Slashdot Mirror
Bank Hackers Steal Millions Via Malware
An anonymous reader writes: When cybersecurity firm Kaspersky Lab was called in to investigate ATMs that had begun dispensing cash without input from users, they expected to find a simple problem. Instead, they found the ATMs were just the tip of the iceberg. The bank's internal computer systems were completely compromised, and in addition to the slow but steady siphoning of funds through physical machines, a criminal group was quietly transferring millions of dollars into foreign bank accounts. A report set to be published on Monday shows the attack extended to over 100 banks in 30 nations.
"Kaspersky Lab says it has seen evidence of $300 million in theft from clients, and believes the total could be triple that. But that projection is impossible to verify because the thefts were limited to $10 million a transaction, though some banks were hit several times. In many cases the hauls were more modest, presumably to avoid setting off alarms." Kaspersky Lab is unable to name the banks involved because of non-disclosure agreements, and no banks have come forward to acknowledge the breach. "The silence around the investigation appears motivated in part by the reluctance of banks to concede that their systems were so easily penetrated, and in part by the fact that the attacks appear to be continuing."
"Kaspersky Lab says it has seen evidence of $300 million in theft from clients, and believes the total could be triple that. But that projection is impossible to verify because the thefts were limited to $10 million a transaction, though some banks were hit several times. In many cases the hauls were more modest, presumably to avoid setting off alarms." Kaspersky Lab is unable to name the banks involved because of non-disclosure agreements, and no banks have come forward to acknowledge the breach. "The silence around the investigation appears motivated in part by the reluctance of banks to concede that their systems were so easily penetrated, and in part by the fact that the attacks appear to be continuing."
William K. Black
I want peace on earth and goodwill toward man.
We are the United States Government! We don't do that sort of thing.
"Why stop at one?" asked the Federal Reserve.
Get thee glass eyes, and, like a scurvy politician, seem to see things thou dost not.--King Lear
Bitcoin Unaffected.
Buh buh buht... uhhh... yeah... Damn. Bitcoin Unaffacted. That's all I can say.
The theory behind "not naming banks" is that if named, people would leave the bank and go to another one.
Why are banks allowed to do this? This completely negates the "vote with your wallet" power that the public should have.
It became clear to me years ago that I could only make something fool-resistant, since as soon as I imagined foolproof had been achieved, they kept making a better fool.
My takeaway: The most devilishly clever security system, devised by the most gifted programmers, in a scenario where money was no object, can still be compromised because of the human user element in the implementation of the system.
Happiness in intelligent people is the rarest thing I know.
Ernest Hemingway
..... Wait, what?
Oh. Nevermind then.
So shouldnt' they be able to trace the transfers to the destination accounts? And continue doing so until the money is withdrawn?
Hell, even in places like Kazakhstan they don't have pallet loads of $100 bills waiting around for people to withdraw millions in cash. And you don't really walk into a bank ANYWHERE in the world and pull out millions in cash from a newly opened account without tons of ID, paperwork, being on cameras, access to large armored trucks, etc.
I'm familiar with the concept of mules and blinds, but for a scheme so sophisticated it sounds suspicious to use low level mules to pull out millions in cash. Multiple points of failure/discovery.
How the hell do they get the actual money OUT?
Learning HOW to think is more important than learning WHAT to think.
..... Wait, what?
Oh. Nevermind then.
The money comes out of "a" bank not individual accounts, the bank will cover the loss, who will cover stolen Bitcoins?
dollars in a bank can be insured, how's that bitcoin insurance industry doing?
Quantitative Easing
With the Fed loaning them money at 0% and their government lackeys ready to bail them out at the drop of a hat, does $300M really matter to them? $300M barely qualifies as material to their financial statements.
Boy what a freaking scam these security firms are engaged in these days. "Gee, we can tell you what happened but that million dollar 'hush' money payout they gave us precludes us from offering any REAL protection to everyone else.
reluctance of banks to concede that their systems were so easily penetrated
Just because their systems were penetrated, doesn't mean it was easy. Why downplay the skill involved?
The theory behind "not naming banks" is that if named, people would leave the bank and go to another one.
Why are banks allowed to do this? This completely negates the "vote with your wallet" power that the public should have.
Because they signed a nondisclosure agreement, and because people are afraid of defamation lawsuits.
It is worth noting that Bank of America just had a five-day IT outage/upgrade/etc... during which their credit card interfaces had limited data, etc... It may be unrelated, but... it was for *five days*.
It may well be unrelated--credit cards v. bank accounts and all that--but it may not be. That's a *really* long time to do the public part of upgrading a system.
Anyway, it's all insured (don't read the stuff about losing your online banking password too closely), and you can always sue if they tried not to cover you, so it's not worth a run on any banks unless they start losing a lot more. At least they're paying attention.
Most of the malware problem is white listing. Spyware and malware are using government spyware signatures which are white listed by virus scanners. If you run a well-known keylogger and network spyware software it is white listed by virus scanners. Recently the poor quality antivirus product McAfee, was listing network monitoring software ( Surveillance ) by its actual name even when it was in zip format. No other virus scanning products does. No doubt within a few weeks McAfee, will no longer name it. If you mess with the governments they will come and get you and they will kill you. no virus signature scanning company is going to mess about with what ever government.
Large amounts of money are covered by the FDIC who gets their money from the treasury who gets their money from the Federal Banks who can print money stealing from any one who owns US dollars. Increasing the money supply is a hidden tax on everyone so everyone will pay for this crime.
The internet was designed to be amazingly robust, able to successfully get a message through a nuked-out infrastructure -- point A to point Z via any number of non-predetermined intermediate points. It was not designed to be secure because such security wasn't deemed necessary to the completion of the mission of getting a message to point Z from point A regardless the damage inbetween the two points.
What security it does have has been bolted on after-the-fact much like bolting a wind spoiler onto a Volkswagen Beetle. and with pretty much the same comical effect. "Secure" internet will require some serious redesign at the various hardware and sofware levels before it can be secure.
An interesting question is whether or not it can be both very robust and very secure at the same time?
My point being that the warnings about the above were made loud and clear in the mid-1990s when the internet was "discovered" by the citizenry and the commercial interests and yet everyone yelled "Full speed ahead!" and so here we are.
Everything in the Universe sucks: It's the law!
hmm, you just gave me a business idea. Alt coin insurance.
have you seen my sig? there are many others like it but none that are the same
We can and do use the insecure internet to securely transmit information.
All to often we do it wrong though. Doing it wrong means we can be fooled.
Sometimes we do it wrong on a technical level, such as using out of date encryption, fundamentally broken encryption, or worse.
Sometimes we do it on a human level, such as not occasionally verifying that the account-holder or bank employee is the one and only person who has used his credendials recently using a non-technical means.
Sometimes we do it wrong in our business practices, such as by not doing frequent-enough random audits and not forseeing that a particular type of attack is worth monitoring for. I will grant some leeway here in that "ridk management" != "risk elimination."
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Payback is a bitch.
>who will cover stolen Bitcoins?
You could implement the same scheme the government does when they cover the bank's losses. Just take a sliver of bitcoin from every single account to replace what was lost.
It's the same effect, you're all a little bit poorer each time they replace that money.
They are the malware. As for threats and force, ask the evicted, the downsized, the outsourced. Remember whatsisname representing the financial TBTFs threatening the USA's Congress with blood in the streets if they didn't get 70 (or 700?) Billion to cover their bad bets, huge debts, insolvency, negligence, crass manipulation, and general malpractice.
Banks stole trillilons, impoverished millions, financed wars, coups, drug cartels, blood diamonds (etc.), weapons, the militarization of society, and war zealots. And the USA's Federal reserve is a council of bank councils, with some US government's legal backing.
Good cue to stop reading: The piece will be devoid of meaning so even trying to figure out what really happened will be a waste of time, guaranteed. Same with any other clickbait, only now with sensationalist "security" sauce.
Too bad that most "cyber security" consists of this sort of fluff. No wonder we're not making any progress in that field.
Before Internet, I know of one group who used fraude to take only a few million USD from different banks by leaning money from one bank, falsify the papers on that loan and use it as a warranty to get a bigger loan at another bank.
They were caught because they tried to kill one person who then talked to the police.
What amazed me was that this was possible. If I have a warrenty against a loan, they will check it 27 times and then decline the value. They added some zeroes and because it was from a bank, all was well. (Ok, simplified, but still).
Seems that banks have always been less cautious compared to what they let the public believe.
Don't fight for your country, if your country does not fight for you.
what bank allows transfers of millions without paperwork??
Bitcoin can and is being insured as well. After all, it's no harder to protect Bitcoin private keys than say Verisign's root certificates, which are insured against theft as well. And it's still an unfortunate thing that our banks are so susceptible to hacking and theft. After all, whether through increased costs of private insurance or FDIC, we all pay for the losses that a bank incurs.
I am afraid that the compromised machines were running Windows. That would put the 'low cost of ownership' that Redmond propagates, in a different perspective.
... had been vaccinated at birth.
It little behooves the best of us to comment on the rest of us.
oh, yeah, poor Greeks...
I always though computer operating systems were only capable of being hacked, but thanks slashdot for giving us that technically insightful and informative heads-up ..
"First, they get physical access to the ATMs and insert a bootable CD to install the malware -- code named Tyupkin by Kaspersky Lab. After they reboot the system, the infected ATM is under their control."
"The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem"
That's what happens when you employ / usurp in cheap Asian security "experts" people!.
Payback's a bitch!!
Could this be Russia's plan to survive the sanctions and drop in oil prices?
No, some companies just started offering it. But "bitcoin is insured" is a generally false statement right now.
"When cybersecurity firm Kaspersky Lab was called in to investigate ATMs that had begun dispensing cash without input from users, they expected to find a simple problem."
The problem is that Kaspersky wasn't "called in", it's just a dubious PR tactic coupled with a journalist who (surprise, surprise) didn't do any own research. They took a discovery from December, renamed the network, inflated the amounts and spun someone else's work as their own.
Graham Cluley had a suspicion about the details which looked awfully familiar: High-tech hackers stole $300 million from 100 banks. But here's what the media forgot to tell you (http://grahamcluley.com/2015/02/bank-hackers/)
Fox-IT, who uncovered this issue last year have since responded to confirm it was indeed a rehash of an older story (https://www.fox-it.com/en/press-releases/anunak-aka-carbanak-update/) but with some inflated amounts to get news headlines.