Slashdot Mirror
Hackers Steal Bank's Crypto Credentials, But Are Foiled By Their Own Typo (reuters.com)
New submitter tlambert writes: Unknown persons stole Bangladesh Bank transfer credentials for payments via the international banking system, and then proceeded to start moving money to the Philippines and Sri Lanka. A human foiled the plot after ~$80M had been stolen with another $870M stopped, after they noticed the word 'foundation' misspelled in one of the requests. Bangladesh, meanwhile, is blaming the U.S. Federal Reserve for trusting their credentials. (Note: Bangladesh Bank isn't like Bank of America; it's the country's central bank.)
I got nothing to add after the pun in the subject line.
Mimetics Inc. Twitter
A typo the source of an almost $1BILLION mistake? Someone's going to die behind this...
Modern security especially for this kind of amount of money would really worth having an out of bond validation of money transfer.
Not taxing transaction does not means that transactions should have non null costs. So de facto the minimal tax that should be imposed to money transactions on the internet MUST be a strong real authentication of the persons out of the internet plan to validate transactions.
Else, we are just letting frauders have a good incentive to cheat. Especially since the victims are all forced to pay by subscribing insurance covering internet frauds thus internet payment actors have no incentive to stop the fraud since it is pumping their bebefits.
He always messes up some mundane detail.
Please stand clear of the doors, por favor mantenganse alejado de las puertas
(Note: Bangladesh Bank isn't like Bank of America; it's the country's central bank.)
Bangladesh Bank is like the US Federal Reserve; it's the country's central bank.
fixed that for you.
The Fed provides a variety of services to more than 200 foreign central banks, foreign governments and international official institutions.
https://www.newyorkfed.org/aboutthefed/fedpoint/fed47.html
Yes, remember when you bitch about "the bankers' that for most of the world, WE are the bankers
... to create a private and permission based blockchain between banks a la R3CEV.COM with so far 46 banks. This way, when the keys get compromised, that hacker can be the richest person in the world.
No trees were killed in the making of this post; however, many trillions of electrons were horribly inconvenienced.
I am not a banker. Never have been.
Things that make ya go ohhhhhhhhh! Im guessing the guy/girl who made the typo will be kicked out of their h@ck3r club..haha
This. It's almost like they don't want anyone trusting their credentials ever. I'd be game for that, actually.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
I fully expected that sentence to end with "they usually know how to spell security".
Not because I know the BB, but I know the BoA.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
How dare you trust the credentials that were stolen from us! You should have known they were stolen, even though we didn't even know!
Slashdot still doesnâ(TM)t support Unicode after it was added to the HTML standard in 1997.
That kind of capital is chump change for the Fed. For these foreign banks it's a lot of money. You'd expect that kind of money transfer to trigger some sort of alert before it goes through, but the Fed isn't in the business of bailing out foreign banks. I'm sure domestic banks is another story.
There is always some engineer or IT guy with the keys to the kingdom at these banks with potentially more power than Janet Yellen.
Here is what is going on at the receiving end.
http://www.gmanetwork.com/news/story/558669/money/personalfinance/businessman-go-implicates-rcbc-officer-to-money-laundering-scheme
Foreign people involved in fraud always mispell shit.
...or, at least, that's what they want you to think.
His ignorance covered the whole earth like a blanket, and there was hardly a hole in it anywhere. - Mark Twain
Bangladesh, meanwhile, is blaming the U.S. Federal Reserve for trusting their credentials.
Wat?
The FBI wants into this... clearly they used and iPhone.
Truth is stranger than fiction, but it is because Fiction is obliged to stick to possibilities; Truth isn't. Mark Twain.
And there are transaction rollback procedures in place in case that engineer or IT guy misbehaves. If Bangledesh Bank hadn't revoked the credentials, then why should the Federal Reserve bank not have trusted them? Your transaction credentials are your identity in the banking system; telling another bank not to trust your (valid and not revoked or reported compromised) credentials is effectively telling them not to trust you. I'll repeat myself: if that's what Bangledesh Bank wants, it's what they should get. they don't want their credentials to be trusted by foreign banks, let foreign banks not trust them, remove them from the world banking system, and see how long it takes them to take responsibility for their own security, fix the issue that allowed this in the first place, and come begging to once again participate in the world banking system. I give them a day or two to take responsibility and start begging, before being told to fix their shit and try again, a year or so to fix it (we're talking about government, i'm being generous), and another year to redevelop their relationships with the rest of the world banks.
You don't play soccer without a cup, then blame the other players, take your ball, and go home when you get a cleat to the nuts. That's basically what Bangledesh is doing here.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
With credentials for the central bank, they could have collapsed the entire nation. Hell, they were going to steal almost a full 1% of the nation's GDP! 1% might not sound like much, but it would have been devastating.
Good thing there wasn't a common security key like the FBI wants !!! :-P