Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LockBit claims to exfiltrate 33TB of data from US Federal Reserve

securityaffairs.com

Post reply on HN
Print view View original

61–70 of 98 posts

Re: LockBit claims to exfiltrate 33TB of data from US Federal Reserve

#61

Post by jonhohle »

mschuster91 wrote: post #40
SV_BubbleTime wrote: post #27

Earlier quoted context omitted.

And we can definitely rely on plurality of professionals. There were many (almost all) journalists and intelligence professionals that claimed the Hunter Laptop was not real… except of course it was and entered into evidence in his gun trail and conviction recently.

The "story" was that Joe Biden had pushed Ukraine to protect Hunter Biden [1], and there was no evidence found to support that claim at all , despite multiple investigations from the FBI as well as both chambers of Congress [2]. The only thing that turned out to be true and actually criminal was that Hunter Biden acquired a gun while forbidden from doing so, for which he was recently convicted. [1] https://en.wikiped…

That’s pretty disingenuous. The story was it was Hunter’s laptop, had compromising information on Hunter (it did), had emails that detailed more involvement and knowledge of Hunter’s business by Joe than was previously disclosed, as well as a litany of other private information that was not previously known (private email addresses used by public officials).

50 intelligence officials signed a politically motivated letter to cast doubt on the authenticity of any of this[0] and the majority of media outlets inferred that it not only could be misinformation, but that it was and gaslighted anyone who alleged differently. The officials opinion was wrong from the outset, and appears to have been a screen for a very politically connected family.

0 - https://www.politico.com/f/?id=00000175-4393-d7aa-af77-579f9...

Re: LockBit claims to exfiltrate 33TB of data from US Federal Reserve

#63

Post by lxgr »

ttrei wrote: post #44
lxgr wrote: post #24

Earlier quoted context omitted.

The Fed runs several RTGS and retail payment systems, including FedNow, FedACH, and Fedwire. FedACH processes roughly half of all ACH transfers, which include effectively all payroll direct deposit transactions in the US.

Does it process individual transactions? RTGS stands for Real Time Gross Settlement, and my understanding is that it lets banks settle the total amount of processed transactions, thus leaving out any details of particular transactions.

For important/large payments, banks will often let customers allow do do individual transactions on the RTGS.

That's how wire transfers work in the US, for example, and that's one reason why they're more expensive than ACH: Without netting, transfers actually reduce reserves, and by extension liquidity, from the sending bank in real time.

FedACH in particular is a retail payment service, and the operator would have visibility into individual transactions, I believe.

Re: LockBit claims to exfiltrate 33TB of data from US Federal Reserve

#64

Post by [deleted] »

SV_BubbleTime wrote: post #49
sva_ wrote: post #36

Earlier quoted context omitted.

I think most of the things you listed weren't really used in the wild, at least not at scale?

I’m pretty sure every phishing attack almost ever was used in the wild and OS-agnostic. The rest of the list was off the top of my head. Other than WannaCry and Stux, how many large scale windows malwares can you name without looking them up?

[deleted]

Re: LockBit claims to exfiltrate 33TB of data from US Federal Reserve

#65

Post by lxgr »

lmz wrote: post #50
ttrei wrote: post #44

Earlier quoted context omitted.

Does it process individual transactions? RTGS stands for Real Time Gross Settlement, and my understanding is that it lets banks settle the total amount of processed transactions, thus leaving out any details of particular transactions.

> lets banks settle the total amount of processed transactions, thus leaving out any details of particular transactions This is the definition of a Net settlement scheme (multiple transactions are combined at end of a period, resulting in only the net changes being transferred), not a Gross settlement scheme.

FedACH is a net settled scheme, but even then, the operator of such a scheme usually has visibility into individual payments (unless participating banks settle everything bilaterally and there is no central operator/hub).

Re: LockBit claims to exfiltrate 33TB of data from US Federal Reserve

#66

Post by lxgr »

panarky wrote: post #48
lxgr wrote: post #24

Earlier quoted context omitted.

The Fed runs several RTGS and retail payment systems, including FedNow, FedACH, and Fedwire. FedACH processes roughly half of all ACH transfers, which include effectively all payroll direct deposit transactions in the US.

Lockbit primarily targets Microsoft Windows servers. Does the Fed run all this critical infrastructure on Windows?

Pretty much everything in traditional banking runs either on mainframes or Windows PCs. If there's Linux servers or non-windows clients, that's usually bolted on via some sort of adapter to the mainframes.

Re: LockBit claims to exfiltrate 33TB of data from US Federal Reserve

#69

Post by JumpCrisscross »

lxgr wrote: post #63
ttrei wrote: post #44

Earlier quoted context omitted.

Does it process individual transactions? RTGS stands for Real Time Gross Settlement, and my understanding is that it lets banks settle the total amount of processed transactions, thus leaving out any details of particular transactions.

For important/large payments, banks will often let customers allow do do individual transactions on the RTGS. That's how wire transfers work in the US, for example, and that's one reason why they're more expensive than ACH: Without netting, transfers actually reduce reserves, and by extension liquidity, from the sending bank in real time. FedACH in particular is a retail payment service, and the operator would have v…

> that's one reason why they're more expensive than ACH

The Fed charges between 4 and 19¢ for a wire [1]. For the delta to be explained by the cost of warehousing reserves, we'd need to assume Zimbabwean costs of capital for the big banks.

RTGS is fundamentally more expensive than net settling. But wires are expensive because we're getting hosed. (If you wire frequently, there are banks that won't charge you for it, e.g. Fidelity.)

[1] https://www.frbservices.org/resources/fees/wires-2024 if you're a small bank, it could be as much as 95¢

Re: LockBit claims to exfiltrate 33TB of data from US Federal Reserve

#70

Post by NegativeK »

andai wrote: post #67
tmaly wrote: post #55

How long would it have taken them to transfer 33TB and where would they store it?

How would they leak it? Multi-part RAR on dozens of MicroSDs sent to journalists?

Often it's via torrents. Or just data dumps on a web server.

Why restrict the data to journalists when it causes much more harm to the breached org for other criminals to get the data?

Post reply on HN