Slashdot Mirror
Second Hacker Group Targets SWIFT Users, Symantec Warns (reuters.com)
A second hacking group has sought to rob banks using fraudulent SWIFT messages, cyber security firm Symantec said on Tuesday. The group is said to be using the same approach that resulted in $81 million in the high-profile February attack on Bangladesh's central bank. From a Reuters report: Symantec said that a group dubbed Odinaff has infected 10 to 20 Symantec customers with malware that can be used to hide fraudulent transfer requests made over SWIFT, the messaging system that is a lynchpin of the global financial system. Symantec's research provided new insight into ongoing hacking that has previously been disclosed by SWIFT. SWIFT Chief Executive Gottfried Leibbrandt last month told customers about three hacks and warned that cyber attacks on banks are poised to rise. SWIFT and Symantec have not identified specific victims beyond Bangladesh Bank. Symantec said that most Odinaff attacks occurred in the United States, Hong Kong, Australia, the United Kingdom and Ukraine.
So if I read properly, even Symantec customers are not protected against hack...
That nefarious persons, politicians and the occasional hacker will go after large sums of money that are poorly protected from theft and diversion.
Raise the moat!
Faster! Faster! Faster would be better!
But I was told Macs did not have viruses!
This is the same thing that happens with networks like SCADA systems, supposedly "air gapped" networks, etc. Even if there is no physical access to the network, it can totally be defeated by a USB key. I'm sure SWIFT has tons of security in place to protect the actual transaction, but lots of these systems that I've seen over the years have relied on the fact that they're typically isolated...which means very little these days. Because the networks are isolated, it becomes more of a pain to apply patches and updates, and network owners are less likely to bother because of this. And in the case of the SCADA stuff or a vertical-market company that doesn't really have much competition, there's little incentive for the device manufacturer or network owner to do any maintenance or write secure code in the first place.
It's kind of sad, but any networked system these days has to assume that anyone accessing it, whether inside or outside the company perimeter, is attacking it. Too many companies assume that if a machine is plugged into the "inside" network, it's safe. Changing access policies is a hard sell though, so places keep doing it and keep getting compromised.
. . . . . I interviewed with SWIFT. Nothing discussed was particularly cutting-edge, from the details I gathered (which probably aren't complete), the major feature was a interconnected set of VPNs. I mentioned dual-key cryptography and was met with a lot of blank looks. Which implies either they weren't using it, or they have a rather substantial collection of really good poker players. . .
If you want to setup secure systems and not be as vulnerable to this crap we need to open up the systems to outside scrutiny and have mechanisms in place to patch vulnerabilities expeditiously and securely. Every bank I've ever gone into seems to be running Microsoft Windows. Is it really any wonder that these systems are vulnerable and being attacked? Between government and corporate incompetence in software, hardware, and security it's no wonder this problems popping up. It is more amazing we're just now seeing it.
What we need to do to secure our systems is to reduce the bloat and build off long-term open standards. Right now that is extremely difficult to do. A start is based around EOMA68, but that's only going to go so far and is not in and of itself a secure solution. A lot of software has to be ported to the cards and housings compliant with EOMA68. EOMA68 is merely a long term interoperability standard so that you can design a computer in the form of a card and upgrade that card without replacing the rest of the hardware. It's a standard of standards (all general purpose buses). The first computer cards are based off completely free software where we have 100% of the code under free software licenses. Now we need to reduce the bloat, audit this code in its entirety, clean it up, utilize open development models, and go from there to be reasonably confident that we can be secure in the systems we utilize. We must get away from Intel/AMD whom refuse to cooperate and we are reasonably sure have included backdoors in critical components (Example: Intel Management Engine).
Professional SWIFT Admin for a large company here. Ask me anything ;-) (until sleeping time - within the next hour or so).
The article neglected to mention that the SWIFT hack only works on an Oracle database running on top of Microsoft Windows and consisted of replacing two bytes in a running process.