Post: #1

Did anyone catch this gem in the news?

Text of article below - to me, this is crazy, sophisticated, and exciting. What do you do with this kind of money? Where is it going? How many people are involved? Is Bangladesh worthless as a country?

Quote:Tens of millions of dollars siphoned from the Federal Reserve Bank of New York. A shadowy set of casinos in the Philippines. A large bank in Bangladesh with creaky technology. An unknown — and perhaps uncatchable — group of anonymous thieves with sophisticated hacking skills.

What unites this curious cast of characters and enabled one of the most brazen digital bank heists ever is a ubiquitous and highly trusted international bank messaging system called Swift.

Swift — the Society for Worldwide Interbank Financial Telecommunication — is billed as a supersecure system that banks use to authorize payments from one account to another. “The Rolls-Royce of payments networks,” one financial analyst said.

But last week, for the first time since hackers captured $81 million from Bangladesh’s central bank in February, Swift acknowledged that the thieves have tried to carry out similar heists at other banks on its network by sneaking into the beating heart of the global banking system.

“There are many banks out there right now saying, ‘There but for the grace of God go us,’” said Gareth Lodge, a payments analyst at Celent, a financial consulting firm.

The admission that the attack was not a one-time event in a developing country but perhaps part of a broader threat has thrust Swift into a spotlight, raising questions about how securely money is being moved around the world. Some financial security experts point out the Swift system is only as safe as its weakest link.

The attack also reflects a growing sophistication among digital criminals, who for years have been breaching personal bank accounts and stealing credit card credentials. The thieves in Bangladesh may have spent months lurking inside the central bank’s computers, studying how to steal the necessary credentials to gain access to Swift.

Data Breaches in the Financial Industry
About half of the data breaches at financial institutions are made via the institutions’ web applications, according to Verizon’s 2016 Data Breach Investigations Report. The report shows the top digital threats by industry.

“The trend is moving from opportunistic crime to Hollywood-scale attacks,” said Mr. Nish, whose firm has analyzed the malware believed to have been used in the Bangladesh breach.

In the United States, most banks take special precautions with their Swift computers, building multiple firewalls to isolate the system from the bank’s other networks and keeping the machines physically isolated in a separate locked room.

But elsewhere, some banks take far fewer precautions. And security experts who have analyzed the Swift breach said they had concluded that the Bangladesh bank may have been particularly vulnerable to an attack.

“Swift is a great organization,” said Chris Larsen, the founder of Ripple, a financial technology company that aims to speed up global money transmissions. “But the system is fractured and antiquated. The way it is set up, you cannot totally isolate problems in a place like Bangladesh from the whole network.”

In some ways, Swift is a testament to how technology has helped all countries — including poorer ones — gain access to the financial system. But that broader access has a downside.

The central bank in Bangladesh, by some accounts, employed fewer protections against cyberattacks than many other large banks. The bank, for example, used $10 routers and no firewalls, according to news reports.

The server software that the Bangladesh bank employed was a Swift product called Alliance Access, which connects banks to the central messaging system. In a sign of how seriously Swift regards the breach of Alliance Access, the group issued a “mandatory software update” last week to help its members identify possible irregularities.

The central bank of Bangladesh, in Dhaka, the capital. The heist was timed so that when Federal Reserve officials tried to contact Bangladesh, it was a weekend there and no one was working. By the time central bankers in Bangladesh discovered the theft, it was the weekend in New York and the Fed was closed. Credit Ashikur Rahman/Reuters

“These hackers figured out this was a weak point on the periphery, and they went for it,” said Jeffrey Kutler, editor in chief at the Global Association of Risk Professionals, a trade group. “But they were not able to compromise the core.”

Swift’s core is built on technology that has been evolving for decades. What began in 1973 as a relatively small network of 240 banks in Europe and North America is now a sprawling network of 11,000 users that includes both banks and large corporations. At first, Swift could be used to authorize payments across national borders. But it is now also used to transmit messages related to domestic payments, securities settlements and other transactions.

Swift’s growth in recent years — it set a record for messages in March — reflects the increasingly global and interconnected nature of finance. But it also shows the risk of so many financial instructions running through a single system made up of a patchwork of banks and companies with varying levels of online protection.

Each bank on the Swift network is identified by a set of codes. And it was the codes assigned to the Bank of Bangladesh that were recognized — correctly — by the Federal Reserve Bank of New York when it transferred $81 million of the Bangladesh bank’s money to the Philippines, not knowing that someone, somewhere, had stolen the credentials of the Bangladesh bank and installed malware to cover his or her tracks.

Initially, the thieves requested the transfer of $951 million into a handful of bank accounts in Sri Lanka and the Philippines — a number that prompted the New York Fed to ask the Bangladesh bank to reconfirm that it indeed wanted to move the money.

In the end, the Fed processed only five of the 35 fraudulent payment requests, after it could not reconfirm with officials in Bangladesh.

The hackers seemed to time the attack perfectly: When officials from the Fed tried to reach out to Bangladesh, it was a weekend there and no one was working. By the time central bankers in Bangladesh discovered the fraud, it was the weekend in New York and the Fed offices were closed.

To conceal the crime, the malware disabled a printer in the Bangladesh bank to prevent officials from reviewing a log of the fraudulent transfers.

Representative Carolyn B. Maloney, Democrat of New York, has called for an investigation into the theft. Credit Robin Caplin/Bloomberg
The money was transferred to accounts in the Philippines and then into the Philippine casino system, which is exempt from many of the country’s anti-money-laundering requirements.

The New York Fed has been criticized for letting the $81 million slip out. Representative Carolyn B. Maloney, a New York Democrat and member of the Financial Services Committee, has called for an investigation, warning that the breach “threatens to undermine the confidence that foreign central banks have in the Federal Reserve, and in the safety and soundness of international monetary transactions.”

The New York Fed said in a statement that “there is no evidence that any Fed systems were compromised” and that the transfer of the money had been “fully authenticated” by Swift.

Swift, which prides itself on its secrecy and low public profile, also put out a statement about the attacks. But its executives declined to speak on the record about the episodes, which are still under investigation. The group’s chairman, Yawar Shah, who is a senior executive at Citigroup, also declined to comment.

In its statement, Swift emphasized that the hackers had been able to breach only some of the banks that communicate over Swift, not the network itself.

“The commonality in what we have seen is that (internal or external) attackers have successfully compromised banks’ own environments,” Swift said.

Even if officials at the Bangladesh bank had employed the highest of security measures, the thieves displayed a level of skill, cunning and determination that may have been able to penetrate a far more secure system.

“If you have an attacker who really wants to get in and knows there is a big prize,” Mr. Nish said, “keeping them out over the long term is really difficult.”

Post: #2

Post: #3

So that's what gmanifesto has been up to . . .

Post: #4

These aren't hackers, these are bank robbers, get the story straight.

Post: #5

These guys are extremely skilled at stealing.
There is a very slim chance they will get caught.
Kudos to them for figuring out the loopholes and weakness within the Swift system.

For the record this group is what hackers truly are.
Most of anonymous are just script kiddies who DDoS systems for kicks.
Most of the encrypted systems they gain access have weak real-world security measures that allow them electronic access.
Think "social engineering"

Post: #6

(05-13-2016 08:54 PM)BassPlayaYo Wrote:  These aren't hackers, these are bank robbers, get the story straight.

In fact, they are both.

Post: #7

Quote:The money was transferred to accounts in the Philippines and then into the Philippine casino system, which is exempt from many of the country’s anti-money-laundering requirements.

Well played BB, well played.

Quote:The bank had no firewall, which is designed to block unauthorised access requests. It also used second-hand internet routers, which had cost $10, to connect to global financial networks.

Apparently that was only one of a string of attacks, they have since hit a Vietnamese bank

Post: #8

(05-14-2016 12:59 AM)kinjutsu Wrote:  These guys are extremely skilled at stealing.
There is a very slim chance they will get caught.
Kudos to them for figuring out the loopholes and weakness within the Swift system.

With 81 Mil in cash at stake, id say the incentive to find them outside of law enforcement is very high. Whos stopping some cleverer stickup man from taking the cash off of them?

Post: #9

That is some serious money, I wonder what would be the punishment for them in Bangladesh if they ever get caught.

Post: #10

If they're smart enough to get this kind of money then they're not dumb enough to start carrying it around with then.

That said, whatever cumuppins befall them will quite possible be extralegal in nature. I don't doubt the marks in this case are above hiring professional hitmen to settle a score like this.

At the end of the day the average schmuck on the street will pick up a nickel or two in extra banking fees, be little the wiser about it, and the world of finance will keep turning.

Post: #11

They can't legally get to them but it's still easy for them to follow the money. From there they just need to hire some muscle to shake them up and get it back.

You'd have to be constantly on the move to avoid getting caught but it sounds like instead they're posted up in the Philippines.

Good luck BB.

Post: #12

^ Story of my life.

Beyond All Seas

"The individual has always had to struggle to keep from being overwhelmed by the tribe.
To be your own man is a hard business. If you try it, you'll be lonely often, and sometimes
frightened. But no price is too high to pay for the privilege of owning yourself." - Kipling

Post: #13

Post: #14

No firewall? Zero sympathy. Very typical of some financial organisations, who put IT spending as a "cost" not an investment for the stability of their business.