Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bank Hackers Steal Millions via Malware

nytimes.com

Post reply on HN
Print view View original

71–80 of 81 posts

Re: Bank Hackers Steal Millions via Malware

#71

Post by ukigumo »

jokoon wrote: post #68

> But the largest sums were stolen by hacking into a bank’s accounting systems and briefly manipulating account balances. Using the access gained by impersonating the banking officers, the criminals first would inflate a balance — for example, an account with $1,000 would be altered to show $10,000. Then $9,000 would be transferred outside the bank. The actual account holder would not suspect a problem, and it would…

This is actually a very good point. If only there was a system of public ledger for fiat currency :-)

Re: Bank Hackers Steal Millions via Malware

#72

Post by jokoon »

ukigumo wrote: post #71
jokoon wrote: post #68

> But the largest sums were stolen by hacking into a bank’s accounting systems and briefly manipulating account balances. Using the access gained by impersonating the banking officers, the criminals first would inflate a balance — for example, an account with $1,000 would be altered to show $10,000. Then $9,000 would be transferred outside the bank. The actual account holder would not suspect a problem, and it would…

This is actually a very good point. If only there was a system of public ledger for fiat currency :-)

stop it right there with bitcoin. there are advantages to centralization.

Re: Bank Hackers Steal Millions via Malware

#73

Post by ukigumo »

contingencies wrote: post #19
chubot wrote: post #4

So what defenses should an organization employ to prevent these types of attacks? From this non-technical article, it looks like they penetrated employees' computers and used their credentials, which makes sense because it's probably the weakest link. It reminds me the philosophy/motivation behind Qubes OS [1]: there is no server security without client security. What are banks running on employee computers these day…

So what defenses should an organization employ to prevent these types of attacks? Infrastructure architect at a major Bitcoin exchange here. It's about defense in depth. Processes. An architecture level stance like "do not trust the client, the server, the network, the data center, the hardware provider, or any particular stage within those three elements". Each element validates the other. An alarm raised by inappro…

Hi, IT Architect with a history of several major financial institutions here.

Defence in depth is a placebo. Separation of concerns, principle of least privilege, honeypots, SIEM, file integrity monitoring, host intrusion detection, IDS/IPS on all your ingress and egress points, WAF, content filtering and a responsive and empowered SOC capable of acting on auditing events will get you half way to not showing up on the front cover of NY Times.

The problem is that it takes money to keep money safe and too much security is often not secure at all, so putting everything together in a way that you doesn't motivate your users to find new and exciting ways to bypass your controls is an art in itself.

Would love to discuss some of these things with you, any chance I can interview you for my blog?

Re: Bank Hackers Steal Millions via Malware

#74

Post by ukigumo »

Well, at least this one was technically challenging. My favourite bank robbery happened in London a couple of years ago and it used social engineering 3G modems and KVMs. More info here:http://arstechnica.com/tech-policy/2014/04/bank-robbers-use-...

Now, I feel a discussion like this one would be the perfect place for me to introduce myself and... try to sell my services but I think I'm too late to the party so I'll keep it short.

Banks are the archetype of the company that suffers through technology. They make huge investments in IT year on year, but often they end up buying overly complex solutions from 1MM consultancy companies that never get fully implemented and, worse, cause high levels of frustration that then backfire onto projects that could actually make a difference.

With every department (or vertical or region) running their own IT, many of the core functions being outsourced offshore, and innovation (ie: BYOD, Shadow IT) being ignored, some pretty serious gaps are opened in the way security is handled despite best intentions, processes or even regulatory compliance we end up with local desktop machines having direct and unrestricted access to sensitive systems _and_ the internet.

Of course, all this is very nice but at the end of the day if someone can just walk in to your office to "fix your computer" and no one bothers to check their credentials... there's only so much one can do for you.

Re: Bank Hackers Steal Millions via Malware

#75

Post by ukigumo »

jokoon wrote: post #72
ukigumo wrote: post #71

Earlier quoted context omitted.

This is actually a very good point. If only there was a system of public ledger for fiat currency :-)

stop it right there with bitcoin. there are advantages to centralization.

Yes there are, I'm not advocating for a one solution fits all.

Re: Bank Hackers Steal Millions via Malware

#76

Post by busterarm »

chubot wrote: post #21
aidos wrote: post #9

Earlier quoted context omitted.

It's just staggering. I know it's silly to think that banks would be better than anyone else, but good lord, malware running on machines capable of transferring millions of dollars that's able to send out video feeds from the network without anyone noticing?! Your various IT/Security teams should be absolutely ashamed. And then the banks don't even have to stand up and admit their incompetence publicly; that's a tota…

So are you saying that bank IT is no better than corporate IT? They don't have any special software or policies? (like the star network thing I mentioned) I would honestly expect it to be a bit better than average. I suppose there are many different types of banks and they all vary. Let's just consider your chain banks like Wells Fargo or BoA, since I'm sure somebody around here has worked at one of those places.

I used to work in financial IT.

Across the industry it's generally better than corporate IT. A lot better. However, it varies widely by sector.

Companies with trading floors or that interact regularly with traders have the best IT practices in the industry. Banking conglomerates are kind of messy - they combine IT operations for each business and never change anything and the systems don't cooperate.

I remember one such company's backup procedures. At that point they were made up of 13 separate large (regional/national) banks. They were trying to standardize the backup procedures between all the banks and run them from a centralized system. At the time that I got there, the nightly backup process failed every single day for over a year and a half. I didn't even get a computer or working logins to be able to do any work for nearly a month. Anyway, getting it to work involved getting the people responsible for the backups at each individual bank's IT group to get their system to cooperate. All of them knew that this would be putting them out of a job at the completion of the project, so there was tons of resistance and it usually took a week of calling peoples' bosses to get the work done. This was also in the middle of forced relocations for most of them. Most of the folks responsible for the work quit. It was really ugly.

Re: Bank Hackers Steal Millions via Malware

#77

Post by foldor »

ams6110 wrote: post #50
DominikR wrote: post #48

Earlier quoted context omitted.

I'd like to see the sysadmin or programmer that is willing to take the loss if someone hacks the network (or an app) of his employer and steals a few hundred million dollars.

Professional Engineers (mechanical, civil, etc.) are exposed to liability for the buildings, bridges, etc. they approve.

Engineers are not liable for not preventing sabotage (like a a bomb for example) however.

Re: Bank Hackers Steal Millions via Malware

#78

Post by topkai22 »

tracker1 wrote: post #70
topkai22 wrote: post #60

While this is an astonishingly large criminal heist, we should look at this from a business perspective. The largest take from a single bank sounds to be around $10M. The first russian bank I could find in Wikipedia, Alfa-Bank, had a net income in 2010 of $550M, meaning that if they were the ones hacked they would have lost about 2% of their annual PROFIT. What would be the capital, operational, and efficiency cost o…

Doing nothing is always a valid business option... not usually a wise one, but always a valid one.

Agreed, I'm not saying these bank CIOs should do nothing, just trying to point out the break even point between security and other factors can come sooner than we as technical people might assume.

Re: Bank Hackers Steal Millions via Malware

#79

Post by contingencies »

ukigumo wrote: post #73
contingencies wrote: post #19

Earlier quoted context omitted.

So what defenses should an organization employ to prevent these types of attacks? Infrastructure architect at a major Bitcoin exchange here. It's about defense in depth. Processes. An architecture level stance like "do not trust the client, the server, the network, the data center, the hardware provider, or any particular stage within those three elements". Each element validates the other. An alarm raised by inappro…

Hi, IT Architect with a history of several major financial institutions here. Defence in depth is a placebo. Separation of concerns, principle of least privilege, honeypots, SIEM, file integrity monitoring, host intrusion detection, IDS/IPS on all your ingress and egress points, WAF, content filtering and a responsive and empowered SOC capable of acting on auditing events will get you half way to not showing up on th…

Agreed, there's no silver bullet. However, I don't think spending money to feel better is much of an alternative. It feels to me as if internal process design in security-conscious organizations is probably more important than actual systems design... which could be summarized as knowing when not to take shortcuts. Please do get in touch, I'd be happy to chat. Email in profile.

Re: Bank Hackers Steal Millions via Malware

#80

Post by dguido »

TwoBit wrote: post #62
dguido wrote: post #45

Earlier quoted context omitted.

The weakest link was that the computer with access to $10 million+ had access to the general web and was running a general purpose operating system at all. You don't need Qubes to secure this situation. You could use an iPad/Chromebook or a filtering proxy (whitelisted websites) and either would be sufficient.

That seems to be the fundamental engineering flaw here. Also, their email system shouldn't allow executable attachments. The last company I worked at completely stopped all such virus infections by killing all executable attachments.

That works too! Why any of this software was running on a machine that can transfer $10mil+ is beyond me.
Post reply on HN