Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacker Publishes 2TB of Data from Cayman National Bank

twitter.com

Post reply on HN
Print view View original

61–70 of 491 posts

Re: Hacker Publishes 2TB of Data from Cayman National Bank

#61

Post by 52-6F-62 »

seibelj wrote: post #58
52-6F-62 wrote: post #48

Earlier quoted context omitted.

> tax and legal purposes This may be terribly naive, but doesn't that make the business de-facto illegal? What kind of legitimate business deserves to buck paying into the systems that support them? As a default I want to disagree, but I would like to know what business needs to operate outside of these constraints. Surely the businesses utilizing the favours of banks like Cayman are not being operated within tyranni…

I still can’t believe it’s legal to move from SF to Texas if you were born and raised in SF. You owe the good people of San Francisco repayment for raising and nurturing you. Leaving after all that education and local services is a corrupt tax-dodge into a state without income tax.

I'm not American, and most people aren't. You might need to tailor your metaphor.

That said, I disagree. Context matters. The comment above isn't talking about moving a business, it's only talking about operating with as little fiscal impunity as possible. Or at least it reads that way—which is why I was asking for more input.

Re: Hacker Publishes 2TB of Data from Cayman National Bank

#62

Post by turtlesdown11 »

rolltiide wrote: post #47
walrus01 wrote: post #44

Earlier quoted context omitted.

The Cayman Islands is a vassal state of the global one percent as a tax shelter. Let's call it what it really is. It's not a global financial center the way NYC or Hong Kong or Tokyo are. It's a sand bar with a bunch of post office box company registries and some banks. I hear there is also good snorkeling.

Their legislative branch is extremely competent at evaluating and passing competitive laws for business and banking, their executive branch is extremely competent at providing the administrative services and modern digital facilities for international business and banking, and their judicial branch is extremely competent at resolving disputes. The government's budget is also balanced without passive taxation of this…

>Their legislative branch is extremely competent at evaluating and passing competitive laws for business and banking

as if races to the bottom are challenging

>this has utility on this planet

The only utility the Caymans serve is unfettered human greed.

Re: Hacker Publishes 2TB of Data from Cayman National Bank

#63

Post by FpUser »

jdkee wrote: post #45
CaymanCruiser wrote: post #37

Earlier quoted context omitted.

Using a throwaway for obvious reasons. I have a fair bit of insight into this industry, both from friends, acquaintances, and family who use a variety of offshore structures to manage their wealth and from my own dealings (the company I founded and currently manage is offshored for tax and legal purposes). What people don’t realise is that aside from a couple outliers offshore jurisdictions aren’t that shady at all a…

"the company I founded and currently manage is offshored for tax and legal purposes" Simply curious, how do you feel about the ethics of this? Is it to reduce the tax burden in your company's home country?

If you want to talk ethics you should probably start at the government. Ethics should start with the higher level. The average business owner/s trying to LEGALLY minimize their tax is hardly unethical comparatively to the sovereign that allows it in a first place. If we are talking guys like Google then yes. Those just buy governments.

Re: Hacker Publishes 2TB of Data from Cayman National Bank

#64

Post by sbarre »

jokoon wrote: post #21

After watching The laundromat, I think it's big news. Although I will always be curious why countries are letting those small, insignificant islands and countries manage all this wealth, and why they're trusted to do it. This can't be secure or safe. I'm curious about the diplomacy and the political implications of this. What if their office get robbed? What if the island gets attacked? What if one of those shady ban…

There is a great book you should read called Treasure Islands[0]. It's equal parts fascinating and infuriating, and makes you realize the system has never been set up fairly.

Rich people have always had their own financial systems that are outside of, and one step ahead of, the regulations and rules the rest of us are subject to.

[0]: https://www.goodreads.com/book/show/10197857-treasure-island...

Re: Hacker Publishes 2TB of Data from Cayman National Bank

#65

Post by pvitz »

_8j50 wrote: post #57
chelmzy wrote: post #3

Pastebin with translated guide on how they hacked the bank: https://pastebin.com/8rXhtqgr

It doesn't tell you how they infiltrated to begin with so that they can sniff cookies and keystrokes. But my guess is they phished an employee. Edit: I missed that part,sorry.

He explicitly mentions how he exploited it and that at the same time, somebody else tried to phish...

Re: Hacker Publishes 2TB of Data from Cayman National Bank

#66

Post by CaymanCruiser »

jdkee wrote: post #45
CaymanCruiser wrote: post #37

Earlier quoted context omitted.

Using a throwaway for obvious reasons. I have a fair bit of insight into this industry, both from friends, acquaintances, and family who use a variety of offshore structures to manage their wealth and from my own dealings (the company I founded and currently manage is offshored for tax and legal purposes). What people don’t realise is that aside from a couple outliers offshore jurisdictions aren’t that shady at all a…

"the company I founded and currently manage is offshored for tax and legal purposes" Simply curious, how do you feel about the ethics of this? Is it to reduce the tax burden in your company's home country?

There are two dimensions here, one is the tax liability and the second is regulatory compliance.

Yes, the tax liability is significantly reduced when using offshore structures and I don't necessarily see this as a bad thing especially since an ultra-low corporate tax rate makes it possible to offer our customers services at a lower price than otherwise - I see this as a good thing.

The second is that regulatory compliance is much, much, much easier especially when working in industries like finance, insurance, or crypto. The flexibility and clarity of the regulatory climate in offshore jurisdictions is a huge advantage as it makes it possible for us to focus on doing business rather than narrowly tiptoeing an arbitrary and complex regulatory line as is the case in "home" jurisdictions like the US or the EU. This is further compounded when you have a distributed workforce located in various jurisdictions (which sometimes changes on a week-to-week basis).

Re: Hacker Publishes 2TB of Data from Cayman National Bank

#67

Post by bowmessage »

pvitz wrote: post #65
_8j50 wrote: post #57

Earlier quoted context omitted.

It doesn't tell you how they infiltrated to begin with so that they can sniff cookies and keystrokes. But my guess is they phished an employee. Edit: I missed that part,sorry.

He explicitly mentions how he exploited it and that at the same time, somebody else tried to phish...

She!

Re: Hacker Publishes 2TB of Data from Cayman National Bank

#68

Post by askytb »

walrus01 wrote: post #44
rolltiide wrote: post #42

Earlier quoted context omitted.

The Cayman Islands has robust financial regulations and is a financial center. It is also reliant on the UK for military assistance, and as you can see the bank records for this particular institution are digital. You are grouping everything together with misplaced isolationist paranoia.

The Cayman Islands is a vassal state of the global one percent as a tax shelter. Let's call it what it really is. It's not a global financial center the way NYC or Hong Kong or Tokyo are. It's a sand bar with a bunch of post office box company registries and some banks. I hear there is also good snorkeling.

>is a vassal state of the global one percent as a tax shelter

Just FYI, to be in the global one percent you need an income of $32,400 per year

Re: Hacker Publishes 2TB of Data from Cayman National Bank

#69

Post by goatsi »

_8j50 wrote: post #57
chelmzy wrote: post #3

Pastebin with translated guide on how they hacked the bank: https://pastebin.com/8rXhtqgr

It doesn't tell you how they infiltrated to begin with so that they can sniff cookies and keystrokes. But my guess is they phished an employee. Edit: I missed that part,sorry.

I thought it was pretty clear. They had already developed a Sonic Wall VPN exploit. They used zmap to scan for vulnerable devices then grepped the hostnames for "bank". When they exploited the VPN it gave them the whole network.

>In this case, on the other hand, it was the same Windows domain passwords that were used to authenticate against the VPN, so I could get a good user password, including that of the domain admin. Now I had full access to his network

Re: Hacker Publishes 2TB of Data from Cayman National Bank

#70

Post by _8j50 »

From what I read the hack was not sophisticated at all. If they had decent endpoint protection this would not have happened. Maybe they disabled defender after the initial access and privesc because defender blocks Get-Keystrokes and other things in empire,even with significant modification.

Anyway, I don't care about the hacktivism and propaganda (don't really get it -- tbh,rich people bad/corrupt?) But would very much be interested in any post-incident analysis of what happend.

But here's what stands out to me: they're talking about using empire and hvnc. Empire is by design detectable,you could use the techniques in empire in your own malware though. Most rats and bots (take trickbot) let you sniff key strokes, run commands,etc... So I guess they used psexec or winrm to access the hosts(no vlan segmentation or firewall on endpoints!?). I ask all this because the specific MO is significantly different than what is seen with criminal actors and crimeware(like Carbank which She mentions). And to me, it does corroborate the story that this was likely an independent hacker motivated by hacktivism as opposed to a bigger conspiracy to burn some group and plant false records in the leak (which could still less likely be the case)

Very exciting,righteous hack.

I think overall, the bank cheaped out on IT and paid big time for it.

Post reply on HN