Slashdot Mirror
Three Banks Lose Millions After Wire Transfer Switches Hacked
mask.of.sanity writes "Criminals have stolen millions from three unnamed U.S. banks by launching slow and stealthy denial of service attacks as a distraction before attacking wire payment switches. The switches manage and execute wire transfers and could have coughed up much more cash should the attackers have pressed on. RSA researcher Limor Kessem said, 'The service portal is down, the bank is losing money and reliability, and the security team is juggling the priorities of what to fix first. That's when the switch attack – which is very rare because those systems are not easily compromised [and require] high-privilege level in a more advanced persistent threat style case – takes place.'"
I like stories like this. If something is done really well and in a clever way (whether it was really being naughty or not) the effort, cleverness and ingenuity should indeed have its merits praised. Slashdot should have more stories like this: Hey, they did a bad thing, but look at just how WELL they did it.
Moved to http://soylentnews.org/. You are invited to join us too!
slow and stealthy denial of service attacks
I don't think a DOS can be stealthy......if it's denying service, are people going to notice?
A stealthy DOS is when the attack looks like a normal occurrence, and not an attack. It is not the DOS that is stealthy, it is the attack or, rather, the reason for the lack of service.
It is a very neat thing, actually. Say you have a very long, segmented fence. There are 1000000 segments, and every day 1 of those will break and stay broken for 10 seconds. You can't explore that, because it is random, and you can't try all 1000000 segments in 10 seconds. However, if you can force the dice and make a specific segment tail, you can be there and exploit it, because you know which one and when. To the external observer, however, it was just a normal, run of the mill segment fail.
It is the same concept. The failure is there, they notice it, but it is done in such a way they don't notice it is an attack.
morcego
He's currently in jail for speaking up against the banks, ya know.. letting those terrorists know about the loopholes so they can exploit it
It's not a typo if you understood the meaning!
Crooks robbing crooks...
You would be amazed - or maybe shocked - to see some of the banking systems out there. I have worked for several financial institutions and their systems are usually very very old legacy crap stuck together with bubble gum and faith. One place was dealing with 70% of the countries financial messaging and they were not using transactions, if there was a problem (and there often was) messages were lost. Asked if I could change it to use transactions, couple lines here, couple lines there.
NO.
Why?
Cost to test would involve the entire country and would cost millions.
OK.
So they are still losing messages.
There are three kinds of falsehood: the first is a 'fib,' the second is a downright lie, and the third is statistics.