Slashdot Mirror
Buggy Software Made Us Miss Money Laundering Scam, Says Australian Bank (theregister.co.uk)
An anonymous reader shares a report: Australia's Commonwealth Bank has blamed a software update for a money laundering scam that saw criminals send over AU$70m (US$55m) offshore after depositing cash into automatic teller machines. News of the Bank's involvement in the laundering scam broke last week, when Australia's financial intelligence agency AUSTRAC announced that it had found over 53,500 occasions on which the Bank failed to submit reports on transactions over $10,000. All transactions of that value are reportable in Australia, as part of efforts to crimp the black economy, crime and funding of terrorism. The news was not a good look for the Bank (CBA), because most of the cash was deposited into accounts established with fake drivers licences. Worse still is that each failure of this type can attract a fine of AU$18m, leaving CBA open to a sanction that would kill it off. Today the bank has explained the reason for its failure: "a coding error" that saw the ATMs fail to create reports of $10,000+ transactions. The error was introduced in a May 2012 update designed to address other matters, but not repaired until September 2015.
Sounds to me like a couple programmers found a way to take their retirement accounts into their own hands.
The only thing necessary for evil to triumph is for it to be pitted against a slightly greater evil
I knew Teslas and other modern cars have a lot of software, but I never new there had been so many advances in buggies. Cool that you can cloak money laundering on a buggy with software!
No one would know about this bug except the person responsible for creating it.
Yeah, no way you couldn't have hired DIFFERENT PROGRAMMERS or purchased software from a DIFFERENT COMPANY.
Don't be so gay. Accept your responsibilities.
I didn't know they held a pageant for that.
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
Would using a provably safe language like Rust have prevented these bugs? Even if Rust can't completely prevent logic bugs, it does free programmers from having to worry about memory bugs and thread safety, allowing programmers to put more focus on avoiding logic bugs.
Oh wait... Us
A coding error that was not caught in regression testing, and remained undetected and thus unpatched for years, breaking your organization's compliance... IS A BUSINESS ERROR.
Dialectician. Archology.
That's one hell of a feature
I bet they cheaped out on QA.
yeah yeah... pull the other one. I'll believe that when monkeys come flying out of my butt.
Why exactly is the ATM machine the piece that is doing the reporting? Shouldn't it be a central authority not some piece of hardware the a large number of people have physical access to?
Money laundering laws remind me of stuff like DRM, where it's primarily known for being a pain in the ass for completely innocent people, and it's assumed that crooks already know how to get around it anyway and are therefore not as inconvenienced or violated as everyone else.
Any time a money laundering law comes into play, it's very likely that it's just making things harder for (or compromising the privacy of) a non-criminal. Ergo, the laws have little legitimacy and no person worries if they're circumvented or otherwise fail.
This bug is unimportant, even if crooks did use it. The crooks are so staggeringly outnumbered by all the other people who used the ATMs too, for non-money-laundering purposes, that whatever money laundering "crime" which may have happened, simply doesn't matter.
I read the headline as "Buggy software made the United States win the Miss Money Laundering Scam according to an Australian bank." I think it's a title we would live up to.
No problem. $10bn overdraft fee please. Also, you might be lying and need to go to jail. Zero fox.
They got letters regarding the transactions from the Australian Federal Police and continued to allow it to happen... so... it sounds like being complicit to me.
Secondly... you wiuldn't out the reporting in ATM soace either. You'd build this stuff into the core transaction code that does the ledgering between accounts...fot all accounts.
I call bull.
Maybe they just Can't Be Arsed
If you gave me a choice between a printer and a giraffe with explosive diarrhoea, i'll get my ladder and my raincoat
Firstly I love to kick the crap out of Aussie banks as much as the next person. It is a national past time down her under the rest of the world.
The Aussie banking system is regulated up the wazoo,with APRA and ASIC constantly moving the regulations around to protect people from the perceived 'predatory' ways of the 'Big' Banks, being NAB, Westpac, ANZ and CBA in recent time. Now firstly these banks make obscene amounts of profits, and in the past have made some monumental screw ups/crap decisions, as have most large business, but really a big chunk of this is protection is because people want to borrow more money than they can afford so they can keep up with the Jones'.
Which brings us to the point in question, when one of the regulators makes a change, it causes a lot of change to be made across the business which takes time and money to implement. The banks aren't actually receiving any benefit from these changes, in most cases are losing business and expending real dollars in meeting the needs, otherwise they have their license jeopardised. When you have rolling changes year on year that effect the entire business and the systems that support them shit it going to get missed.
Maybe the government should look inwards at the amount of fraud that exists in the welfare, tax and health systems before targeting the banks. After all they have just decided to tax the five biggest banks AU$1.6B a year just because they can.
Just to be clear I don't work for any financial industry, I actually work in health.
If CBA are anything like the other banks their coders are all in Mumbai as they're cheap.
I once worked for another one of the Big Four aussie banks and they were busily shifting as many IT positions as possible to India.
It goes without saying the Indians were fucking useless. Tata, Wipro etc...you guys know the drill. They were lazy, incompetent, would "hide" using the time zone differences, would say yes to everything even when they knew they couldn't do it, and would stink up the HQ with curry shit when they were flown in to work onshore.
Have you ever noticed that most of them don't even wash their fucking hands after using the toilet ?? It was a running "thing" in HQ that you'd avoid using hotdesks that an Indian had been in, especially touching the phone etc...
IKR?
I worked most of career in .au, the last 10 years as a contract Information Architect. All industries NGO, .gov, Big 4s, SMEs, Energy etc are depressingly not self aware. Like a complicated soup, they struggle with the laws of thermodynamics, Chinese whispers and too many chefs.
It's depressing as a stakeholder (ie citizen, customer, investor etc) to observe. OTH, it's been a lucrative career and I am enjoying a multi year sabbatical in Europe, studying Art History and (barely) managing a porn startup.
ymmv.
Dialectician. Archology.
> Would using a provably safe language like Rust have prevented these bugs?
A programmer somewhere could have been bribed to do this deliberately. In that case, it doesn't matter whether it's COBOL/FORTRAN/C/C++/PYTHON/RUST/whatever. This was not a buffer overflow, or a null pointer. The program was WAD (Working As Designed). Someone on the design team accidentally or deliberately did this.
I'm not repeating myself
I'm an X window user; I'm an ex-Windows user