Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bank Hackers Steal Millions via Malware

nytimes.com

Post reply on HN
Print view View original

21–30 of 81 posts

Re: Bank Hackers Steal Millions via Malware

#21

Post by chubot »

aidos wrote: post #9
chubot wrote: post #4

So what defenses should an organization employ to prevent these types of attacks? From this non-technical article, it looks like they penetrated employees' computers and used their credentials, which makes sense because it's probably the weakest link. It reminds me the philosophy/motivation behind Qubes OS [1]: there is no server security without client security. What are banks running on employee computers these day…

It's just staggering. I know it's silly to think that banks would be better than anyone else, but good lord, malware running on machines capable of transferring millions of dollars that's able to send out video feeds from the network without anyone noticing?! Your various IT/Security teams should be absolutely ashamed. And then the banks don't even have to stand up and admit their incompetence publicly; that's a tota…

So are you saying that bank IT is no better than corporate IT? They don't have any special software or policies? (like the star network thing I mentioned)

I would honestly expect it to be a bit better than average. I suppose there are many different types of banks and they all vary. Let's just consider your chain banks like Wells Fargo or BoA, since I'm sure somebody around here has worked at one of those places.

Re: Bank Hackers Steal Millions via Malware

#23

Post by kirvyteo »

"But the largest sums were stolen by hacking into a bank’s accounting systems and briefly manipulating account balances. Using the access gained by impersonating the banking officers, the criminals first would inflate a balance — for example, an account with $1,000 would be altered to show $10,000. Then $9,000 would be transferred outside the bank. The actual account holder would not suspect a problem, and it would take the bank some time to figure out what had happened."

A naive thought...if they leave with the exact amount of money (left) in the bank, should it be seen as just "illegal inflation", rather than seeing it as a theft. Someone made a gain but nobody made a loss in any case. Banks have always created more liquidity officially through loans, except that it is legal.

Re: Bank Hackers Steal Millions via Malware

#24

Post by [deleted] »

aceperry wrote: post #16

I laugh whenever someone tells me that they never buy anything over the internet. Their reasoning is that they're afraid of hackers going after online transactions. It seems to me that most of the serious security problems reside in the places that keep your money or access to your money, such as banks, credit cards, or even businesses such as Anthem, etc. Another problem that I've seen from banks is that they all us…

[deleted]

Re: Bank Hackers Steal Millions via Malware

#25

Post by chubot »

contingencies wrote: post #19
chubot wrote: post #4

So what defenses should an organization employ to prevent these types of attacks? From this non-technical article, it looks like they penetrated employees' computers and used their credentials, which makes sense because it's probably the weakest link. It reminds me the philosophy/motivation behind Qubes OS [1]: there is no server security without client security. What are banks running on employee computers these day…

So what defenses should an organization employ to prevent these types of attacks? Infrastructure architect at a major Bitcoin exchange here. It's about defense in depth. Processes. An architecture level stance like "do not trust the client, the server, the network, the data center, the hardware provider, or any particular stage within those three elements". Each element validates the other. An alarm raised by inappro…

So, I'm specifically asking about protecting employees' machines. My reading of the article is that the attackers got a foothold on employees' machines and credentials, and just piggybacked their malicious transactions along with normal transactions.

In that case, it doesn't matter how much security you have in your data center. Employees need access to central systems to do their job, so client security is paramount.

For instance, for a bank or Bitcoin exchange, I think it would relevant how many client operating systems can access your crown jewels. I think if you're just using Mac or Windows with antivirus or whatever, there's already a pretty low upper bound on your client security and thus your overall system security.

What I'm wondering if anybody is deploying some kind of custom client OS similar in spirit to Qubes OS, or a build of Chromium OS or Android, which have application sandboxing beyond what stock Linux, Mac or Windows have.

Also, I would imagine that each teller has their own credentials, and the bank should have policies about the transaction rate / total for a single teller. It sounds like the attackers would have to compromise multiple employee accounts to steal that much money. So you also want to protect employees machines from each other as much as possible (not just "outside" attackers).

I'm guessing that a Bitcoin Exchange doesn't have that many employees, since the whole industry is new. You probably have people just accessing stuff with their personal MacBooks or whatever, and that's fine for now (there are bigger risks). But when you start to have 100, 1000, 10,000 employees capable of doing financial damage, then I think this type of thing will start to matter more.

EDIT: Actually I remember one large deposit I made required three people at a bank to approve it. The teller said, "Wait my boss has to approve this." Then the boss said, "Wait my boss has to approve this". So they are probably using the presence of three credentials and credentials at a sufficient employee level to authorize large transactions. So I take it the attackers would have to target employees with those credentials.

But that can cause problems for customers -- e.g. if the branch manager isn't around, you might not be able to do what you wanted. To some degree, they are using meat space protocols to mitigate risk that their software systems can't handle.

Re: Bank Hackers Steal Millions via Malware

#26

Post by lifeisstillgood »

Spearchucker wrote: post #15
patcheudor wrote: post #14

Earlier quoted context omitted.

It's nearly impossible to isolate banking system networks these days. As an example, ATMs run transactions through public networks. Customers access their accounts via public networks, etc. Further, network isolation as a primary control fails time and time again. It's best to focus on the end points and beef up security there. Focus primary security controls on the application and not the perimeter. One of my bigges…

" It's best to focus on the end points and beef up security there " Not the way I'd do it. Defence in depth means securing everything . Starting with the perimeter, working inwards to individual apps - on both clients and servers. Every resource needs to be secured. That means spending cash, and the amount of cash that should be spent should be proportionate to the value of the asset being protected. If you have a se…

To run with your analogy a bit I occassionally see CEO types with "bodyguards". Because the kidnapping attempt is theoretical and not happened for ten years the bodyguard is carrying the luggage or opening the doors or answering the phone.

The analogy is fairly clear - you can spend the money on security in depth. But humans tend to use those in segments for other things eventually. Banks hav been around long enough that all their bodyguards are now bellboys.

Re: Bank Hackers Steal Millions via Malware

#27

Post by aidos »

chubot wrote: post #21
aidos wrote: post #9

Earlier quoted context omitted.

It's just staggering. I know it's silly to think that banks would be better than anyone else, but good lord, malware running on machines capable of transferring millions of dollars that's able to send out video feeds from the network without anyone noticing?! Your various IT/Security teams should be absolutely ashamed. And then the banks don't even have to stand up and admit their incompetence publicly; that's a tota…

So are you saying that bank IT is no better than corporate IT? They don't have any special software or policies? (like the star network thing I mentioned) I would honestly expect it to be a bit better than average. I suppose there are many different types of banks and they all vary. Let's just consider your chain banks like Wells Fargo or BoA, since I'm sure somebody around here has worked at one of those places.

To be honest, I have no experience - so I can't say, if the description in the article is at all accurate though, they're in a pretty bad way:

"The cybercriminals sent their victims infected emails — a news clip or message that appeared to come from a colleague — as bait. When the bank employees clicked on the email, they inadvertently downloaded malicious code. That allowed the hackers to crawl across a bank’s network"

There must be plenty of people on HN with experience in this field, so it'll be interesting to hear their take on it.

My (very ranting/rambling) point was that I've seen other large organisations pretending to do security (and probably believing it themselves), where it's really just security theatre.

Re: Bank Hackers Steal Millions via Malware

#28

Post by joemi »

kirvyteo wrote: post #23

"But the largest sums were stolen by hacking into a bank’s accounting systems and briefly manipulating account balances. Using the access gained by impersonating the banking officers, the criminals first would inflate a balance — for example, an account with $1,000 would be altered to show $10,000. Then $9,000 would be transferred outside the bank. The actual account holder would not suspect a problem, and it would t…

As far as I understand it, the money that was transferred out did not come from nowhere... Ultimately it was the bank's money.

Edit: Meant to also mention also that the whole making-it-look-like-an-account-had-more-money concept was about making the fact that they were taking the bank's money harder to notice. It was not actually creating money that did not exist before.

Re: Bank Hackers Steal Millions via Malware

#29

Post by aidos »

dredmorbius wrote: post #17
aidos wrote: post #9

Earlier quoted context omitted.

It's just staggering. I know it's silly to think that banks would be better than anyone else, but good lord, malware running on machines capable of transferring millions of dollars that's able to send out video feeds from the network without anyone noticing?! Your various IT/Security teams should be absolutely ashamed. And then the banks don't even have to stand up and admit their incompetence publicly; that's a tota…

A key differentiator for banks vs. many other service providers is that financial transfers can be reversed. Releases of information however cannot be. So where a bank has a risk of an unauthorized financial transaction, there are multiple options to claw that back (or to shift the risk to other parties, notably merchants). A disclosure, though, of account information is a different case, and here the results can be…

That's an interesting point, though it's a pretty thin silver lining on a very dark cloud. Being able to undo the operation doesn't really soften the blow of having hackers inside your bank sending outgoing video feeds of employee's screens.

Do you think they'll be getting back the money in this case? Presumably the people involved know enough about the operations to have moved the cash to somewhere out of reach before being exposed.

Re: Bank Hackers Steal Millions via Malware

#30

Post by [deleted] »

kirvyteo wrote: post #23

"But the largest sums were stolen by hacking into a bank’s accounting systems and briefly manipulating account balances. Using the access gained by impersonating the banking officers, the criminals first would inflate a balance — for example, an account with $1,000 would be altered to show $10,000. Then $9,000 would be transferred outside the bank. The actual account holder would not suspect a problem, and it would t…

[deleted]
Post reply on HN