Slashdot Mirror
Another British Bank Hit By KVM Crooks
judgecorp writes "Another British bank — Barclays — has been hit by a fraud attempt using a stealthily-planted KVM (keyboard, video, mouse) device. Unlike the previous attempt on Santander, the crooks got away with £1.3 million, but were subsequently apprehended by the Metropolitan Police's Central e-Crimes Unit."
Makes you wonder how many other times has this been done where the crooks got away scott free and the bank just didn't want to go public about it?
When information is power, privacy is freedom.
... to good old security? You know, checking who gets into the staff premises of a bank?
I bet they thought it was a low risk area, because it was only handling "data". But "data" is money...
Looks like a KVM-over-IP box, possibly. But those don't have video passthrough, so it'd be detected in no time at all. I can see how such a scam could work (KVM-over-IP + access point + VGA splitter), but not with the hardware described. You'd have to depend on employees leaving their station unlocked, but that is going to happen sooner or later.
I'm not sure if this is a deliberate Met policy of withholding the details of crimes to prevent imitation, or just non-technical reporting trying to express complicated networkystuff in a manner the layperson can understand.
You certainly couldn't get it at PC World, though. They only sell consumer gear. You might be able to get a plain local KVM if you're very lucky, but a KVM over IP? No chance. A quick check of their website shows no KVMs of any variety.
Can we rename it VKM, so that it doesn't conflict with Kernel-based Virtual Machine?
They will just ask Central Bank to print some extra money. Problem solved. For the rest of you, go to work to earn some pennies.
I'm assuming you are from the US, because that is were this "printing money is bad" meme seems to have been resurrected lately. Central banks are managing the money supply to balance and the economy, and in most modern western economies this is working as intended - keeping a stable currency value, steady low inflation and fueling economic growth or counteracting recession. Outside that the slogan "printing money" sounds like something bad is going on, I don't really understand what it is about the real world effect of this that you are dissatisfied with.
If there was no "printing money" you would get deflation, which would be really bad for any modern economy. For one it increases the real value of debt, curbing investments, contributing to or amplifying recession and can lead to a deflationary spiral. (on a personal scale, imagine your house mortgage just growing and growing in real value you owe, the actual house value would not necessarily follow)
They will just ask Central Bank to print some extra money. Problem solved.
For the rest of you, go to work to earn some pennies.
I'm assuming you are from the US, because that is were this "printing money is bad" meme seems to have been resurrected lately. Central banks are managing the money supply to balance and the economy, and in most modern western economies this is working as intended - keeping a stable currency value, steady low inflation and fueling economic growth or counteracting recession.
So I see the brainwashing regarding "minor inflation is good" did work on you. Back in my day, we had a word for FALLING prices on essential goods, it was called "progress".
Also known as some people with a bit of technical knowledge and a grasp of basic social engineering. Gotta love it when they make something sound like rocket science so folks won't realize what little is really involved.
The access might have been fairly straight forward, but we don't know what they did with it. What do you do once you are in? Just because you're on the banks network doesn't mean it's easy to steal money. I'm thinking back to the last time I was in a machine room on my own at a bank and wondering what I could have done if I'd wanted to, not really sure. Maybe you can find a convenient gui with buttons like "add money to an account (untraceable)" but failing that you're going to need a reasonable amount of IT/banking knowledge. If you're wanting to mod a CICS transaction written in COBOL to siphon off money without leaving any trace then you'll need more skills than the average crook. On the other hand they got caught, so maybe it was all over their heads...
So I see the brainwashing regarding "minor inflation is good" did work on you. Back in my day, we had a word for FALLING prices on essential goods, it was called "progress".
Yeah, I would love to see the price on my house keep falling in value while the debt keep growing.. On the business side this effect will limit investments.
When I was syadmin a few years ago, I really used to get SO bloody angry with the maintenance guys, as they used to call in photocopy machine engineers when the things went wrong. Of course, they never informed the IT department (ME!), so all of a sudden, when I was going somewhere, I saw an 'unknown' guy hooked up with a laptop on the companies network *.
No matter WHAT I told them about security, it didn't matter - a working photocopier was more important than security.
This is obviously a similar situation - some 'official looking' technical guy turns up, tells a few porkies, and the staff just let him get on with it without any checks.
* I later coded a short perl script to send me a mail when an unknown MAC connected to the LAN.
Because they used an electronic gadget in the commission of a crime? This was a social engineering ploy, the tech played a minor role. Even TFA (yes, I read it) explained that the technology involved was "crude."
The "tech expert" they interviewed is just adding fuel to the idiot fire by explaining that antivirus won't help, giving undeserved credence to the notion that this was a technological attack.
Stop prefixing e- and cyber- and other bullshit to make yourself sound modern because you actually sound like an old fart bitching about "newfangled gizmos" that they don't understand.
It is funny how the media reports it as a sophisticated attack with criminal masterminds as they don't want you to know that it is something that pretty much anybody with a little tech understanding could do. They are only reporting this one because they were such clever criminal masterminds that they got caught doh! Anyone with the courage to go in to a bank masquerading as in IT contractor could plug such a device into a PC. In fact I'm sure many geeks could come up with a far less obvious solution fitted internally. The problem is banks; especially in the UK are living in the steam era and think of their buildings and therefore their internal network secure. Surely staff should be required to use some sort of NFC tag or similar so that the computer can only be operated while they are sat at it and locks when they walk away.
All that duplication of OS, and you get the perceived benefit of increased separation, but you've still go a thing running that launches other things, all on the same machine, only now with the overhead of running the first thing inside another thing inside itself....
The only security benefit is in the thing that contains the thing that runs the stuff. If this piece of software sufficiently segregates the running applications, then it is secure, if it does not, then you're in the same boat as before except you need three times the hardware just to get started.
A well-designed operating system would keep the applications just as separate with only 1x the overhead of an operating system. The fact that we're using VM's all over the place is clear evidence that we haven't got operating systems figured out right now.
Can you be Even More Awesome?!
Some times the works don't get staff ID's or it can be easy to say I got a call just now to come out or just show some paper work that looks like an work order. And they can say the system placed the call on it's own.
The problem is when you print money and use it to bail out a private entity that is considered too big to fail. Particularly when you also keep socking it to individuals who are apparently too small to succeed.
Don't you know? The process involves plugging the lan cable into your ear and then playing a video game involving glowing buildings by waving your hands in the air.
This replaced the old interface where the computer would ask you in a 60 point font if you wanted all of da money.
Install it on one of the computers processing transfers.
Let it run for a week while monitoring patterns and learning gui.
Prepare some dodgy accounts, usually you take a hobo off the street, clean him up, make him open proper bank account, give him drugs/vodka/whatever he wants and drop him off where you found him. You use those accounts regularly to make them look legit.
Once you have your window of opportunity (lunch break, loo visit, whatever) start transferring money to a bunch of accounts you prepared earlier.
Immediately go on a shopping spree, commodities (truck full of cigarettes, TVs, even hi end food). It might seem small time until you realize truck with cigs is worth couple of million euros.
Who logs in to gdm? Not I, said the duck.
So I see the brainwashing regarding "minor inflation is good" did work on you. Back in my day, we had a word for FALLING prices on essential goods, it was called "progress".
Yeah, I would love to see the price on my house keep falling in value while the debt keep growing.. On the business side this effect will limit investments.
Solution: don't get in debt. On the grand scale of things, mortgages are a very new "invention".