Three Banks Lose Millions After Wire Transfer Switches Hacked 179
mask.of.sanity writes "Criminals have stolen millions from three unnamed U.S. banks by launching slow and stealthy denial of service attacks as a distraction before attacking wire payment switches. The switches manage and execute wire transfers and could have coughed up much more cash should the attackers have pressed on. RSA researcher Limor Kessem said, 'The service portal is down, the bank is losing money and reliability, and the security team is juggling the priorities of what to fix first. That's when the switch attack – which is very rare because those systems are not easily compromised [and require] high-privilege level in a more advanced persistent threat style case – takes place.'"
Smart Criminals (Score:5, Insightful)
I like stories like this. If something is done really well and in a clever way (whether it was really being naughty or not) the effort, cleverness and ingenuity should indeed have its merits praised. Slashdot should have more stories like this: Hey, they did a bad thing, but look at just how WELL they did it.
Re: (Score:3)
Re: (Score:2)
Same.
Re:Smart Criminals (Score:5, Insightful)
Where do you think those US banks are going to take the money to make it up? In their customer pockets maybe? It's like insurance fraud, shoplifting etc. The end consumer ends up paying for that. We might think; well they already make enough money so, good for them but don't let that fool you. They are going to make up for that to keep investors happy and their stock healthy.
Worse, they may have insurance coverage and insurance companies may raise premium for all banks making sure everybody pays for it.
Sure, it looks nice as a hacker movie scenario although...
Re:Smart Criminals (Score:4, Insightful)
End consumer (commoners) always end up paying, one way or another, in all situations. Nothing new there.
Sometimes I think that instead of being a obedient sheep, waking up early, working 10 hours and generally being exploited while barely having enough for comfortable "life", I should turn to let's say.. victimless crime*.
I know this is frowned upon by society, but only because those in power are propagating idea that we should be obedient.. so they can keep all the f money and have less competition.
The banks are criminals, the politicians are criminals, the religious leaders are criminals, insurance companies, pharmaceutical companies, governments, etc. In modern world, they just upped it to a new, modern level. It's not corruption same as in 3rd world country, but it still exist just behind the curtains and/or through loopholes they made for themselves.
I know people that acquired wealth by pillaging (literally), smuggling cigarettes and guns. Now they are respected businessmen that have legal businesses, and are hiring you to work 10 hours a day for them while they propagate the idea that doing anything "illegal" is bad. Exactly the same as those mentioned above are doing.
It's all just to keep you in check and under control. Every each one of them are full of it.
(*) = As a programmer, that would be let's say hacking wordpress sites and selling them to someone or using them to make a profit. System Administrators should be happy. This creates jobs for them.
Re: (Score:2)
End consumer (commoners) always end up paying, one way or another, in all situations. Nothing new there.
Sometimes I think that instead of being a obedient sheep, waking up early, working 10 hours and generally being exploited while barely having enough for comfortable "life", I should turn to let's say.. victimless crime*.
(*) = As a programmer, that would be let's say hacking wordpress sites and selling them to someone or using them to make a profit.
If you're working a middle class job in western society and you are healthy, your greatest burden is probably deciding what you want to eat for dinner. The standard of living you enjoy is higher than what most people have endured since humans began walking the earth. Your life or the life of someone you love has probably been saved at least once by the pharmaceutical companies you rail against.
And on what planet is "hacking wordpress sites and selling them to someone or using them to make a profit" a vict
Re: (Score:2)
Re: (Score:2)
What's worse is those new fees they attach to recover those lost funds, will be ongoing long after the funds have been recovered from our pockets. It's Corporate Rape against the populous.
Re:Smart Criminals (Score:4, Interesting)
If the banks had a way to extract more money from us, wouldn't they already be doing it? Why would they wait until they were hacked and lost money to raise prices, if they thought it would increase their income?
Re: (Score:2)
Re: (Score:3, Insightful)
Supermarkets have a typical profit margin of 1 to 2%. It means that if you steal 10$ worth of food they need to sell 1000-2000$ worth more to make it up unless they already have calculated the shoplifting costs in their 1-2% profit margin. No store stays open for long without makings profits so your "profit maximization" argument makes no sense.
Any businessman will factor in all costs, like hiring more cashier, security guards, security cameras, utility bills etc. when determining their sale prices, it is e
Re:Smart Criminals (Score:4, Informative)
Actual supermarket profit margins statistics:
http://answers.google.com/answers/main?cmd=threadview&id=204979 [google.com]
Re:Smart Criminals (Score:4, Insightful)
Don't forget gross margin is not real profit. Net profit margin is. Gross margin doesn't take into account salaries, rent, utility bills, security camera installation and maintenance etc. And of course; lost due to shoplifting.
Re: (Score:2)
Or they just dodge taxes so their official profit is minimal.
Re:Smart Criminals (Score:4, Informative)
Profit margin isn't constant from year to year, look at the averages. Some even have negative averages. I would say the average of all the averages is around 1-2% over the years, say 3% if that makes you happy ;-) Oh, and this is from 2009 to 2013. Not a decade ago:
Link 1:
http://ycharts.com/companies/LBLCF/profit_margin [ycharts.com]
Link 2:
http://ycharts.com/companies/SWY/profit_margin [ycharts.com]
Link 3:
http://ycharts.com/companies/KR/profit_margin [ycharts.com]
Link 4:
http://ycharts.com/companies/SVU/profit_margin [ycharts.com]
Link 5:
http://ycharts.com/companies/WFM/profit_margin [ycharts.com]
Link 6:
http://ycharts.com/companies/NGVC/profit_margin [ycharts.com]
Re: (Score:2)
Then, nobody would pay taxes and the government would go bankrupt. A company only pay taxes on profits which is very little. A basic principle in our capitalist society is that only the end user pay taxes. The end user is the cash cow and ends up paying for everything, all the time ;-)
Re: (Score:2)
Don't forget gross margin is not real profit. Net profit margin is.
That's a bit like saying salary is not really salary because it doesn't account for utility bills, rents, maintenance, etc. If businesses are to be taxed only on what's left after paying the bills, individuals should be afforded the same luxury and vice versa.
FWIW, for businesses, most taxes are paid on the NET (e.g., income tax, SE tax), but some are paid on the GROSS (e.g., excise/sales tax, business tax/licenses). For individuals where most taxes are paid on the GROSS (income tax and SS tax), but taxes on passive gains (such as investments) are paid on the NET.
One theory is the expenses of a business are like an investment that the business is making in itself to generate revenue. If a business itemizes $2M in "existance" bills to sell $2.1M worth of stuff,
Re: (Score:2)
Re: (Score:3)
UK supermarkets make much more than that. The US ones must be doing something wrong.
Maybe on the cheapest lead-in items they make 1-2%, or even a small loss, but there are lots of higher profit items they sell too. The classic rip-off are the "premium" ranges like Tesco Finest which are basically the same shit as their value stuff but in a different packet. Medicine is even worse - if you look at the "PL" code on the box you will see that the cheap own-brand stuff is usually exactly the same as the expensiv
Re: (Score:2)
As an earlier post suggested, this may be a number determined by tax laws. If high profits result in high taxes, then the money is likely to be spent on things that, while benefical, reduce the profits. What things are likely to depend on what they can buy from their parent corporation, or from other companies owned by their parent corporation.
N.B.: I'm not asserting that this is true. I am, however, asserting that one shouldn't put too much trust in that number.
Re: (Score:2)
Re: (Score:2)
I wrote:
" to sell 1000-2000$ worth more to make it up unless they already have calculated the shoplifting costs in their 1-2% profit margin"
which they obviously have, along with other costs. Thank for the clarification anyway ;-)
Also if you look here, you will find out that Kroger as an average net profit of 0.99% for the past 5 years.
http://slashdot.org/comments.pl?sid=4111255&cid=44629005 [slashdot.org]
Re: (Score:2)
Supermarkets have a typical profit margin of 1 to 2%. It means that if you steal 10$ worth of food they need to sell 1000-2000$ worth more to make it up unless they already have calculated the shoplifting costs in their 1-2% profit margin. No store stays open for long without makings profits so your "profit maximization" argument makes no sense.
Any businessman will factor in all costs, like hiring more cashier, security guards, security cameras, utility bills etc. when determining their sale prices, it is economy 101.
The goal for any business is to keep shoplifting as low as possible for the cheapest cost ratio possible in order to be able to keep prices down and maximize profits.
http://www.foxbusiness.com/personal-finance/2012/12/20/retail-worst-enemy-their-own-employees/ [foxbusiness.com]
Says that employee stealing is worse then shoplifters, so it seems that Supermarkets biggest problem is it's own employee's.
Re: (Score:2)
Sure, but that isn't different in other industries. I have worked for a bank that got 5 millions robbed through computer system manipulation from insiders and they never managed to identify the culprit although they were positive it came from inside. It doesn't make the guys who rob branches at gun point heroes although, even if they rarely get 5 millions and shoplifting is still a cost of doing business for supermarkets.
Re: (Score:2)
Re: (Score:3)
I wrote:
"Any businessman will factor in all costs", especially if they only make a 1-2% profit margin.
There is just too many middle men taking cuts along the way but this is a different topic. Local agriculture and buying local is one solution to that topic. Do you practice it? It sure beats shoplifting as a solution.
https://en.wikipedia.org/wiki/Local_food [wikipedia.org]
Re: (Score:2)
Re: (Score:2)
You mean over at the Farmer's Market where the fruits and vegetables are significantly higher than they are over at Safeway? Eating local like eating organic isn't cost effective (comparing the costs of the two, not the long term costs of poor health due to eating GM food, etc).
[John]
Re: (Score:2)
An interesting point. There is NO POSSIBILITY of ANYONE knowing the long-term costs or benefits of eating GMO products. In fact the entire concept is probably wrong, because it's likely that some GMO products will have positive benefits, some negative, and the majority neutral. Occasionally one can point to some specific benefit, as in golden rice, but even that may well be associated with long term costs that we don't know about.
Worse than that, the information about what the costs and benefits are is g
Re: (Score:2)
But shoplifting increases the cost of doing business, and therefore the profit maximisation point on the supply/demand curve will be at a higher price.
Re: (Score:2)
I guess only if the bank goes bankrupt and cannot reimburse the account holders...
https://en.wikipedia.org/wiki/Federal_Deposit_Insurance_Corporation#Resolution_of_insolvent_banks [wikipedia.org]
Re: (Score:3)
True, it makes a great read - when nobody is cleverly and ingeniously maimed or killed.
Re: (Score:3)
Another example of the increasing skill requirements for today's work force. 50 years ago the only skills required to rob a bank was the ability to hold a gun and drive a getaway car. Now - sheesh - you have to know how to break into a high security switch.
The average guy has no chance to make it nowadays.
Re: (Score:2)
Makes me glad I am not going to live 300 years in the future. You know what they'll be teaching in high schools then? Shit would probably go way over our heads.
Re: (Score:2)
Not to mention that takes were probably higher in the bad old days as well. Nowadays since it's all numbers in a database, the bank only needs enough cash to cover withdrawals for the day (which aren't tha
Re: (Score:2)
If you're going to go down for something, make sure it's big. In the case of theft, make sure you're stealing several wasted lifetimes worth of money so that you can afford the legal defence, and eventual breaking out of jail. And you can afford to do the same for everyone involved.
There's no point getting banged up and a criminal record for petty theft.
I'm with you on this - it might be criminal, and it might be taking money from the banks customers, but it sure is a slick manoeuvre.
Re: (Score:2)
Indeed. And they even were smart enough to not get greedy, the typical downfall of otherwise smart criminals and criminal hackers.
Re:Smart Criminals (Score:5, Funny)
Re: (Score:3, Insightful)
Re: (Score:3)
Three unnamed banks. They could be three credit unions who have done you no wrong.
Plus, the more banks r*** people on a daily basis, the more profit bank robbers achieve. Its in their best interest this situation continue.
The banks simply pass on the costs to their customers.
Re: (Score:2)
And so, in the end, it's really the customers that the thieves did fark over, weighted inversely against the efficiency of these customers' bank's security. This is exactly like how, with welfare states, net wealth transfers are averaging to the base amount of voluntary contribution to the wealth pool by participants, minus the losses of doing the transfers ; and at the individual scale those net effects are weighted against the participant's competitive advantage at being a recipient and at avoiding being
Re: (Score:2)
Look at it another way: Maybe these are banks that haven't wasted a lot of investor funds on computer security, and instead saved that money and loaned out those funds to turn a bigger profit. Maybe they made more money over the years through loans than they lost in the theft?
Let's say that $45 million would be the profit on about a billion dollars in loans (a very rough approximation, but good enough for this analysis.) Suppose that billion was spread out over a decade. They had to have saved more than
Re: (Score:2)
Give them a couple of weeks. They'll start pulling the same shady shit that the credit card companies pulled - changing late fees and late dates without notice, etc. Remember: These are the assholes responsible for the mortgage collapse...they'll close their doors before they cover the costs, and since nobody gets a paycheck without their help there's not a whole hell of a lot that anyone can do about it.
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Funny)
In this specific case, it's more like a serial rapist finally getting raped.
I miss car analogies...
Re:Smart Criminals (Score:5, Funny)
*taptap...onetwo...thisthingon?...taptap...onetwothree...good
*clear throat again
Ladies and Gentlemen, I present to you: the car analogy for our topic tonight
It's like...with the police behind following you in your car...
blinking left, but taking a right turn!
*badabumm
Thank you, thank you, I'm here all night.
Re: (Score:2)
And then the cops turn left and are all "Where'd he go? He just disappeared!"
Re: (Score:3, Funny)
I miss car analogies...
The Ford Pinto plant getting rear-ended and blowing up?
Re: Smart Criminals (Score:2)
how about a drunk driver crashing and burning.
stealthy? (Score:5, Informative)
slow and stealthy denial of service attacks
I don't think a DOS can be stealthy......if it's denying service, are people going to notice?
Re: (Score:2, Funny)
If nobody's around when the DOS is being executed, did it really happen?
Re:stealthy? (Score:5, Interesting)
slow and stealthy denial of service attacks
I don't think a DOS can be stealthy......if it's denying service, are people going to notice?
A stealthy DOS is when the attack looks like a normal occurrence, and not an attack. It is not the DOS that is stealthy, it is the attack or, rather, the reason for the lack of service.
It is a very neat thing, actually. Say you have a very long, segmented fence. There are 1000000 segments, and every day 1 of those will break and stay broken for 10 seconds. You can't explore that, because it is random, and you can't try all 1000000 segments in 10 seconds. However, if you can force the dice and make a specific segment tail, you can be there and exploit it, because you know which one and when. To the external observer, however, it was just a normal, run of the mill segment fail.
It is the same concept. The failure is there, they notice it, but it is done in such a way they don't notice it is an attack.
Re: (Score:2)
Re: (Score:3)
Woosh.
No they don't notice that the real attack is different from the previous 'fake' attacks.
Re: (Score:2)
what if they are requesting heavy pages? what if they slowly increase the load for several hours/days? you can see a increase, but don't care much, it looks like normal users , a natural increase of traffic ... only after it keep increasing or is sustain for a long period you start to be alert. And even that you may point finger to a deploy made a few minutes/hours/days ago that might have change the site load distribution ( you may test for errors before deploying, but load factor is harder to test, specia
Re: (Score:2)
Re: (Score:2)
A better analogy would be a case of an actual bank burglar. There was a guy (many decades ago) who found a way to set off a specific burglar alarm sensor at a local bank. Every night at 2:00 AM or so he would do whatever it was to trip the alarm, then quickly sneak away. He'd watch the cops arrive, shine their flashlights around, find nothing, then leave. After repeating this pattern for a couple of weeks, the cops stopped showing up after the alarm was tripped. He then broke into the bank.
Re: (Score:2)
A DoS should be stealthy if the purpose is to e.g temporarily get a part of the system to accumulate transactions.
The resulting queue can then be manipulated before stopping the DoS
Re: (Score:2)
Stop giving toads such a bad reputation, thanks.
Something (Score:4, Interesting)
I must be missing something -- did these people transfer it to an account then go withdraw millions in cash quickly? Or did it take months for it to be discovered?
I can't conceive of any other way that would insulate against a reversal, no matter how many accounts and banks around the world they forwarded it to. Even Swiss banks go along with obvious criminality investigations nowadays.
Re: (Score:3)
You assume that banks have full referential integrity. I.e. Every transaction must have a source and destination account, and both accounts can be verified from their server.
If they don't then you just say it got sent to another bank where they can't verify the destination, then send another transaction to a different bank for the same value.
Or if you really want to cause hell, just change numbers. Make money appear from nowhere or make it vanish.
You can't stop the world's banking networks and replay each t
Re: (Score:3, Interesting)
You assume the banks actually WANT to catch the criminals. They'll just use this as an excuse to fleece their customers. "We're now adding a $1/month anti-wire-payment-switching fee to all accounts." Add a little spin, and the cost is there to protect YOU, Mr or Mrs Customer ... and there you have it. The millions stolen will be reimbursed in short order. After that, it's pure profit.
Re: (Score:2)
They'll just use this as an excuse to fleece their customers. "We're now adding a $1/month anti-wire-payment-switching fee to all accounts."
But first, they need to collect from the insurance companies.
And then they need a government subsidy to help protect their infrastructure in the future
Next, they'll re-negotiate costs with their partners who failed to protect them ("Why are we paying you so much? If you want to keep us as your customers then we need to talk price. Oh, no need to actually fix anything;
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
They transfer the funds to money mules who then transfer it to them using Western Union or similar. It is the money mules who end up losing out when the fraud is discovered. The transfer to them gets reversed, leaving an overdrawn account, but withdrawing the money as cash to take to a Western Union shop isn't a reversible transaction.
Banks... (Score:2)
..will just use this as an excuse to hold your money even longer. Thanks Obama.
Unsigned transactions? (Score:4, Interesting)
Re: (Score:2)
A little too easy - sadly (Score:5, Interesting)
The bottom line is that we need to harden up our defences more and more. We may even have to disconnect essential financial infrastructure from the internet and bring it back onto a completely private network that it costs a substantial amount of money to join and be authenticated to. It should come with the proviso that any device connecting to it, could also not be connected to the internet or an unknown intranet device at the same time. This would not be bulletproof, but it would substantially reduce the risk.
Re: (Score:2)
Perhaps a 24 hour hold on all transfers would take care of much of the problem. By having a built in delay any institution could judge normal traffic by running software designed to notice unusual transfers. It is rather like a credit card situation. Many card holders are very consistent if shopping close to home exclusively. So why not have software that red flags when a person suddenly seems to be hundreds of miles away and have stores carefully check IDs or get a phone conversation with the card
Re: (Score:2)
Halarity ensues... (Score:5, Funny)
You be amazed (Score:5, Interesting)
NO.
Why?
Cost to test would involve the entire country and would cost millions.
OK.
So they are still losing messages.
Re: (Score:3)
Too big to fai^Wrepair.
Re: (Score:2)
You would be amazed - or maybe shocked - to see some of the banking systems out there. I have worked for several financial institutions and their systems are usually very very old legacy crap stuck together with bubble gum and faith. One place was dealing with 70% of the countries financial messaging and they were not using transactions, if there was a problem (and there often was) messages were lost. Asked if I could change it to use transactions, couple lines here, couple lines there.
NO.
Why?
Cost to test would involve the entire country and would cost millions.
OK.
So they are still losing messages.
How much do the lost messages cost the company?
Re:You be amazed (Score:5, Interesting)
I had an instructor for Windows Server Security whose day job was doing pen tests of financial institutions. When they would arrive on a site and set up in a conference room he would unpack their equipment while his partner would get on the phone calling branch offices. "Hello, this is George, the new guy on the HelpDesk. I need to make some changes on the network equipment in your office, but I don't have the login details and my coworkers are at a benefits meeting. Since your branch manager has sufficient permissions can I ask a really big favor and get his login info?" In two years of pen testing he never failed to acquire branch manager credentials from at least one office by the time the equipment was even unpacked and set up.
uhh....what banks!!??!! (Score:2)
Re: (Score:2)
Great. Just great (Score:3)
You would think that at this time, that they would be smart enough to limit the internet's transactions, to being slower than what it takes to process the security issues.
Bait and ... (Score:2)
No senior exec is going to be held accountable (Score:4)
Even when they lie through their teeth to sell junk as gold to others they don't end up in jail. We all will pay, through more bank fees, more insurance costs, more taxes to bail them out. And they will dance all the way to their own private bank.
Which banks? (Score:2)
I hate when an article eludes to a point but never actually provides the full disclosure details.
Which three US banks?
Ancient Everything (Score:4)
I happened to be at a bank yesterday, inquiring about a bank transfer. Turns out it was cheaper for me to get a bank check and overnight it than it would be to do a bank transfer, and the bank transfer wasn't even guaranteed to be complete within 24 hours.
The young teller thought the system was as odd as I did ("hey, I just work here") and was more interested in asking me about nuclear transmutation in star formation than banking (my strange little world...) but I have to assume that when the banks are 20 years behind Western Union and Walmart that their systems are too. I wouldn't expect 20 year old systems to be robust against attack and it would surprise me if they put much effort into otherwise defending them.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Cool tip, thanks. Not relevant in this case, but we do have a few national banks in the area and it might come up again.
Re: (Score:2)
Prime Risk (Score:2)
Tracing the Transfer (Score:4, Insightful)
Re:And now to our resident expert: (Score:5, Funny)
Re: (Score:2)
Re: (Score:2)
Re:You know I really love (Score:4, Informative)
"The researchers said fraudsters were using Dirt Jumper, a $200 crimeware kit that launches DDoS attacks, to draw bank employees' attention away from fraudulent wire and ACH transactions ranging from $180,000 to $2.1 million in attempted transfers."
Sounds like theft to me. Now granted it says "attempted transfers," but, I think someone made themselves very rich while only giving the banking system a minor scratch. A few million is pocket change in the land of banking.
Re: (Score:2)
Yeah a few thousand more of these and the banks can finally receive an adequate fine for the crimes they committed a few years ago since the government doesn't have the balls to do it.
Re: (Score:2)
Re: (Score:2)
What will he tell the IRS? That could get tricky. And if he doesn't pay his protection money, the feds could get impatient with him.
He'd better have really thought things through.
Re: (Score:2)
And this is why the NSA is monitoring all the internet traffic in the country, to stop things like this happening. Except it didn't work very well this time did it?
Or maybe this is one way the NSA gets around the sequestration, get 20% of their budget back and then they won't have to lay-off 90% of their sysadmins ;-)
Re: (Score:2)
I would guess, without checking, that the quote is from Stalin. If so, I deny that he was ever a communist. He was a gangster, who was also good at political manipulation. Even the government he was manipulating wasn't communist, though it was trying, at least officially.
FWIW, there has never been a communist group ruling more than a small village. This is because the system doesn't scale at all well, and only works when EVERYONE knows EVERYONE. (Not everyone needs to be trusted, but you need to know h