Slashdot Mirror

← Back to Stories (view on slashdot.org)

$10 Router, No Firewall Blamed In $80M Bangladesh Bank Hack (reuters.com)

Posted by msmash on from the router-rapidly-routed-rupees dept.

Earlier this a year, a spelling mistake in an online bank transfer prevented nearly $1 billion heist at Bangladesh's central bank and the New York Fed. The hackers, however, still had managed to steal about $80 million. Bangladesh government blamed the New York Fed for not spotting the suspicious transactions earlier. As it turns out, they should also be taking some blame, if not all. An anonymous reader writes: Bangladesh's central bank was vulnerable to hackers because it did not have a firewall and used second-hand, $10 switches to network computers connected to the SWIFT global payment network, an investigator into one of the world's biggest cyber heists said. The shortcomings made it easier for hackers to break into the Bangladesh Bank system earlier this year and attempt to siphon off nearly $1 billion using the bank's SWIFT credentials, said Mohammad Shah Alam, head of the Forensic Training Institute of the Bangladesh police's criminal investigation department.

7 of 96 comments (clear)

  1. Make the 81M come of the VP's bonus by Joe_Dragon · · Score: 4, Informative

    Make the 81M come of the VP's bonus.

    That $10 switch seems alot of like some cost reduction yahoo is calling the shots and does not want to pay for the needed costs to due it right.

    1. Re:Make the 81M come of the VP's bonus by anegg · · Score: 5, Interesting

      If I were analyzing their security, I would be much more concerned with the "no firewall" comment than how much they spent on a switch... No firewall, really? Bet they saved a lot of money not having to put that in place and monitor it....

    2. Re:Make the 81M come of the VP's bonus by anegg · · Score: 4, Informative

      Ok - after reading the article, I think they might not have had any security architecture whatsoever. No compartmentalization of data flows. No firewall. Probably no monitoring. And judging from the comments, no traffic accounting/auditing capability.

      It seems like they had no understanding of the IT risks at all.

    3. Re:Make the 81M come of the VP's bonus by GungaDan · · Score: 4, Funny

      Coming soon - this bank outsources IT to neighboring India.

      --
      Eloi are stupid, throw morlocks at them!
    4. Re:Make the 81M come of the VP's bonus by l0n3s0m3phr34k · · Score: 4, Informative

      That article is crap lol. This article is far more interesting... Like how one of the security researches was abducted for several days, "malware was specifically designed to hijack access to the Swift network", Bangladesh Finance Minister A.M.A Muhith saying local banking officials were "100 percent" involved in the scandal, Rizal Commercial Banking Corporation (RCBC) President and CEO Lorenzo Tan ordering people to "move the money", how much of it has already been converted into Chinese casino chips, etc. This would make a great movie, it's so convoluted and messed up lol. It's even got "a man previously linked to illegal drug operations, Kim Wong, as the mastermind." per Philippines Senator Sergio Osmeña.

    5. Re:Make the 81M come of the VP's bonus by rahvin112 · · Score: 5, Funny

      You are apparently unaware of how finances work in states like Bangladesh.

      1. The government apportions the appropriate money for a task assuming market. Rates
      2. Department head siphons off 5% of the money and uses it to pay for Hookers and Blow.
      3. The Department manager awards the contract to a friend who then gives them 10% of the money remaining back as cash.
      4. The department representative responsible for ensuring the requirements are met then gets his 5% remaining kickback as well to look the other way as the requirements are not met. There are various other kickbacks as well, the city inspector and other involved.
      5. The company now responsible for the implementation has lost about 25% of the total. They then taken their 50% profit and buy $10 off the shelf routers to do a job that had originally required commercial grade products with support contracts and zero day support.

  2. I dunno... by Okian+Warrior · · Score: 4, Interesting

    Make the 81M come of the VP's bonus.

    That $10 switch seems alot of like some cost reduction yahoo is calling the shots and does not want to pay for the needed costs to due it right.

    I dunno... reading through the hacking team break-in (by which I mean, reading the hacker's first-person description, it's unclear to me how *anyone* could be considered responsible for these sorts of things.

    The hacked system should encrypt passwords, use a salt, have offsite backups that are regularly tested... all that "of course" stuff applies.

    But I'm not at all sure how having a modem or router hacked could be the responsibility of the system.

    How can you tell? Is there an exploit for your high-end Juniper firewall?

    The hacking-team narrative suggests that the person who did it replaced the [router?] firmware with a custom one with his own backdoor. A single 0day exploit on an internet-facing appliance.

    Did someone intentionally weaken the PRNG in your Intel CPU at the mask level? Did someone replace the firmware on your hard drive? Is your BIOS compromised?

    I read where someone put malware into the firmware of an intelligent *battery*.

    Welcome to the future: everything has firmware, and all firmware can be reflashed by the factory.

    (The update service installed when you install our product will automatically upgrade the system as needed. Just download and execute! This fixes the rendering issue in the Tagalog language pack, it's a *must have* upgrade!)

    I'm not sure how anyone can guarantee their systems are secure any more.

    If the State department can't secure their computers, what hope is there for regular mortals?