Slashdot Mirror
Crooks Arrested Over KVM-Based Bank Heist Attempt
judgecorp writes "Twelve men have been arrested over an attempt to take control of computers at a Santander bank branch in London using a stealthily planted KVM (keyboard, video and mouse) switch installed by a bogus maintenance engineer. The men were caught by the Metropolitan Police's Central e-Crimes Unit."
Everyone knows if you want to rip off a bank. You need to BE the banker.
That way you get the money. And then the goverment comes and gives you MORE money. Win. Win. No jailtime.
All Intel upstrem patches are belong to me.
"Now"? KVM has been an acronym for years, if not decades.
This and the NSA incident should really tell everybody that the story of a lone hacker sitting in his basement "hacking the world" is just that: bullshit. ... undertakings. Hacking stuff, either by placing ... once the flow of information gets going you'll notice
It takes always more than one to be effective, be it in the large or small spying business or criminal
hardware or coming directly for the systems is one thing, making money or usable information out of it another. And one "big heist" usually
leads to another, because a larger pool would be nice, wouldn't it? And spying
your customers are always thirsty.
What else is bullshit is all the stuff "preventionists" are telling you. The picture of the barbarian, unwashed hacker hordes rushing you, only to be foiled by stalwart products while you observe like a field marshal from your dashboard is a lie. They have no reason to do that, they go for the weak points. These guys brought their backdoor with autonomous internet access with them, they didn't even try to breach the net - and they used of-the-shelf-products. Which is always annoying, wether it is backdoors or hardware deployed - you don't who dropped it, could be anyone.
So how did they caught? Maybe they got too greedy, maybe did it one time too often - and someone didn't rely on prevention, but investigation.
Should you be bored by this little rant, buy an iKVM switch, throw it at an antivirus marketing guy whilst yelling "Catch this!"
... I was hoping they tried to exploit the bank through a Kernel-based Virtual Machine. Disappointing.
The article missed the rather crucial word 'switch'. Keyboard/Video/Mouse switch.
I don't expect even the most accomplished geek to know every acronym, but you don't even know kvm you need to hand back your credentials, and don't let the door hit your ass on the way out. Thank you.
Personally, used my first KVM in 1998 - but they've been around since the 80's
'The Metropolitan Police said its "time-critical, dynamic response" had thwarted a "very significant and audacious cyber-enabled offence". '
http://www.bbc.co.uk/news/uk-england-london-24077094
I think there should be a general rule: Anyone who uses the word 'cyber' in a non-sarcastic manner should be ignored.
The article looks like it wasn't written by a tech journalist too, as it contains such obvious errors as 'The device, if operational, would have allowed data and contents of the desktop to be downloaded over the network.' News organizations so often make mistakes in their rush to be the first to break a story - even the BBC.
Yes, since people started using mice in their computers. Before that it was a KVS (Keyboard Video Switch).
How where they caught?
The clarification was almost certainly intended to disambiguate KVM switches from Linux KVM virtualization.
Apparently, you're not old enough to have ever seen a KVM switch, and your awareness of current technologies isn't keen enough to know about KVM virtualization. Neither of these conditions is a bad thing, but the snide tone of your comment was unwarranted in light of the facts.
Write failed: Broken pipe
Well, he could have easily slipped in an unobstrusive thumbdrive with a key logger in to a back usb port, and collected it back in the next "maintenance" visit! One could imagine a usb device based KVM without cables transmitting data wirelessly. Such devices are very useful, I could stash my tower in a sound proofed cooling enclosure far away and keep my KVM on my desk. So they will be in the market, if they are not already in the market. At that point all the bogus engineer had to do was to slip in an unobstrusive usb device in a back port.
Once the crooks have physical access to the machine, it becomes very difficult to protect against. Once a crook and an insider cooperate it becomes very very difficult to guard against.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
http://www.raritan.com/products/kvm-over-ip/
this is hardly esoteric
Using mice in computers is not recommended, they chew on the wires and poo and pee on the boards. I've been using the MIC (Mice In Cat) protocol to prevent that.
installed KVM as phony IT guy, were arrested and here are their names
this is all the information the article provides. no details of any kind. no picture of the (hopefully stealthy) KVM, how they were caught or anything of any interest at all!
Here's the real scoop:
A man dressed as a "maintenance engineer" (IT guy) claimed to be sent by a some company working for the bank. Then he goes to the bank branch's main server and plugs an external KVM-over-IP box connected to an ethernet to wifi adapter or at least that was the plan. The plan was thwarted at the last minute... no info as to why/how but I'm betting that the server either didn't have a PS/2 port or didn't have VGA output not that it matters without a username and password to login.
A spokesman for Santander insisted that the bogus engineer had not managed to install the device and no customer money was ever at risk.
We are pleased that we have been able, through the robustness of our systems, to prevent the fraud and help the police gather the evidence they needed to make the arrests. Santander operates multiple levels of controls to protect customers' funds and this attack would not have been successful.
Hours after the bogus engineer attempted to fit the device to the computer server, officers from Scotland Yard swooped arresting 12 men on suspicion of conspiracy to steal. As for how they were caught, I think someone just realized there wasn't supposed to be an IT guy there and then the cops got called.
Anons need not reply. Questions end with a question mark.
did you just learn how to use the bold tag or something?
you received several ac replies, i'll do it while logged in.
'kvm switch' (the last word missing from the summary for some reason) is a product that has existed for a long time. they are primarily used in server rooms along with a rackmountable display/keyboard//mouse (usually a touchpad, although i prefer trackball a lot more). nowadays these sets are lcd so they fold in 2u or so. before that, you'd allocate place for a crt monitor in some rack.
a kvm switch sits behind that terminal and has a shitload of cables going to all the servers. last i did it, it was all ps/2, no idea whether the new ones are all usb or something.
large kvm switch can hook up to dozens of servers, and you can even stack many of those, controlling hundreds of servers from a single terminal.
note that large companies probably have more efficient solutions (ssh-kvm etc), and last i actually worked on this ability to ssh in a kvm was just arriving, so you might find more up-to-date information from vendors
Rich
ipmi is a lot better for servers. of course you need a special network interface which is hugely expensive. then again cat5 is a whole lot cheaper than video cable, especially monster.
i mean who really wants to wander around in a room with 250 KVA snaking through the place installed by people that think 12V is overkill.
I've actually got a 2 source KVM switch that supports usb keyboard and mouse. Been years since i've used it, but I can attest that they exist.
I've decided to Diversify my Holdings. I've divided my cash between my left and right pockets, instead of all in one.
Update of technology knowledge coming :)
LCD/keyboard trays now fit into 1U and IBM, among others, have Cat5e-based console managers that daisy-chain different server connection devices using RJ45 connectors. These end devices can have PS/2, USB, VGA, HDMI, DVI and even RS232 options. On the IBM unit we have, the LCM 16, there are two sets of connectors for the LCD tray and 16 RJ45 KVM ports which can cascade to 16 servers each for 256 devices in 1U. And there is network KVM access available for an extra license cost.
Trying to become famous by taking photos. Visit my homepage please.
People with no job conspire and fail in trying to shave off a few millions out of a bank's billions?
Get arrested, thrown in prison for years.
Work for a bank, conspire and succeed in destroying the global economy and cheat your customers out of trillions of dollars?
Get the government to give you even MORE money.
Not saying these guys here should not have been arrested. But the worst crooks in the story are working inside the bank, not outside.
If he explores all forms and substances Straight homeward to their symbol-essences; He shall not die.
Under what circumstances will Slashdot not pick up this story? Perhaps if....
CrookA calls CrookB on his cel^H^H^Hrotary phone. CrookB asks a bicycle courier outside his building to deliver some building plans across town to CrookC and CrookD.
The next night, they all meet up and get to work hammering down a wall from some parking garage which leads into the vault.
When you are part of an industry and use a certain term multiple times you get to decide when and what you create acronyms for. Since a lot morons among the AC crowd don't seem to get simple concepts, I will explain this one for your benefit. Acronyms are made to make speaking easier/quicker when you MUST repeat yourself. People that make KVM switches probably took about 10 seconds into their first meeting talking about making this product to decide that repeatedly saying keyboard video mouse was a waste of time. Just because the entirety of your experience with acronyms begins and ends with lol, fml and diaf as you text your twelve year old friends does not mean that the world in general doesn't understand that time is money. If you had even a modicum of experience in a non-entry level position in a larger company you would realize that most acronyms in the world are business related; created and mostly used by the people that create the idea or product then picked up by the general public over time. The military is an exception to that rule. They have a serious addiction to creating acronyms for everything.
I've just finished development on my new bitchen KVM system!
Wanna give one a try and tell me how you like it? ......
Rick B.
I found out about them in the mid nineties when I got an extra pc with no peripherals from a neighbor and wanted to use it just for games. They were amazing, magical devices back when it was easier to just get another computer than it was to find a big enough hard drive to hold everything you wanted to have access to.
it was a KVM with wireless capability. Bank was in a mall. The crooks just had to sit at a cafe and watch and learn remotely. Something like these
http://www.kvm-switches-online.com/wireless-kvm.html was used. I'm still looking for the ones that "can be bought online for 10 pounds"
Picked this up from Sky news this morning via my Apple TV which has a free feed.
Pretty smart except for needing 12 guys and getting caught.
They must have used the device in the link attached to a wifi router. Though the device must be capable of negotiating the firewall like RVNC does. I think the router gave it away.
http://www.hy-line.de/en/company-group/hy-line-computer-components/line-card/lantronix/kvm/
What if you are a political blogger whose keyboard is bugged? The Miniluv can do everything they want against you, and no TOR, I2P, VPN, foreign hosting or full-disk encryption will save you from Room 101.
is ipmi console a standard protocol ? how widely is it used ? i'll admit not seeing it being it actually used even once, but maybe i was not looking at right organisations...
Rich
The acronym KVM has been around quite some time. This is Slashdot. KVM doesn't necessarily mean Keyboard/Video/Mouse here. Many of us are informed enough to know that KVM is also a core Linux Kernel virtualization technology, and it was therefore necessary to be explicit. In fact, when I read the title I thought they were talking about the Kernel Virtual Machine. I had to read the summary to find out they were talking about a Keyboard/Video/Mouse based exploit.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
That's the strong tag, you antiquated fool.
chase bank out outsourced branches IT to work to a mix of outside contractors / sub contractors.
They should have used Xen or VMware for the financial industry.
And yet its use was rather weak.
The KVM was marked 'Made in China'. They should replaced it with a label saying 'Installed by the NSA'.
Hey, newspaper guy! It's called "Social Engineering" and it's broadly the same as "Con Artistry".
if i wasn't too lazy to login, i would rate this as "comedy". you obviously are confusing "business" with "technical". business is only concerned with making money. money sometimes happens to technical people.
is ipmi console a standard protocol ? how widely is it used ? i'll admit not seeing it being it actually used even once, but maybe i was not looking at right organisations...
If you've never been a sysadmin, then there's no reason for you to ever have heard of it.
It is a standard and widely adopted protocol, created in the late 90s by some of the prominent hardware vendors of the day. You're not likely to see it outside of server class machines.