Slashdot Mirror
Buggy Software Made Us Miss Money Laundering Scam, Says Australian Bank (theregister.co.uk)
An anonymous reader shares a report: Australia's Commonwealth Bank has blamed a software update for a money laundering scam that saw criminals send over AU$70m (US$55m) offshore after depositing cash into automatic teller machines. News of the Bank's involvement in the laundering scam broke last week, when Australia's financial intelligence agency AUSTRAC announced that it had found over 53,500 occasions on which the Bank failed to submit reports on transactions over $10,000. All transactions of that value are reportable in Australia, as part of efforts to crimp the black economy, crime and funding of terrorism. The news was not a good look for the Bank (CBA), because most of the cash was deposited into accounts established with fake drivers licences. Worse still is that each failure of this type can attract a fine of AU$18m, leaving CBA open to a sanction that would kill it off. Today the bank has explained the reason for its failure: "a coding error" that saw the ATMs fail to create reports of $10,000+ transactions. The error was introduced in a May 2012 update designed to address other matters, but not repaired until September 2015.
Sounds to me like a couple programmers found a way to take their retirement accounts into their own hands.
The only thing necessary for evil to triumph is for it to be pitted against a slightly greater evil
No one would know about this bug except the person responsible for creating it.
Yeah, no way you couldn't have hired DIFFERENT PROGRAMMERS or purchased software from a DIFFERENT COMPANY.
Don't be so gay. Accept your responsibilities.
I didn't know they held a pageant for that.
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
Oh wait... Us
I have another idea. How about actually testing the features before deploying the software?
A coding error that was not caught in regression testing, and remained undetected and thus unpatched for years, breaking your organization's compliance... IS A BUSINESS ERROR.
Dialectician. Archology.
That's one hell of a feature
I bet they cheaped out on QA.
yeah yeah... pull the other one. I'll believe that when monkeys come flying out of my butt.
No.
Would using a provably safe language like Rust have prevented these bugs? Even if Rust can't completely prevent logic bugs, it does free programmers from having to worry about memory bugs and thread safety, allowing programmers to put more focus on avoiding logic bugs.
BINGO!!!
You said all the buzzwords on my bingo card!
I WIN!!!!
Why exactly is the ATM machine the piece that is doing the reporting? Shouldn't it be a central authority not some piece of hardware the a large number of people have physical access to?
Money laundering laws remind me of stuff like DRM, where it's primarily known for being a pain in the ass for completely innocent people, and it's assumed that crooks already know how to get around it anyway and are therefore not as inconvenienced or violated as everyone else.
Any time a money laundering law comes into play, it's very likely that it's just making things harder for (or compromising the privacy of) a non-criminal. Ergo, the laws have little legitimacy and no person worries if they're circumvented or otherwise fail.
This bug is unimportant, even if crooks did use it. The crooks are so staggeringly outnumbered by all the other people who used the ATMs too, for non-money-laundering purposes, that whatever money laundering "crime" which may have happened, simply doesn't matter.
Rust is a toddler. Many better and safer languages have been in production use for a long, long time. Three of the best in this regard are SPARK, Eiffel, and Ada. Rust is too young and untested.
I read the headline as "Buggy software made the United States win the Miss Money Laundering Scam according to an Australian bank." I think it's a title we would live up to.
With modern OS's (Memory Address randomization, have data and Executable data in different areas of the memory ) the types of bugs that Rust fixes by default will prevent a bunch of system crashes vs using low level hacking methods to control the system.
Besides the developers who are good at fixing the low level security problems are often not the same people who are good at fixing logic errors.
I find most bugs comes from management pushing the get the product done quickly. and forcing using the prototype proof of concept code into the core system.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
Rust in my opinion, has not proven itself yet.
Once the amateur programmers start using it to make shovel ware, junk programs. Then we will see how good it really is. Right now most of the Rust developers (Not all) are good at their craft and already write careful code.
Once it matures a bit, it will get the immature developers on it, meaning they will stumble on crazy hacky ways to get things done. Making all the variables mutable just because it will be easier than having compile errors.
I remember back in the old days where there were a a bunch of Computer science freshman, who will declare victory and turn in their code for grading once they get it to compile. (without testing to see if it works as directed) While luckily most of these students change majors. But a few will be happy with their 2.0 GPA and get the paper, and a job somewhere.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
declare victory and turn in their code for grading once they get it to compile ...at least they get it compiled. I've seen students submit code typed up in Word! :-/
No problem. $10bn overdraft fee please. Also, you might be lying and need to go to jail. Zero fox.
They got letters regarding the transactions from the Australian Federal Police and continued to allow it to happen... so... it sounds like being complicit to me.
Secondly... you wiuldn't out the reporting in ATM soace either. You'd build this stuff into the core transaction code that does the ledgering between accounts...fot all accounts.
I call bull.
Maybe they just Can't Be Arsed
If you gave me a choice between a printer and a giraffe with explosive diarrhoea, i'll get my ladder and my raincoat
Firstly I love to kick the crap out of Aussie banks as much as the next person. It is a national past time down her under the rest of the world.
The Aussie banking system is regulated up the wazoo,with APRA and ASIC constantly moving the regulations around to protect people from the perceived 'predatory' ways of the 'Big' Banks, being NAB, Westpac, ANZ and CBA in recent time. Now firstly these banks make obscene amounts of profits, and in the past have made some monumental screw ups/crap decisions, as have most large business, but really a big chunk of this is protection is because people want to borrow more money than they can afford so they can keep up with the Jones'.
Which brings us to the point in question, when one of the regulators makes a change, it causes a lot of change to be made across the business which takes time and money to implement. The banks aren't actually receiving any benefit from these changes, in most cases are losing business and expending real dollars in meeting the needs, otherwise they have their license jeopardised. When you have rolling changes year on year that effect the entire business and the systems that support them shit it going to get missed.
Maybe the government should look inwards at the amount of fraud that exists in the welfare, tax and health systems before targeting the banks. After all they have just decided to tax the five biggest banks AU$1.6B a year just because they can.
Just to be clear I don't work for any financial industry, I actually work in health.
If CBA are anything like the other banks their coders are all in Mumbai as they're cheap.
I once worked for another one of the Big Four aussie banks and they were busily shifting as many IT positions as possible to India.
It goes without saying the Indians were fucking useless. Tata, Wipro etc...you guys know the drill. They were lazy, incompetent, would "hide" using the time zone differences, would say yes to everything even when they knew they couldn't do it, and would stink up the HQ with curry shit when they were flown in to work onshore.
Have you ever noticed that most of them don't even wash their fucking hands after using the toilet ?? It was a running "thing" in HQ that you'd avoid using hotdesks that an Indian had been in, especially touching the phone etc...
IKR?
I worked most of career in .au, the last 10 years as a contract Information Architect. All industries NGO, .gov, Big 4s, SMEs, Energy etc are depressingly not self aware. Like a complicated soup, they struggle with the laws of thermodynamics, Chinese whispers and too many chefs.
It's depressing as a stakeholder (ie citizen, customer, investor etc) to observe. OTH, it's been a lucrative career and I am enjoying a multi year sabbatical in Europe, studying Art History and (barely) managing a porn startup.
ymmv.
Dialectician. Archology.
> Would using a provably safe language like Rust have prevented these bugs?
A programmer somewhere could have been bribed to do this deliberately. In that case, it doesn't matter whether it's COBOL/FORTRAN/C/C++/PYTHON/RUST/whatever. This was not a buffer overflow, or a null pointer. The program was WAD (Working As Designed). Someone on the design team accidentally or deliberately did this.
I'm not repeating myself
I'm an X window user; I'm an ex-Windows user