Bank Hackers Steal Millions via Malware
nytimes.com
Bank Hackers Steal Millions via Malware
1–10 of 81 posts
Re: Bank Hackers Steal Millions via Malware
#2 I don't see how Jamie Dimon's , presidential , POTUS cufflink's didn't scare the hackers away .
Re: Bank Hackers Steal Millions via Malware
#3The scope of this is pretty stunning, but if you're going to make a billion dollars you can probably invest 100M or so in developing an organization that can pull it off.
I wonder when we'll see the equivalent of VC money in these sorts of enterprises.
Re: Bank Hackers Steal Millions via Malware
#4So what defenses should an organization employ to prevent these types of attacks?
From this non-technical article, it looks like they penetrated employees' computers and used their credentials, which makes sense because it's probably the weakest link.
It reminds me the philosophy/motivation behind Qubes OS [1]: there is no server security without client security.
What are banks running on employee computers these days? I'm guessing Windows. Do they have anything beyond what typical corporate IT does to Windows machines (install virus checkers, auto updates, most users don't have root)?
Clearly that's not sufficient. It sounds like you want some kind of strict compartmentalization like Qubes. There's probably no reason that an e-mail client like Outlook needs to share any state with whatever app they used to manage accounts. Besides perhaps sharing a clipboard for cutting and pasting a tiny amount of info.
The machines probably need secure boot and attestation of the root file system state too. It's pretty bad that in this attack and I think in the Anthem case that attackers were inside their network for such a long period without detection.
I also remember a DEFCON talk where a penetration tester said the hardest site he ever worked on was where they had a strict "star" network topology. None of the computers in the enterprise could talk to each other or even see each other. All communication had to be proxied through a central hub, which would audit all the connections.
Do any banks do that now? Is there any reason they couldn't in practice? I imagine that there isn't really a need for two tellers in the same office to be sharing files directly with each other. Let alone tellers in different offices. I've never worked at a bank do I have no idea what their networks are like. Possibly there would be some uptime concerns with a centralized system like that.
I'm just brainstorming and wondering if anyone has direct work-related experience.
Re: Bank Hackers Steal Millions via Malware
#5Why were internal banking admin systems connected to the public Internet? Two isolated networks should be the minimum.
Re: Bank Hackers Steal Millions via Malware
#6Why were internal banking admin systems connected to the public Internet? Two isolated networks should be the minimum.
While I've never worked in banking/financial environments I do know of people who have; they often had two workstations (one for the 'public' network, the other for the systems) and weren't allowed to use software like Synergy to share the keyboard and mouse. I guess not every company does stuff like that, though.
Re: Bank Hackers Steal Millions via Malware
#7I don't see how Jamie Dimon's , presidential , POTUS cufflink's didn't scare the hackers away .
Huh?
Re: Bank Hackers Steal Millions via Malware
#8The scope of this is pretty stunning, but if you're going to make a billion dollars you can probably invest 100M or so in developing an organization that can pull it off. I wonder when we'll see the equivalent of VC money in these sorts of enterprises.
It really only makes sense for organized crime to manage this within their own ranks. You already have trustworthy people, and people with the relevant skills and connections. How would you know if the "startup" you're funding isn't undercover police? If an upstart appears, just "convince" them to share in the profits.
Re: Bank Hackers Steal Millions via Malware
#9So what defenses should an organization employ to prevent these types of attacks? From this non-technical article, it looks like they penetrated employees' computers and used their credentials, which makes sense because it's probably the weakest link. It reminds me the philosophy/motivation behind Qubes OS [1]: there is no server security without client security. What are banks running on employee computers these day…
It's just staggering.
I know it's silly to think that banks would be better than anyone else, but good lord, malware running on machines capable of transferring millions of dollars that's able to send out video feeds from the network without anyone noticing?! Your various IT/Security teams should be absolutely ashamed. And then the banks don't even have to stand up and admit their incompetence publicly; that's a total disgrace.
That's the state of corporate security I guess. I've dealt with corporate IT departments over the years where they put these "processes" in place to mitigate these security issues but it's all a load of rubbish. Filling in forms to tick boxes so that everyone can go home happy pretending there's security going on, when really their network is a leaky sieve.
At one point I saw a release by a 3rd party supplier to a large corporate system that included privilege escalation, blatantly, at the start of a T-SQL script. It was done because the IT department refused to carry out the action on request via the official channel but it was work that needed to be done to complete a project. The 3rd party knew the admins would just be running scripts as SA so they escalated their own account to do what they needed to do later.
I know it's silly to be so frustrated about it, but we've all dealt with crappy banking systems for years, with totally insane security measures; meanwhile hackers can just walk away with millions using a bit of malware.
Re: Bank Hackers Steal Millions via Malware
#10Why were internal banking admin systems connected to the public Internet? Two isolated networks should be the minimum.
relatedly, why do they have webcams? WTF