Slashdot Mirror
$10 Router, No Firewall Blamed In $80M Bangladesh Bank Hack (reuters.com)
Earlier this a year, a spelling mistake in an online bank transfer prevented nearly $1 billion heist at Bangladesh's central bank and the New York Fed. The hackers, however, still had managed to steal about $80 million. Bangladesh government blamed the New York Fed for not spotting the suspicious transactions earlier. As it turns out, they should also be taking some blame, if not all. An anonymous reader writes: Bangladesh's central bank was vulnerable to hackers because it did not have a firewall and used second-hand, $10 switches to network computers connected to the SWIFT global payment network, an investigator into one of the world's biggest cyber heists said. The shortcomings made it easier for hackers to break into the Bangladesh Bank system earlier this year and attempt to siphon off nearly $1 billion using the bank's SWIFT credentials, said Mohammad Shah Alam, head of the Forensic Training Institute of the Bangladesh police's criminal investigation department.
Make the 81M come of the VP's bonus.
That $10 switch seems alot of like some cost reduction yahoo is calling the shots and does not want to pay for the needed costs to due it right.
More H-1b visas! Send them our way since they're so good at securing their own networks.
We will bankrupt ourselves in the vain search for absolute security. -- Dwight D. Eisenhower
Headline states $10 router, but story states $10 switches. Who's not paying attention?
Good point, App Guy! If they were running their bank using apps they would have been on wifi, and they'd at least have been behind NAT and had a minimal firewall.
It would be an improvement!
I miss GNAA more every day.
"Prediction: within 10 years, Windows will be a Linux distribution." Me, 7-6-2016
If you buy a cheap switch/router/hub you get a poor performance switch/router/hub or an unreliable switch/router/hub, not a hackable network. The protocol is totally encrypted end to end and getting access to a switch won't give you the keys to anything. So, the cheap switch/router/hub is totally irrelevant in this picture.
Next, the lack of a firewall, again here, it all depends on how the network is built. Is it a single computer, single purpose network and the only port open on the computer is the port required by the SWIFT network? If yes, adding a firewall won't make it more secure neither. It is already listening on the port that would have been open by the firewall anyway. On another hand, if the computer is listening on multiple ports with pieces of software known to be flawn, it is likely to be vulnerable to an attack and maybe the encryption keys have been stolen or maybe not. We still don't know how the attack was successfully completed. So far, it is more likely someone just gave the keys and password to the hackers. It could be an inside job.
BTW, expensive switches/routers/hubs are not necessarily more secure than cheaper one. They are made to be more reliable on 7/24 operations and have an larger capacity. That's where most of the price difference is justified to the customer
Achille Talon
Hop!
Make the 81M come of the VP's bonus.
That $10 switch seems alot of like some cost reduction yahoo is calling the shots and does not want to pay for the needed costs to due it right.
I dunno... reading through the hacking team break-in (by which I mean, reading the hacker's first-person description, it's unclear to me how *anyone* could be considered responsible for these sorts of things.
The hacked system should encrypt passwords, use a salt, have offsite backups that are regularly tested... all that "of course" stuff applies.
But I'm not at all sure how having a modem or router hacked could be the responsibility of the system.
How can you tell? Is there an exploit for your high-end Juniper firewall?
The hacking-team narrative suggests that the person who did it replaced the [router?] firmware with a custom one with his own backdoor. A single 0day exploit on an internet-facing appliance.
Did someone intentionally weaken the PRNG in your Intel CPU at the mask level? Did someone replace the firmware on your hard drive? Is your BIOS compromised?
I read where someone put malware into the firmware of an intelligent *battery*.
Welcome to the future: everything has firmware, and all firmware can be reflashed by the factory.
(The update service installed when you install our product will automatically upgrade the system as needed. Just download and execute! This fixes the rendering issue in the Tagalog language pack, it's a *must have* upgrade!)
I'm not sure how anyone can guarantee their systems are secure any more.
If the State department can't secure their computers, what hope is there for regular mortals?
North Korea's been hurting under the new sanctions. The amount of money that was almost stolen is insane for a person to steal but makes sense for a country (or more specifically, a military and ruling party) to steal. It was a well-organized effort involving many people. They were caught because of a mistake that an English-speaker wouldn't make.
"When information is power, privacy is freedom" - Jah-Wren Ryel
No.
More like bob we don't need a firewall just need a switch to get on the network so what can you do for $10 get a router/firewall that can't handle the load or just a basic switch that will work.
It is so painful reading your posts...
I'm sorry, why is Wi-Fi intrinsically using NAT? You are barely more knowledgeable than the OP, and at least he has a humorous, sarcastic point.
If it ain't broke, don't fix it.
From the way the article words it they hadn't even segmented the broadcast domains -- the sensitive servers were in the same VLAN as everything else -- nothing to do with logging capabilities, really -- they were apparently using a dumb switch with no dot1q capabilities whatsoever.
Someone had to do it.
Near the end of the article is the better info...
The SWIFT connected computers should have at least been hived off into a separate VLAN. They weren't.
Be nice. Slashdot readership is no longer technical. Be happy that he (almost) did better than Hollywood screenwriters.
Serious? Seriousness is well above my pay grade.