Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LockBit claims to exfiltrate 33TB of data from US Federal Reserve

securityaffairs.com

Post reply on HN
Print view View original

71–80 of 98 posts

Re: LockBit claims to exfiltrate 33TB of data from US Federal Reserve

#71

Post by JumpCrisscross »

MagicMoonlight wrote: post #53
kouunji wrote: post #8

If this is real, this is an incredible target to choose. I mean, you might not make it trial if they catch you, if you know what I mean. Makes me wonder what level of affiliation or perceived safety would make anyone this confident.

They will be Russian. All of the groups are just government agents, that’s why you get someone like “Anonymous” suddenly appearing overnight, attacking someone that is a foreign rival to the US and then disappearing for another 8 years.

> that’s why you get someone like “Anonymous” suddenly appearing overnight, attacking someone that is a foreign rival to the US and then disappearing for another 8 years

Humans can spontaneously self organise to a surprising extent. No government was behind Reddit's meme trading, for instance.

Not saying you're wrong. Just that spontaneous bursts of organisation aren't per se evidence of outside influence.

Re: LockBit claims to exfiltrate 33TB of data from US Federal Reserve

#72

Post by lxgr »

JumpCrisscross wrote: post #69
lxgr wrote: post #63

Earlier quoted context omitted.

For important/large payments, banks will often let customers allow do do individual transactions on the RTGS. That's how wire transfers work in the US, for example, and that's one reason why they're more expensive than ACH: Without netting, transfers actually reduce reserves, and by extension liquidity, from the sending bank in real time. FedACH in particular is a retail payment service, and the operator would have v…

> that's one reason why they're more expensive than ACH The Fed charges between 4 and 19¢ for a wire [1]. For the delta to be explained by the cost of warehousing reserves, we'd need to assume Zimbabwean costs of capital for the big banks. RTGS is fundamentally more expensive than net settling. But wires are expensive because we're getting hosed. (If you wire frequently, there are banks that won't charge you for it,…

Completely agree: Of course the markup that banks charge for them is not proportional in any way.

If it were, FedNow (which is also real-time, although I'm not sure on whether it's also real-time settled) and non-US equivalents would be equally expensive, yet SEPA instant and FPS are usually free to consumers. They do have an amount cap per day, though.

Re: LockBit claims to exfiltrate 33TB of data from US Federal Reserve

#74

Post by rsynnott »

lxgr wrote: post #72
JumpCrisscross wrote: post #69

Earlier quoted context omitted.

> that's one reason why they're more expensive than ACH The Fed charges between 4 and 19¢ for a wire [1]. For the delta to be explained by the cost of warehousing reserves, we'd need to assume Zimbabwean costs of capital for the big banks. RTGS is fundamentally more expensive than net settling. But wires are expensive because we're getting hosed. (If you wire frequently, there are banks that won't charge you for it,…

Completely agree: Of course the markup that banks charge for them is not proportional in any way. If it were, FedNow (which is also real-time, although I'm not sure on whether it's also real-time settled) and non-US equivalents would be equally expensive, yet SEPA instant and FPS are usually free to consumers. They do have an amount cap per day, though.

While SEPA Instant has a cap (100k), SEPA Slow (or, well, same-day/next-day, the normal one) does not, though some banks may impose their own.

Weirdly, 100k is not an absolute limit; the scheme allows banks to have bilateral agreements to exceed it, though I’m not sure how common this is.

Re: LockBit claims to exfiltrate 33TB of data from US Federal Reserve

#75

Post by JumpCrisscross »

lxgr wrote: post #72
JumpCrisscross wrote: post #69

Earlier quoted context omitted.

> that's one reason why they're more expensive than ACH The Fed charges between 4 and 19¢ for a wire [1]. For the delta to be explained by the cost of warehousing reserves, we'd need to assume Zimbabwean costs of capital for the big banks. RTGS is fundamentally more expensive than net settling. But wires are expensive because we're getting hosed. (If you wire frequently, there are banks that won't charge you for it,…

Completely agree: Of course the markup that banks charge for them is not proportional in any way. If it were, FedNow (which is also real-time, although I'm not sure on whether it's also real-time settled) and non-US equivalents would be equally expensive, yet SEPA instant and FPS are usually free to consumers. They do have an amount cap per day, though.

> do have an amount cap per day

This is related to fraud risk, which is only ameliorated by net-settlement systems in that they're slower. (An RTGS with a built-in delay would have a similar fraud profile.)

Wires' immutability makes them both ideal for large transactions and more risky for fraud. If I understand correctly, FedNow payments are reversible.

In essence, you have to pick two among fast settlement, immutability and low cost. FedWire is fast and immutable and low cost at volume. FedNow is fast and low cost. ACH is stupid.

Re: LockBit claims to exfiltrate 33TB of data from US Federal Reserve

#76

Post by lxgr »

JumpCrisscross wrote: post #75
lxgr wrote: post #72

Earlier quoted context omitted.

Completely agree: Of course the markup that banks charge for them is not proportional in any way. If it were, FedNow (which is also real-time, although I'm not sure on whether it's also real-time settled) and non-US equivalents would be equally expensive, yet SEPA instant and FPS are usually free to consumers. They do have an amount cap per day, though.

> do have an amount cap per day This is related to fraud risk, which is only ameliorated by net-settlement systems in that they're slower. (An RTGS with a built-in delay would have a similar fraud profile.) Wires' immutability makes them both ideal for large transactions and more risky for fraud. If I understand correctly, FedNow payments are reversible. In essence, you have to pick two among fast settlement, immutab…

It helps with fraud, sure, but I bet banks aren't too unhappy about the dampening effect it has on liquidity flows as well, especially now that we've left ZIRP?

There must be some cost of capital associated with needing reserve buffers for outgoing instant payments sent outside of the operating hours of the interbank money market and the Fed discount window.

In the end, both effects (cost of fraud and cost of liquidity) will of course get baked into the cost per dollar to the banks and it might be hard to untangle them.

Re: LockBit claims to exfiltrate 33TB of data from US Federal Reserve

#77

Post by JumpCrisscross »

rsynnott wrote: post #74
lxgr wrote: post #72

Earlier quoted context omitted.

Completely agree: Of course the markup that banks charge for them is not proportional in any way. If it were, FedNow (which is also real-time, although I'm not sure on whether it's also real-time settled) and non-US equivalents would be equally expensive, yet SEPA instant and FPS are usually free to consumers. They do have an amount cap per day, though.

While SEPA Instant has a cap (100k), SEPA Slow (or, well, same-day/next-day, the normal one) does not, though some banks may impose their own. Weirdly, 100k is not an absolute limit; the scheme allows banks to have bilateral agreements to exceed it, though I’m not sure how common this is.

What are house payments usually made with?

Re: LockBit claims to exfiltrate 33TB of data from US Federal Reserve

#78

Post by JumpCrisscross »

lxgr wrote: post #76
JumpCrisscross wrote: post #75

Earlier quoted context omitted.

> do have an amount cap per day This is related to fraud risk, which is only ameliorated by net-settlement systems in that they're slower. (An RTGS with a built-in delay would have a similar fraud profile.) Wires' immutability makes them both ideal for large transactions and more risky for fraud. If I understand correctly, FedNow payments are reversible. In essence, you have to pick two among fast settlement, immutab…

It helps with fraud, sure, but I bet banks aren't too unhappy about the dampening effect it has on liquidity flows as well, especially now that we've left ZIRP? There must be some cost of capital associated with needing reserve buffers for outgoing instant payments sent outside of the operating hours of the interbank money market and the Fed discount window. In the end, both effects (cost of fraud and cost of liquidi…

> banks aren't too unhappy about the dampening effect it has on liquidity flows

Correct.

The average FedWire is $5.4mm [1]. The Fed Funds rate is 5.3% [2]. ACH settles in 1 to 3 business days [3]. Actual/360, that's $800 to 2,400 to finance wholesale.

If, on the other hand, you're JPMorgan and can pay 2 bps for deposits [4], that cost drops to $3 to 9. These are the economics that drive bank consolidation.

[1] https://www.frbservices.org/resources/financial-services/wir...

[3] https://www.frbservices.org/resources/resource-centers/same-...

[2] https://fred.stlouisfed.org/series/fedfunds

[4] https://www.chase.com/content/dam/chase-ux/ratesheets/pdfs/r...

Re: LockBit claims to exfiltrate 33TB of data from US Federal Reserve

#79

Post by lxgr »

JumpCrisscross wrote: post #77
rsynnott wrote: post #74

Earlier quoted context omitted.

While SEPA Instant has a cap (100k), SEPA Slow (or, well, same-day/next-day, the normal one) does not, though some banks may impose their own. Weirdly, 100k is not an absolute limit; the scheme allows banks to have bilateral agreements to exceed it, though I’m not sure how common this is.

What are house payments usually made with?

Just regular "SEPA slow" (i.e. SEPA credit transfer), as far as I know, unless they're financed by a mortgage/loan anyway.

Some banks offer "rush payments" for that use case in particular, which I believe essentially correspond to either an RTGS payment and a phone call or fax to the receiving bank ("hey, can you check your TARGET2 account real quick for our transfer and credit your account x for the sum please?"), or just a regular old SEPA credit transfer with somebody making sure that it's not caught in some AML or fraud control queue for several days. It's not a pan-European standardized scheme, in any case.

Re: LockBit claims to exfiltrate 33TB of data from US Federal Reserve

#80

Post by hahaitsfunny »

empath75 wrote: post #15
kouunji wrote: post #8

If this is real, this is an incredible target to choose. I mean, you might not make it trial if they catch you, if you know what I mean. Makes me wonder what level of affiliation or perceived safety would make anyone this confident.

I don't think the federal reserve has that many deep dark secrets. The main risk is going to be stuff like knowing that a bank is in trouble before it's public knowledge.

[dead]
Post reply on HN