Slashdot Mirror
Another British Bank Hit By KVM Crooks
judgecorp writes "Another British bank — Barclays — has been hit by a fraud attempt using a stealthily-planted KVM (keyboard, video, mouse) device. Unlike the previous attempt on Santander, the crooks got away with £1.3 million, but were subsequently apprehended by the Metropolitan Police's Central e-Crimes Unit."
Makes you wonder how many other times has this been done where the crooks got away scott free and the bank just didn't want to go public about it?
When information is power, privacy is freedom.
... to good old security? You know, checking who gets into the staff premises of a bank?
I bet they thought it was a low risk area, because it was only handling "data". But "data" is money...
Looks like a KVM-over-IP box, possibly. But those don't have video passthrough, so it'd be detected in no time at all. I can see how such a scam could work (KVM-over-IP + access point + VGA splitter), but not with the hardware described. You'd have to depend on employees leaving their station unlocked, but that is going to happen sooner or later.
I'm not sure if this is a deliberate Met policy of withholding the details of crimes to prevent imitation, or just non-technical reporting trying to express complicated networkystuff in a manner the layperson can understand.
You certainly couldn't get it at PC World, though. They only sell consumer gear. You might be able to get a plain local KVM if you're very lucky, but a KVM over IP? No chance. A quick check of their website shows no KVMs of any variety.
Can we rename it VKM, so that it doesn't conflict with Kernel-based Virtual Machine?
They will just ask Central Bank to print some extra money. Problem solved. For the rest of you, go to work to earn some pennies.
I'm assuming you are from the US, because that is were this "printing money is bad" meme seems to have been resurrected lately. Central banks are managing the money supply to balance and the economy, and in most modern western economies this is working as intended - keeping a stable currency value, steady low inflation and fueling economic growth or counteracting recession. Outside that the slogan "printing money" sounds like something bad is going on, I don't really understand what it is about the real world effect of this that you are dissatisfied with.
If there was no "printing money" you would get deflation, which would be really bad for any modern economy. For one it increases the real value of debt, curbing investments, contributing to or amplifying recession and can lead to a deflationary spiral. (on a personal scale, imagine your house mortgage just growing and growing in real value you owe, the actual house value would not necessarily follow)
Here is the argument:
Every fiat currency in history constantly loses value in the process of "balancing the economy" until the system implodes on itself creating a massive deflation all at once followed by panicked money printing and inflation. This occurs rather than the series of relative minor events that would have occurred otherwise. The process also has the side effect of encouraging wasteful spending and use of resources. Also, the entities that receive the printed money (government and large financial institutions) are given too much power over how then to use this newly created money/reserves and the people in charge of these entities get to spend it on their pet projects at the expense of less well connected people (their money is now devalued).
These are problems created by printing money in the first place. Yes, at this point it is a major problem and the money printing can not stop without causing major pain for a lot of people, the only thing to do is keep kicking the can down the road or wind it down very slowly.
“Those responsible for this offence are significant players within a sophisticated and determined organised criminal network, who used considerable technical abilities and traditional criminal know-how to infiltrate and exploit secure banking systems,”
Also known as some people with a bit of technical knowledge and a grasp of basic social engineering. Gotta love it when they make something sound like rocket science so folks won't realize what little is really involved.
They will just ask Central Bank to print some extra money. Problem solved.
For the rest of you, go to work to earn some pennies.
I'm assuming you are from the US, because that is were this "printing money is bad" meme seems to have been resurrected lately. Central banks are managing the money supply to balance and the economy, and in most modern western economies this is working as intended - keeping a stable currency value, steady low inflation and fueling economic growth or counteracting recession.
So I see the brainwashing regarding "minor inflation is good" did work on you. Back in my day, we had a word for FALLING prices on essential goods, it was called "progress".
So I see the brainwashing regarding "minor inflation is good" did work on you. Back in my day, we had a word for FALLING prices on essential goods, it was called "progress".
Yeah, I would love to see the price on my house keep falling in value while the debt keep growing.. On the business side this effect will limit investments.
When I was syadmin a few years ago, I really used to get SO bloody angry with the maintenance guys, as they used to call in photocopy machine engineers when the things went wrong. Of course, they never informed the IT department (ME!), so all of a sudden, when I was going somewhere, I saw an 'unknown' guy hooked up with a laptop on the companies network *.
No matter WHAT I told them about security, it didn't matter - a working photocopier was more important than security.
This is obviously a similar situation - some 'official looking' technical guy turns up, tells a few porkies, and the staff just let him get on with it without any checks.
* I later coded a short perl script to send me a mail when an unknown MAC connected to the LAN.
Because they used an electronic gadget in the commission of a crime? This was a social engineering ploy, the tech played a minor role. Even TFA (yes, I read it) explained that the technology involved was "crude."
The "tech expert" they interviewed is just adding fuel to the idiot fire by explaining that antivirus won't help, giving undeserved credence to the notion that this was a technological attack.
Stop prefixing e- and cyber- and other bullshit to make yourself sound modern because you actually sound like an old fart bitching about "newfangled gizmos" that they don't understand.
You knowledge of economic history is severely inadequate. Here are two lessons about the risks of incurring large debts and printing money to pay them -
http://en.wikipedia.org/wiki/Hyperinflation_in_the_Weimar_Republic
http://en.wikipedia.org/wiki/Hyperinflation_in_Zimbabwe
It is funny how the media reports it as a sophisticated attack with criminal masterminds as they don't want you to know that it is something that pretty much anybody with a little tech understanding could do. They are only reporting this one because they were such clever criminal masterminds that they got caught doh! Anyone with the courage to go in to a bank masquerading as in IT contractor could plug such a device into a PC. In fact I'm sure many geeks could come up with a far less obvious solution fitted internally. The problem is banks; especially in the UK are living in the steam era and think of their buildings and therefore their internal network secure. Surely staff should be required to use some sort of NFC tag or similar so that the computer can only be operated while they are sat at it and locks when they walk away.
Keynesian nonsensical scaremongering yet again. Steady inflation is anything but stable and the current target of 2% effectively steals 45% of a man's savings after 30 years.
The only honest target is 0%.
Oh, and there's no such thing as a "deflationary spiral" that is comparable to hyperinflation. The former is a negative feedback loop that ends itself when price meets utility value while the latter is a positive feedback loop that has no control mechanism other than the entire economy imploding.
All that duplication of OS, and you get the perceived benefit of increased separation, but you've still go a thing running that launches other things, all on the same machine, only now with the overhead of running the first thing inside another thing inside itself....
The only security benefit is in the thing that contains the thing that runs the stuff. If this piece of software sufficiently segregates the running applications, then it is secure, if it does not, then you're in the same boat as before except you need three times the hardware just to get started.
A well-designed operating system would keep the applications just as separate with only 1x the overhead of an operating system. The fact that we're using VM's all over the place is clear evidence that we haven't got operating systems figured out right now.
Can you be Even More Awesome?!
Some times the works don't get staff ID's or it can be easy to say I got a call just now to come out or just show some paper work that looks like an work order. And they can say the system placed the call on it's own.
The problem is when you print money and use it to bail out a private entity that is considered too big to fail. Particularly when you also keep socking it to individuals who are apparently too small to succeed.
As stated above, any network equipment worth using has MAC filtering. Just set up all access port security as single MAC only, sticky so you don't have to hardcode them all, and shutdown on violation. Done. No more alien network interfaces on your network.
Why would you take the time to code a script but not do the bare bones network administration task of setting port security? It's only five lines of configuration on Cisco equipment:
int ra f0/x-y
switch mode acc
switch port-s mac sticky
switch port-s max 1
switch port-s vi sh
A whole lot easier than a custom one off job that will only tell you when something has already gone wrong.
My brain-washing says that the economy doesn't run if money doesn't change owners, and people are more likely to hold onto money if there's deflation (=money appreciates in value). Which is why the politicians try to avoid deflation, and the best way to do that is to have a small inflation.
See e.g. Japan who are now printing loads of money, hoping to get rid of the mild deflation that's been ongoing for the last decade or so.
Banks create money out of thin air every time somebody takes out a loan.
www.positivemoney.org
97% of the money in existence is BANK money - meaning it is a DEBT to a bank somewhere, meaning the banks (i.e. the private individuals who own them) own 97% of everything.
not who's
So I see the brainwashing regarding "minor inflation is good" did work on you. Back in my day, we had a word for FALLING prices on essential goods, it was called "progress".
Yeah, I would love to see the price on my house keep falling in value while the debt keep growing.. On the business side this effect will limit investments.
Solution: don't get in debt. On the grand scale of things, mortgages are a very new "invention".