researcher Limor Kessem said, 'The service portal is down, the bank is losing money and reliability, and the security team is juggling the priorities of what to fix first. That's when the switch attack – which is very rare because those systems are not easily compromised [and require] high-privilege level in a more advanced persistent threat style case – takes place.'"
I like stories like this. If something is done really well and in a clever way (whether it was really being naughty or not) the effort, cleverness and ingenuity should indeed have its merits praised. Slashdot should have more stories like this: Hey, they did a bad thing, but look at just how WELL they did it.
Moved to http://soylentnews.org/. You are invited to join us too!
slow and stealthy denial of service attacks
I don't think a DOS can be stealthy......if it's denying service, are people going to notice?
"First they came for the slanderers and i said nothing."
I must be missing something -- did these people transfer it to an account then go withdraw millions in cash quickly? Or did it take months for it to be discovered?
I can't conceive of any other way that would insulate against a reversal, no matter how many accounts and banks around the world they forwarded it to. Even Swiss banks go along with obvious criminality investigations nowadays.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
He's currently in jail for speaking up against the banks, ya know.. letting those terrorists know about the loopholes so they can exploit it
It's not a typo if you understood the meaning!
..will just use this as an excuse to hold your money even longer. Thanks Obama.
You can put authorization codes in transactions, but if they aren't digitally signed, you can alter them in transit. Maybe banks should start exchanging signing keys and not transfer authorization codes?
I was promised a flying car. Where is my flying car?
The bottom line is that we need to harden up our defences more and more. We may even have to disconnect essential financial infrastructure from the internet and bring it back onto a completely private network that it costs a substantial amount of money to join and be authenticated to. It should come with the proviso that any device connecting to it, could also not be connected to the internet or an unknown intranet device at the same time. This would not be bulletproof, but it would substantially reduce the risk.
Meus subcriptio est nocens Latin quoniam bardus populus reputo is sanus callidus
Crooks robbing crooks...
You would be amazed - or maybe shocked - to see some of the banking systems out there. I have worked for several financial institutions and their systems are usually very very old legacy crap stuck together with bubble gum and faith. One place was dealing with 70% of the countries financial messaging and they were not using transactions, if there was a problem (and there often was) messages were lost. Asked if I could change it to use transactions, couple lines here, couple lines there.
NO.
Why?
Cost to test would involve the entire country and would cost millions.
OK.
So they are still losing messages.
There are three kinds of falsehood: the first is a 'fib,' the second is a downright lie, and the third is statistics.
As a dude who's done decades of banking work, this was inevitable, because uhm... something to do with 1970's infrastructure or something.
Why has there not been any information as to which banks were involved. That's kind of important. regardless if this directly impacts a customer or not I would like to know if it was my bank...
These banks run the crappiest OS and security systems. Then when they are cracked, they do not want it known who they are, BUT, we taxpayers will be on the hook for these idiots that refused to run secured systems.
You would think that at this time, that they would be smart enough to limit the internet's transactions, to being slower than what it takes to process the security issues.
I prefer the "u" in honour as it seems to be missing these days.
From the article....
"The researchers said fraudsters were using Dirt Jumper, a $200 crimeware kit that launches DDoS attacks, to draw bank employees' attention away from fraudulent wire and ACH transactions ranging from $180,000 to $2.1 million in attempted transfers."
Sounds like theft to me. Now granted it says "attempted transfers," but, I think someone made themselves very rich while only giving the banking system a minor scratch. A few million is pocket change in the land of banking.
Donald Trump, on a crusade to make Nixon look respectable
I wrote:
"Any businessman will factor in all costs", especially if they only make a 1-2% profit margin.
There is just too many middle men taking cuts along the way but this is a different topic. Local agriculture and buying local is one solution to that topic. Do you practice it? It sure beats shoplifting as a solution.
https://en.wikipedia.org/wiki/Local_food
Everything I write is lies, read between the lines.
Even when they lie through their teeth to sell junk as gold to others they don't end up in jail. We all will pay, through more bank fees, more insurance costs, more taxes to bail them out. And they will dance all the way to their own private bank.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
I happened to be at a bank yesterday, inquiring about a bank transfer. Turns out it was cheaper for me to get a bank check and overnight it than it would be to do a bank transfer, and the bank transfer wasn't even guaranteed to be complete within 24 hours.
The young teller thought the system was as odd as I did ("hey, I just work here") and was more interested in asking me about nuclear transmutation in star formation than banking (my strange little world...) but I have to assume that when the banks are 20 years behind Western Union and Walmart that their systems are too. I wouldn't expect 20 year old systems to be robust against attack and it would surprise me if they put much effort into otherwise defending them.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
When money is stolen like this, it must be transferred to an account somewhere. Why is it not a simple matter to trace where the funds were transferred to and go after them?