Slashdot Mirror
Another British Bank Hit By KVM Crooks
judgecorp writes "Another British bank — Barclays — has been hit by a fraud attempt using a stealthily-planted KVM (keyboard, video, mouse) device. Unlike the previous attempt on Santander, the crooks got away with £1.3 million, but were subsequently apprehended by the Metropolitan Police's Central e-Crimes Unit."
Makes you wonder how many other times has this been done where the crooks got away scott free and the bank just didn't want to go public about it?
When information is power, privacy is freedom.
... to good old security? You know, checking who gets into the staff premises of a bank?
I bet they thought it was a low risk area, because it was only handling "data". But "data" is money...
Looks like a KVM-over-IP box, possibly. But those don't have video passthrough, so it'd be detected in no time at all. I can see how such a scam could work (KVM-over-IP + access point + VGA splitter), but not with the hardware described. You'd have to depend on employees leaving their station unlocked, but that is going to happen sooner or later.
I'm not sure if this is a deliberate Met policy of withholding the details of crimes to prevent imitation, or just non-technical reporting trying to express complicated networkystuff in a manner the layperson can understand.
You certainly couldn't get it at PC World, though. They only sell consumer gear. You might be able to get a plain local KVM if you're very lucky, but a KVM over IP? No chance. A quick check of their website shows no KVMs of any variety.
They will just ask Central Bank to print some extra money. Problem solved.
For the rest of you, go to work to earn some pennies.
Can we rename it VKM, so that it doesn't conflict with Kernel-based Virtual Machine?
“Those responsible for this offence are significant players within a sophisticated and determined organised criminal network, who used considerable technical abilities and traditional criminal know-how to infiltrate and exploit secure banking systems,”
Also known as some people with a bit of technical knowledge and a grasp of basic social engineering. Gotta love it when they make something sound like rocket science so folks won't realize what little is really involved.
When I was syadmin a few years ago, I really used to get SO bloody angry with the maintenance guys, as they used to call in photocopy machine engineers when the things went wrong. Of course, they never informed the IT department (ME!), so all of a sudden, when I was going somewhere, I saw an 'unknown' guy hooked up with a laptop on the companies network *.
No matter WHAT I told them about security, it didn't matter - a working photocopier was more important than security.
This is obviously a similar situation - some 'official looking' technical guy turns up, tells a few porkies, and the staff just let him get on with it without any checks.
* I later coded a short perl script to send me a mail when an unknown MAC connected to the LAN.
I think this post is very informative for us http://hightechbd.com/
Because they used an electronic gadget in the commission of a crime? This was a social engineering ploy, the tech played a minor role. Even TFA (yes, I read it) explained that the technology involved was "crude."
The "tech expert" they interviewed is just adding fuel to the idiot fire by explaining that antivirus won't help, giving undeserved credence to the notion that this was a technological attack.
Stop prefixing e- and cyber- and other bullshit to make yourself sound modern because you actually sound like an old fart bitching about "newfangled gizmos" that they don't understand.
It is funny how the media reports it as a sophisticated attack with criminal masterminds as they don't want you to know that it is something that pretty much anybody with a little tech understanding could do. They are only reporting this one because they were such clever criminal masterminds that they got caught doh! Anyone with the courage to go in to a bank masquerading as in IT contractor could plug such a device into a PC. In fact I'm sure many geeks could come up with a far less obvious solution fitted internally. The problem is banks; especially in the UK are living in the steam era and think of their buildings and therefore their internal network secure. Surely staff should be required to use some sort of NFC tag or similar so that the computer can only be operated while they are sat at it and locks when they walk away.
All that duplication of OS, and you get the perceived benefit of increased separation, but you've still go a thing running that launches other things, all on the same machine, only now with the overhead of running the first thing inside another thing inside itself....
The only security benefit is in the thing that contains the thing that runs the stuff. If this piece of software sufficiently segregates the running applications, then it is secure, if it does not, then you're in the same boat as before except you need three times the hardware just to get started.
A well-designed operating system would keep the applications just as separate with only 1x the overhead of an operating system. The fact that we're using VM's all over the place is clear evidence that we haven't got operating systems figured out right now.
Can you be Even More Awesome?!
Some times the works don't get staff ID's or it can be easy to say I got a call just now to come out or just show some paper work that looks like an work order. And they can say the system placed the call on it's own.
As stated above, any network equipment worth using has MAC filtering. Just set up all access port security as single MAC only, sticky so you don't have to hardcode them all, and shutdown on violation. Done. No more alien network interfaces on your network.
Why would you take the time to code a script but not do the bare bones network administration task of setting port security? It's only five lines of configuration on Cisco equipment:
int ra f0/x-y
switch mode acc
switch port-s mac sticky
switch port-s max 1
switch port-s vi sh
A whole lot easier than a custom one off job that will only tell you when something has already gone wrong.
Banks create money out of thin air every time somebody takes out a loan.
www.positivemoney.org
97% of the money in existence is BANK money - meaning it is a DEBT to a bank somewhere, meaning the banks (i.e. the private individuals who own them) own 97% of everything.
not who's