Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bank Hackers Steal Millions via Malware

nytimes.com

Post reply on HN
Print view View original

41–50 of 81 posts

Re: Bank Hackers Steal Millions via Malware

#41

Post by niels_olson »

aceperry wrote: post #16

I laugh whenever someone tells me that they never buy anything over the internet. Their reasoning is that they're afraid of hackers going after online transactions. It seems to me that most of the serious security problems reside in the places that keep your money or access to your money, such as banks, credit cards, or even businesses such as Anthem, etc. Another problem that I've seen from banks is that they all us…

> they all use Microsoft Windows for most of their employees. That's got to be the worst OS in terms of security.

Well, it's good enough for the Department of Defense, so it must be good enough for us, right?

No one ever got fired for buying Microsoft.

Re: Bank Hackers Steal Millions via Malware

#42

Post by niels_olson »

justincormack wrote: post #35
joemi wrote: post #28

Earlier quoted context omitted.

As far as I understand it, the money that was transferred out did not come from nowhere... Ultimately it was the bank's money. Edit: Meant to also mention also that the whole making-it-look-like-an-account-had-more-money concept was about making the fact that they were taking the bank's money harder to notice. It was not actually creating money that did not exist before.

Not sure, double entry bookkeeping is apparently not baked in everywhere, if you can increase an account balance it might not be picked up. If this is creating money, well thats another question.

Yes, that's absolutely fascinating. The banks wouldn't catch on until up to 10 hours later. Is it possible they're only validating their database every 10 hours?! Shouldn't the database reject the transaction instantaneously?

Re: Bank Hackers Steal Millions via Malware

#43

Post by chubot »

justincormack wrote: post #34
chubot wrote: post #25

Earlier quoted context omitted.

So, I'm specifically asking about protecting employees' machines. My reading of the article is that the attackers got a foothold on employees' machines and credentials, and just piggybacked their malicious transactions along with normal transactions. In that case, it doesn't matter how much security you have in your data center. Employees need access to central systems to do their job, so client security is paramount…

Even widespread two factor auth would mitigate a lot of this. Banks are often quite backward because there are few software suppliers, and it is an industry that took to computing early so there is a lot of legacy. But they vary a lot - the implication of the story is that these were perhaps banks in smaller countries - the banks that got defrauded recently in another large case with cashpoint withdrawals from fake c…

I don't believe that's true in this case or in the case of many client attacks.

If you have two factor auth, the employee will go through the process since they need it to do their job for 8 hours a day. Then they will have credentials on their machine (in memory or wherever).

Any attacker sitting on the machine can use those same credentials. Whether you have two factor auth or not doesn't matter.

The point is that you need to prevent the client from getting infected in the first place (which isn't easy if you have 10,000+ employees). As mentioned, if the state of the art is Windows or Mac + antivirus, then your upper bound on security is pretty low.

I recommend reading "Kingpin", a recent book about Max Butler. There's a nice story where he is hired for a penetration test. He guarantees 100% success rate, since he's always been able to get in.

He was coming out of jail and his skills were perhaps rusty, and he couldn't get into this particular server.

So what he did is hack an employee's home computer, steal their VPN credentials, and hack the company server with internal access. Apparently the company was agnry that he did this, but it pretty vividly illustrates the point.

I recall that Kevin Mitnick also used employee VPN attacks. Just because you have hardened Linux, regular updates, jailed processes, etc. on your server doesn't mean it's secure. Employees have to access systems to work, so that is often the weakest link. It's not surprising that this is how major banks got hacked and relieved of millions of dollars.

Re: Bank Hackers Steal Millions via Malware

#45

Post by dguido »

chubot wrote: post #4

So what defenses should an organization employ to prevent these types of attacks? From this non-technical article, it looks like they penetrated employees' computers and used their credentials, which makes sense because it's probably the weakest link. It reminds me the philosophy/motivation behind Qubes OS [1]: there is no server security without client security. What are banks running on employee computers these day…

The weakest link was that the computer with access to $10 million+ had access to the general web and was running a general purpose operating system at all.

You don't need Qubes to secure this situation. You could use an iPad/Chromebook or a filtering proxy (whitelisted websites) and either would be sufficient.

Re: Bank Hackers Steal Millions via Malware

#46

Post by ryanlol »

chubot wrote: post #4

So what defenses should an organization employ to prevent these types of attacks? From this non-technical article, it looks like they penetrated employees' computers and used their credentials, which makes sense because it's probably the weakest link. It reminds me the philosophy/motivation behind Qubes OS [1]: there is no server security without client security. What are banks running on employee computers these day…

PLEASE do not link to qubes in any security related discussion, the devs are known for their incompetence and making some rather hilarious public claims[1].

Not only that, Qubes uses a vulnerable git version from several years ago so practically anyone could go backdoor it if they cared.

[1] http://en.wikipedia.org/wiki/Blue_Pill_%28software%29

Re: Bank Hackers Steal Millions via Malware

#47

Post by omeid2 »

niels_olson wrote: post #41
aceperry wrote: post #16

I laugh whenever someone tells me that they never buy anything over the internet. Their reasoning is that they're afraid of hackers going after online transactions. It seems to me that most of the serious security problems reside in the places that keep your money or access to your money, such as banks, credit cards, or even businesses such as Anthem, etc. Another problem that I've seen from banks is that they all us…

> they all use Microsoft Windows for most of their employees. That's got to be the worst OS in terms of security. Well, it's good enough for the Department of Defense, so it must be good enough for us, right? No one ever got fired for buying Microsoft.

Yet NSA developed Selinux. So there is that.

Re: Bank Hackers Steal Millions via Malware

#48

Post by DominikR »

belorn wrote: post #40
chubot wrote: post #4

So what defenses should an organization employ to prevent these types of attacks? From this non-technical article, it looks like they penetrated employees' computers and used their credentials, which makes sense because it's probably the weakest link. It reminds me the philosophy/motivation behind Qubes OS [1]: there is no server security without client security. What are banks running on employee computers these day…

The best defense an organization can employ, is to make departments/managers/people economical liable. This result in insurance being bought, budgets assign to risk management, and practical prevention mechanism being implemented. No organization like being attacked, but any defensive measure that cost money will always be balanced to the potential loss, risk, and convenience of employees. If the risk feels low, the…

I'd like to see the sysadmin or programmer that is willing to take the loss if someone hacks the network (or an app) of his employer and steals a few hundred million dollars.

Re: Bank Hackers Steal Millions via Malware

#49

Post by vanzard »

dredmorbius wrote: post #17
aidos wrote: post #9

Earlier quoted context omitted.

It's just staggering. I know it's silly to think that banks would be better than anyone else, but good lord, malware running on machines capable of transferring millions of dollars that's able to send out video feeds from the network without anyone noticing?! Your various IT/Security teams should be absolutely ashamed. And then the banks don't even have to stand up and admit their incompetence publicly; that's a tota…

A key differentiator for banks vs. many other service providers is that financial transfers can be reversed. Releases of information however cannot be. So where a bank has a risk of an unauthorized financial transaction, there are multiple options to claw that back (or to shift the risk to other parties, notably merchants). A disclosure, though, of account information is a different case, and here the results can be…

> financial transfers can be reversed.

Not this time: hackers withdrew some of the money from ATMs.

Re: Bank Hackers Steal Millions via Malware

#50

Post by ams6110 »

DominikR wrote: post #48
belorn wrote: post #40

Earlier quoted context omitted.

The best defense an organization can employ, is to make departments/managers/people economical liable. This result in insurance being bought, budgets assign to risk management, and practical prevention mechanism being implemented. No organization like being attacked, but any defensive measure that cost money will always be balanced to the potential loss, risk, and convenience of employees. If the risk feels low, the…

I'd like to see the sysadmin or programmer that is willing to take the loss if someone hacks the network (or an app) of his employer and steals a few hundred million dollars.

Professional Engineers (mechanical, civil, etc.) are exposed to liability for the buildings, bridges, etc. they approve.
Post reply on HN