Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bank Hackers Steal Millions via Malware

nytimes.com

Post reply on HN
Print view View original

31–40 of 81 posts

Re: Bank Hackers Steal Millions via Malware

#31

Post by hawkice »

navait wrote: post #8
ChuckMcM wrote: post #3

The scope of this is pretty stunning, but if you're going to make a billion dollars you can probably invest 100M or so in developing an organization that can pull it off. I wonder when we'll see the equivalent of VC money in these sorts of enterprises.

It really only makes sense for organized crime to manage this within their own ranks. You already have trustworthy people, and people with the relevant skills and connections. How would you know if the "startup" you're funding isn't undercover police? If an upstart appears, just "convince" them to share in the profits.

I'm going to be a little pedantic, but since this is an article about security (and your point is also about security, of a marginally different type):

> You already have trustworthy people, and people with the relevant skills and connections.

In security, there is a distinction between 'trustworthy' and 'trusted'. Organized crime definitely has trusted personnel, but, 'trustworthy'... maybe not.

Re: Bank Hackers Steal Millions via Malware

#32

Post by DangerousPie »

kirvyteo wrote: post #23

"But the largest sums were stolen by hacking into a bank’s accounting systems and briefly manipulating account balances. Using the access gained by impersonating the banking officers, the criminals first would inflate a balance — for example, an account with $1,000 would be altered to show $10,000. Then $9,000 would be transferred outside the bank. The actual account holder would not suspect a problem, and it would t…

Private banks can't "create money". Are you maybe confusing them with central banks?

Re: Bank Hackers Steal Millions via Malware

#33

Post by hyperion2010 »

DangerousPie wrote: post #32
kirvyteo wrote: post #23

"But the largest sums were stolen by hacking into a bank’s accounting systems and briefly manipulating account balances. Using the access gained by impersonating the banking officers, the criminals first would inflate a balance — for example, an account with $1,000 would be altered to show $10,000. Then $9,000 would be transferred outside the bank. The actual account holder would not suspect a problem, and it would t…

Private banks can't "create money". Are you maybe confusing them with central banks?

Fractional reserve systems mean that private banks can and actively do create money by lending.

Re: Bank Hackers Steal Millions via Malware

#34

Post by justincormack »

chubot wrote: post #25
contingencies wrote: post #19

Earlier quoted context omitted.

So what defenses should an organization employ to prevent these types of attacks? Infrastructure architect at a major Bitcoin exchange here. It's about defense in depth. Processes. An architecture level stance like "do not trust the client, the server, the network, the data center, the hardware provider, or any particular stage within those three elements". Each element validates the other. An alarm raised by inappro…

So, I'm specifically asking about protecting employees' machines. My reading of the article is that the attackers got a foothold on employees' machines and credentials, and just piggybacked their malicious transactions along with normal transactions. In that case, it doesn't matter how much security you have in your data center. Employees need access to central systems to do their job, so client security is paramount…

Even widespread two factor auth would mitigate a lot of this. Banks are often quite backward because there are few software suppliers, and it is an industry that took to computing early so there is a lot of legacy. But they vary a lot - the implication of the story is that these were perhaps banks in smaller countries - the banks that got defrauded recently in another large case with cashpoint withdrawals from fake cards were middle eastern. You have a lot of choice of banks, choose the weakest...

Re: Bank Hackers Steal Millions via Malware

#35

Post by justincormack »

joemi wrote: post #28
kirvyteo wrote: post #23

"But the largest sums were stolen by hacking into a bank’s accounting systems and briefly manipulating account balances. Using the access gained by impersonating the banking officers, the criminals first would inflate a balance — for example, an account with $1,000 would be altered to show $10,000. Then $9,000 would be transferred outside the bank. The actual account holder would not suspect a problem, and it would t…

As far as I understand it, the money that was transferred out did not come from nowhere... Ultimately it was the bank's money. Edit: Meant to also mention also that the whole making-it-look-like-an-account-had-more-money concept was about making the fact that they were taking the bank's money harder to notice. It was not actually creating money that did not exist before.

Not sure, double entry bookkeeping is apparently not baked in everywhere, if you can increase an account balance it might not be picked up. If this is creating money, well thats another question.

Re: Bank Hackers Steal Millions via Malware

#36

Post by rlucas »

hyperion2010 wrote: post #33
DangerousPie wrote: post #32

Earlier quoted context omitted.

Private banks can't "create money". Are you maybe confusing them with central banks?

Fractional reserve systems mean that private banks can and actively do create money by lending.

That's certainly not what went on here, from the description. Your assertion is truthy, in that, yes, the /practice/ of fractional reserve banking increases the money supply.

However, to do the equivalent in the way the example described would have required mocking up a loan (asset) which would be offset by a liability (deposit account balance), and a reserve amount (loss allowance and bank capital) behind it. In that manner you create 10,000 in an account which may be withdrawn where the "real" money in the bank is only 1,000. This happens every day, but not by hackers, just by run of the mill self-dealers and fraudsters. At the end of the day the 9,000 comes out of the capital of the bank (or the deposit insurance if things get dire), but it can take months or years ... See the s&l crisis for more.

But hackers don't give a shit about the books seeming to balance for years to snooker regulators. They just want to withdraw the $9,000. The books obviously won't reconcile end of day, but who cares?

So yeah, fractional reserve banking is interesting to know about and not without its hazards, but this exploit could have happened against a full reserve depository institution just as well. The fractional reserve thing is spurious.

Re: Bank Hackers Steal Millions via Malware

#38

Post by patcheudor »

Spearchucker wrote: post #15
patcheudor wrote: post #14

Earlier quoted context omitted.

It's nearly impossible to isolate banking system networks these days. As an example, ATMs run transactions through public networks. Customers access their accounts via public networks, etc. Further, network isolation as a primary control fails time and time again. It's best to focus on the end points and beef up security there. Focus primary security controls on the application and not the perimeter. One of my bigges…

" It's best to focus on the end points and beef up security there " Not the way I'd do it. Defence in depth means securing everything . Starting with the perimeter, working inwards to individual apps - on both clients and servers. Every resource needs to be secured. That means spending cash, and the amount of cash that should be spent should be proportionate to the value of the asset being protected. If you have a se…

The problem is, most organizations start at the network rather than focusing on the application tier. In the development of applications, they should be designed to work safely within a very hostile environment. Far too often they are not.

Re: Bank Hackers Steal Millions via Malware

#40

Post by belorn »

chubot wrote: post #4

So what defenses should an organization employ to prevent these types of attacks? From this non-technical article, it looks like they penetrated employees' computers and used their credentials, which makes sense because it's probably the weakest link. It reminds me the philosophy/motivation behind Qubes OS [1]: there is no server security without client security. What are banks running on employee computers these day…

The best defense an organization can employ, is to make departments/managers/people economical liable. This result in insurance being bought, budgets assign to risk management, and practical prevention mechanism being implemented.

No organization like being attacked, but any defensive measure that cost money will always be balanced to the potential loss, risk, and convenience of employees. If the risk feels low, the potential loss minimum (worst case, government will intervene), and employees inconvenience high from employing effective security schemes, then no such efforts tend to be used.

Post reply on HN