Follow Slashdot stories on Twitter

 


Forgot your password?
Close
typodupeerror
×
News

UK Banks Blackmailed by Crackers 98

Posted by Roblimo from the pay-up-now-or-pay-up-later dept.
Palin Majere writes "This story from USAToday reports on how banks in the UK are finding it cheaper (and easier) to pay off cracker groups rather than try and defend themselves properly."
This discussion has been archived. No new comments can be posted.

UK Banks Blackmailed by Crackers More

UK Banks Blackmailed by Crackers

Comments Filter:
  • that gets me thinking:

    If I go to a company and say - I found those security breaks in your system, I can fix them if you'd pay me.

    Is that blackmail?

  • Sure.

    Bank: What did you do to break in?
    Blackmailer: Well, I... (yadda yadda yadda)

    Where is the trust in this situation? As mentioned before in the comments, the blackmailer could have multiple ways in, or multiple backdoors, etc. It would only take one easy way in to do more damage -- or have the potential to do more damage.

    Blackmail is not about trusting someone. It's about knowing that you definitely don't trust them, but attempt to make the situation better for yourself. Getting answers from blackmailers would be just as easy as eating an asphalt pie.
  • Regarding the activites of crackers and blackmailing backs. I'm sure most of the threats are just DOS attacks that may or may not actually involve compromising the security of the bank.
    Consider the scenario of a banks communication network breaking down.
    Here's how it might work:
    Lets say the main branch in London has a computer failure. Now, that's all ok for an hour or too, but if it lasts much longer, especially at some strategic time (like during backups) then the bank will start having problems.
    Now, instead of transferring monies out of an account the crook simply withdraws the money from several banks, one after the other. They won't notice untill after the link comes back up.
    Ok, so the banks that are offline can't deal with major withdrawals. So now, they really can't do anything, except dissalow withdrawals. Then, when the news hits, there may be a run on the bank... (This is really bad news.)

    Now, the tricky part here is that the bank would rather pay someone to not attack than to loose it's buisness for a day, no big deal. As soon as the scenario becomes reasonably common, the bank may well move to more economical means of protection.

    Also, it seems like this kind of scenario is likely to be an inside job. A banker should be well versed in how to perform massive money transfers discreetly, and have appropiate contacts to do so. The insider already has acess to the system, and can easily forge an e-mail by simply bypassing physical security.
    Furthermore, with inside information, the crook could verry well know what sums of money would be considered small enough to be acceptable payoffs.

    Otherwise there are massive issues with this sort of caper. AFAIK most banks use proprietary systems. Most of these systems were written a long time ago by professional high-end programmers, not the indian sweatshop programs available from MS, so each system is unique, and may well require insider info. The actual transfer of money would also be very difficult to perform securely.

    NTG
  • Perhaps it's not monitary transactions that the crackers threat is based on. Privacy is a large concern of most banks ( especially in Ireland where a couple of large banks have been exposed of stealing from their customers ).

    There is a lot of sensitive information in a bank, and more importantly, a bank's financial success depends on it's public image.

    Can you imagine the bad press if a cracker group post a/c details of some corporate clients?

    mmmmm... bad medicine....

  • You mention that
    The drives are hooked up using fibre channel as though they were local hard drives to the machine. If you know what you're doing, getting inside one of these links can be quite easy.
    I haven't used any fibre channel devices yet, but isn't this just a fiberoptic link? If it is, how can it be easy to get inside a link? From what I've seen, fiber optic communications are among the hardest to tap physically.


    --Phil (Pardon if I misunderstood--as I said, I haven't yet had much experience in this area.)
  • Many worldwide banks offer NetBanking as a way of allowing customers access to their account, bill payments, loan payments, etc over the net. The way this is done is not through a browser, but through a secure on-line client terminal, developed by the bank (which is not open source ;-) ).

    My bank has an interesting solution here: It uses a client, which does all the wacky password stuff, and then acts as a local proxy, so that you can use your normal browser, but only with the security program working. It can be a bit of a pain to setup when you're already using a proxy, but not all that bad. And it seems to work - I haven't heard of any great problems yet.

    Of course, the nice thing about just having stuff on the web is that you don't need any proprietary software - it'll work on any OS that has a browser!

    Of course, you'll want decent encryption - would a "simple" solution that used 128 bit encryption be generally decent? Would most of you trust it?

    (of course it would depend on a lot of other things... but hey)

    If so, all we need is to allow 128 bit encryption everywhere! There's that familiar refrain again...
  • I can't imagine that banks can't track down their own money to find out where it is, and then nab the crackers from there. ("Yeah, sure, we'll give you money! --Aha, gotcha!")
    I also can't believe that these skript kiddiez all have secret Swiss bank accounts or something. Wouldn't a deposit of $400,000 by an unemployed teenager be suspicious? This isn't exactly an amount of money you can hide under your bed.
    Reminds me of a local incident a couple years ago, where a couple skript kiddiez hacked an e-commerce server, stole credit card numbers, then had stuff *shipped to their homes*. And they wonder why they got caught...


    "During your times of trial and suffering, when you see only one set of footprints, it was then that I was riding the pogostick."
  • Perhaps opening an account to receive the message leaves too much of a trail? I don't recall the article saying *how* the crackers were paid off (suitcase full of cash, say; or seized collateral, or whatever) but the bright ones, presumably, wouldn't accept anything like a personal check...
  • I think he meant that it was backwards in that crackers are more commonly known as malicious hackers (at least as far as the media is concerned), rather than vice versa.

    Jason.
  • Thanks for the info. I'd never even heard of this shmoe, but i was *very* suspicious of an article like this in USA today. I mean, come on. This is a news paper more used to telling you what kind of potato chips most americans eat, in 98 eye-catching colors ("The dreaded USA-Today effect").


    -nme!
  • CitiBank did the right thing when they were cracked. They went to the authorities, cooperated, helped in tracking the crackers down, and were willing to testify against them. Exactly the right way to go about putting these criminals in jail

    Unfortunately, as these things go, the press ran with the usual "CitiBank gets hacked!" headlines, with the result that CitiBank lost nearly all of its most lucrative accounts almost immediately. This lesson has not been lost on other banks, who will now gladly pay a protection racket "reasonable" fees rather than loose their own lucrative accounts. This will probably go on until either the authorities jail some high-level banking executives for obstruction of justice or complicity in covering up a crime, or depositers wise up and realize that a bank like CitiBank is probably a much more secure place to put one's money than a competitor which gets cracked in exactly the same way, but covers up the incident and finances future cracking missions with payoffs to boot!
  • There is one good reason why most banks in this situation will not inform the authorities at all. Banks rely on public trust in them to earn their money. If they reported such a blackmail attempt to the police it would necessesarily become known by the public. The cost of this in terms of plummeting business (would you lend your money to a bank with that lax security?) would far exceed the $100000 or even $1000000 in ransom. So they pay up and hope it just will go away. /Dervak
  • Wince through the teller screen at your local bank and I'm willing to bet what you'll see... No, it's not a gaggle of blonds - it's passowrds on postit-notes stuck onto monitors. They're crying to be abused!

    And on a related note: Until recently TSB's ATM network in The UK used modem dial-up to network their cash machines in the North of Scotland to the rest of their network. Further more no encryption was employed over these lines. Unencrypted transfers on public lines - sheesh!
  • There are two, neither of which you listed...
    1. A bit of hype about those evil hackers will go a long way (i.e., from newspaper to newspaper, country to country...)
    2. Sufficient doses of hype will induce TREMBLES (Traumatic Reflex Evoking Multiple Blank Line Entry Syndrome), as evidenced in your message.
    Hope this helps...

    (I will admit I was unable to distinguish in this case between TREMBLES and MUMBLES [Monkey Using Multiple Blank Lines for Emphasis Syndrome] so I gave you the benefit of the doubt.)

  • Some members of a mailing list I subscribe to (ukcrypto) have suggested that this is simply a scare story whipped up by GCHQ (think British NSA) to try to get big companies to use their consulting services.

    See this archive [ucl.ac.uk].

  • This was all made up by the UK's NSA. (Score:3)

    by Paul Crowley ( 837 ) on Tuesday September 21, 1999 @08:56PM (#1668385) Homepage Journal
    Inhabitants of the "UKcrypto" mailing list, for discussing government cryptology policy, have come to the conclusion that this story is a complete fabrication, "cut from whole cloth" by GCHQ (the UK equivalent of the NSA) to spread bad words about strong crypto and encourage regulation.

    The original story has bizarre references to "hackers" holding up banks "with crypto" - I know it's a munition, but you can't point it at a bank teller!

    See for example thi s article [ucl.ac.uk] by highly respected cryptologist and computer security expert Ross Anderson, who is also co-author of AES candidate Serpent. Note also thi s observation [ucl.ac.uk] on bank panic stories, or read the whole thread [ucl.ac.uk] (search for "today's Times").

    I'll also echo the comments here about Jonathan Ungoed-Thomas's hilarious attempts to cover security issues, among other iGaffes.
    --
  • Go read some back issues of www.ntk.net to know more about the most outrageous cyber-journalist in the UK, Jon Ungoed-Thomas. This story is pure fantasy, as are most of his stories. He is a scare-monger of the worst kind.

    Many times he has been caught sending out emails from his work account, pretending to be a female eco-terrorist. Then he started using hotmail but filled out the registration form with his own name, and it was sent with the emails. He is astoundingly stupid and clueless.

    Now, there may have been some extortion attempts against banks recently by script-kiddies. During the Secondary DNS Con, civic minded hackers announced that the Scottish National Party's web site had no security. They then gave the web masters 2 weeks to fix it (the idiots applied a single M$ patch), then cracked the system and defaced the home page with some very funny stuff. Obviously the hack was long in the making.

    Since then, there has been a lot of poking around websites all over the place in the UK, and since most of the security holes are application based, adding firewalls doesn't do much good.

    I expect some script-kiddies sent an email to a web master at a major bank, demanding money or "the web site gets it". Mr double-plus-Ungoed has managed to fabricate a huge threat out of that with his tabloid trash writing.

    Bank security for transactions doesn't go through web sites, despite what clueless wanna-be hackers would love to think. Any real cyber-threat to banks is well funded by organized crime, and the hacks are months in the execution. The payoff can be huge, and usually requires inside knowledge. Mr Ungoed can't even figure out hotmail :-)

    the AC
  • This is really old news. The german magazine "Der Spiegel" had article on this very subject already years ago. Actually, in most cases the extortors were just making idle threats. In other cases, the internet wasn't involved at all: the attackers just threatened to detonate a HERF device (which would destroy all data on computers nearby) near the bank's headquarters. Even if network security is up to snuff, there's really not much you could do against physical attacks. And this would also explain why the attackers usually prefer ransom, rather than stealing the money from accounts.

    Btw, a couple of years ago, there was an incident where somebody fraudulently transferred away a large sum of money from Pernot-Ricard's (famous pastis drink producer) account to a numbered account in Switzerland. The perps were hoping that the incident would stay undiscovered, in the naive belief that at a company nobody would check bank accounts...

  • "If you know what you're doing, getting inside one of these links can be quite easy."
    If this is so easy, then it *really* ought to be trivial to listen to any phone conversation you want (I mean come on, a lot of the phone network isn't even digital).

    If you are such a badass information warfare expert, why don't you just tap into a few conversations between CEOs of huge evil companies (ie MSFT) and let everyone know about the nefarious schemes they are hatching.

    And hey if it's so easy to jump from the PBX into the data network, it should be just as easy to do it from the power grid, right? I mean c'mon they're all wires that are sorta, somewhat, in some way connected with each other.

    Gimme a break. Somehow I just don't think getting information is quite as easy as you say, or we wouldn't have the NSA squawking about encryption technologies and the like all the time.
  • My bank (Toronto Dominion) has a net banking solution.

    It grew from a touch-tone system (which I avoid using) to a proprietary client to a browser based app. They recently phased out the propietary client.

    However, I would not be able to legally access my info outside of North America. Yep, it only allows 128-bit crypto. It'll reject anything else.

    Between that and the phone, I trust the browser more. It is really easy to just record a phone session and get the touch-tone password and card number.

    So banks outside North America are getting the shaft due to dumb US export restrictions.

    Quite frankly, I'm surprised they're "letting" us use it. But then again, is that IP owned by the US government? What right do they have to impede international business?

    What pisses me off the most is that I can't really do anything about it. They're not going to listen to me, as I'm not a US citizen.

    All of you US people should each write a monthly letter to their politicians, or a monthly fax. Let them know how strongly you feel.
  • From my point of view the decision of the banks makes sense. First, they have to protect themselves from the loss if customers. This can be acomplished by paying the ransom. As someone else pointed out already, you can try to catch the blackmailers when picking up the money.

    Second, you fix the holes quietly to prevent other crackers to do the same. And you still keep it quiet.

    Trust is really important when you give somebody your money. You trust the bank that they give back the money you gave them. Therefor you trust them to be able to protect the integrity of the finance tracking system.

    Let's take that a bit farther: What if it becomes known, that more than one or two banks, namely nearly all banks, are vulnerable and not too difficult to crack? What might happen? The customers may lose their trust in the banks and get their money back and/or keep it to themselves. If this happens on a big scale you decrease the available money for the servies of the banks like investing and credits. Without being able to get a decent credit other investments will not be made and so on... The financial system slows and the economy suffers. Therefor there is less money on the side of the investors, which they still keep to themselves...

    Trust is really important for the economy. You have to trust the government, that those cheap printed paper slips with numbers on them are really worth more than the paper value. You have to trust the banks, that you get your money back. And therefor they have to pretend that they are invulnerable. Behind the scenes they may act completely different, but in the face of the public they have to keep their face.

    BTW: I really liked it, too, that the author didn't mix hackers with crackers as many others do.

    Björn
  • City investigators say at least two London financial institutions have paid out ransoms totaling more than a million pounds ($1.6 million)," says the paper.

    So what's the uk rate for a competent sysadmin? 80 pounds or so? An ounce of prevention...
    --Shoeboy
  • Now that it's been revealed that banks have poor records in dealing with electronic attacks, does that mean that faith and trust will be lost in the entire banking sector (rather than just the banks that are actually sloppy)?

    This is bad timing - just in time for the Y2k currancy rush. I wouldn't want to be working at a bank at the moment. Remind me to have more on my credit card than in my bank account on the 31st of December...

    CJ.

    PS. First post again?!?

  • Its amazing.
    I don't understand how it could be so easy to crack what should be such a single-minded system..

    Sounds like the bank is trying to do too much on one server..

    Or maybe is it a lack of encryption issue?

    If I can set up my linux box to accept packets with a simple service, and I proof the code enough, then I don't have to worry about anything but DoS attacks.. and the firewall should be handling that...

    And if they are cracking your firewall, you need to hire a new admin, because the old one is incompetent.
  • They called malicious hackers crackers. glad there not confusing the two.
  • Reports of malicious hackers, more commonly known as crackers...

    Is it just me or did they get that backwards? :)

    Well, at least they actually used the proper term some of the time...

    Ribo

  • You're quite right..
    Just one thing that came to my mind: If the crackers are so good that they can do what they want (or at least that's what the banks think they are), why don't they just transfer the amount of money they want to their own accounts? Why go all the trouble in blackmailing the banks? Makes me wonder if a bank would give me money if I sent them a note I'll crash their machines if they don't..
    --
  • If there's one group that I trust to honor privacy even less than any of our governments it's large corporations. And if there's any group that I trust less than large corporations to honor privacy, it's crackers.

    Does anybody know if these crackers are anything more than greedy script kiddies?

    With this kind of thing (governments eroding privacy, eroding any attempts to use encryption, private sector being even worse about privacy, etc.) the average law-abiding citizen in any country might as well post a daily log of all their activities and financial statements to USENET, because everybody could get to the info anyways.

    And, jeez, how hard is it, really, to separate a bank network from the internet entirely and only allow absolutely necessary things through firewalls? (and to keep computers up-to-date, for that matter) Or is this all mostly being done by people that manage to get access (somehow) to terminals in the banks themselves?

  • Been happening for a long time (Score:5)

    by Anonymous Coward on Tuesday September 21, 1999 @05:36PM (#1668403)
    As someone who's been involved with various information warfare efforts over the years (hence the AC posting) this has been a well known fact for at least the last 10 years that I know of.

    The methods of blackmail are very simple as most of the systems run over standard high bandwidth lines. It's a simple enough problem to get into these systems by going through the exchange points rather than walking through the front door of a bank (just like breaking into most company networks is actually much easier to break the PABX system and then jump across into the data stream that contains the network link rather than trying to attack the firewall directly).

    Most of the time, the banks don't even bother with varifying the cracker's claims. They just pay up the cash and be done with it. You'd be surprised as just how lax most banks are with thier internal security. Oh, this system is inside the network so we don't even have to worry about encrypting the comms between our two mainframes even though their located at two different sites 50Km apart.

    Another interesting whole to watch out for in the future will be the increasing use of direct fibre channel connections. Some of the setups that I've seen put the mainframe connection in one site and the drives and backdrives in two separate sites. The drives are hooked up using fibre channel as though they were local hard drives to the machine. If you know what you're doing, getting inside one of these links can be quite easy.

    Despite repeated demonstrations of how easy some of these systems are to break, the banks just don't seem to be interested in trying to make it more secure. They don't want to spend the extra money because it eats into the profit margin. Security through obscurity seems to be their favourite mantra. Fscking idiots!

  • you never lose the Dane.

    of all the policies I've heard, this is the most short sighted. Of course, not much detail is given out, but I can see this already:

    1. crack root on one bank's machine.
    2. metastatize into the whole LAN.
    3. install backdoors everywhere.

    Now:

    4. give a vivid demo + ransom instructions, signed
    with one handle. Obtain ransom. Observe which backdoors are undone. Restore what you can.

    5. wait.

    6. if (backdoors >= 1) {

    a. select new handle and set of ransom
    instructions.
    b. repeat steps 4 and 5.

    }

    Lovely, eh?

  • Long term /Short term and Capitalism (Score:3)

    by Tsk ( 2863 ) on Tuesday September 21, 1999 @05:23PM (#1668405) Homepage Journal

    Thi is exactly the kind of attitude I can't understand in the Capitalistc world were leaving in.
    Sure on the short terms it's cheaper to pay the hackers to send them elsewhere (like your comperitor). But on the long term this really is bad:
    * Crackers will see in such deal a good way to make money, they'll come back (this will increase the cost of security)
    * Since they just pay the cracker and don't do anything about security, what will happen when the cracker dosn't try to get paid by the bank but takes what he wants

    On the long trem the money should be spend on increaing security .....

  • Why go to the trouble of actually doing something when you can just cash in on threats?

    Make $$$ in your spare time! Have the bank pay you for your cracking skills!
  • it appears that it is actually cheaper to get this 'protection' from hackers than to employ a 'security expert' to protect the system.
  • I think that, at some point, giving in to these people will legitimize malicious cracking in the eyes of many. This will only lead to more cracking attempts, and the more people there are trying to crack systems, the more likely a given system is to fall.

    Furthermore, this is bad because banks depend heavily on the trust of regular people. Since they take the money you deposit into your savings account and loan it out, making money on the interest the borrowers must pay, it isn't good for the bank if too many people lose faith at once and come for their savings.

    I wouldn't feel good about having my money in a bank that gives in to the demands of script kiddies. :-)

    Take care,

    Steve

  • Gee with this sort of behavior, I can only wonder how long it'll be before there's financial security in our time.

    Idiots.

  • cHrackers (Score:3)

    by Matt2000 ( 29624 ) on Tuesday September 21, 1999 @05:29PM (#1668410) Homepage
    Overheard on an unsecured line:

    "Did you pay off the hackers?"
    "Yes, they're covered."

    "How bout the crackers?"
    "Ya, we got them too."

    "Snackers?"
    "Trying to find them."

    "Meat packers?"
    "I can only work so fast boss..."

    Hotnutz.com [hotnutz.com]
  • And don't underestimate the influence law enforcement has on policy, especially in the
    uniquely British system of banking. And London
    journalism is nothing if not sensational.
  • Let's say that a 200k$ machine brakes DES on a 3.5 day average(has been done!). So 20k$ brakes it on 35 day avarage. And 2k$ brakes it on 1year average! So security depends on the expiration time for the data: 1 year -> 50% chance of success, 6month -> 25% etc. Key change rate is also important. Already with 1% chance of BIG payoff such a machine is mighty tempting.

    LINUX stands for: Linux Inux Nux Ux X
  • They wouldn't have to transfer funds to hurt the bank, just steal some "private" info. The bank would *not* want the media to know that their system had been cracked, even if it was only minor. Joe Sixpack finds out his banks been cracked, he rushes to withdraw all his cash. If too many people do this, oops the bank has no money because it's out on peoples mortgages, car loans, et cetera.
    Cheers,

    Rick Kirkland

  • "I think that, at some point, giving in to these people will legitimize malicious cracking in the eyes of many. "

    Haha! Bank Robbery will undergo a renaissance,
    after a lull in popularity since the 1930's!
    A whole new generation of underworld gangsters
    to worship in the *next* gens media!

  • Re:Been happening for a long time (Score:4)

    by The Dodger ( 10689 ) on Tuesday September 21, 1999 @09:03PM (#1668416) Homepage

    I've heard a lot of people dismissing this story as pure fabrication and, whilst I do suspect that Ungoed-Thomas doesn't have a clue about what he's writing about (do a search for "Ungoed" on
    NTK [ntk.net] for my reasons for thinking this), I'm inclined to suspect that there may be some truth behind the story.

    Back in '95 I wrote a couple of articles on on information warfare, battlefield technology, etc. for an international military magazine. In April '96, I was contacted and asked if I could supply an EMP device which could "wipe out all computers within a 100m radius in a built-up area", for a certain amount of money (in excess of $15k).

    Obviously, I refused the "commission", and thought no more of it, but several weeks later, the Sunday Times led with this story [sunday-times.co.uk].

    Needless to say, I've kept an open mind about these things since, especially as, since then, I've been asked to do all manner of illegal things, from hacking into the mail servers of competitors, takeover-targets and companies planning IPOs, to monkeywrenching - i.e. causing crashes, glitches and other problems in a company's systems and networks to make them look bad).

    The methods of blackmail are very simple as most of the systems run over standard high bandwidth lines. It's a simple enough problem to get into these systems by going through the exchange points rather than walking through the front door of a bank (just like breaking into most company networks is actually much easier to break the PABX system and then jump across into the data stream that contains the network link rather than trying to attack the firewall directly).

    That's true enough, and it's also true that companies' phone systems are often a lot less secure that their data networks, but that sort of hacking is quite low-level and requires a level of knowledge which, luckily, isn't as easy to acquire as normal hacking scripts are.

    You'd be surprised as just how lax most banks are with thier internal security.

    I don't have any experience with banks, but I've been involved in testing the security at other financial institutions, and I've been completely astonished at things like an insurance company with a wide open RAS dialup into their internal network. Senior executives can and do crap themselves when they realise just how vulnerable they are and, perhaps more importantly, that they are legally responsible for the security of their company's information systems and networks and the data (financial and personal) held on them.

    Another interesting whole to watch out for in the future will be the increasing use of direct fibre channel connections. Some of the setups that I've seen put the mainframe connection in one site and the drives and backdrives in two separate sites. The drives are hooked up using fibre channel as though they were local hard drives to the machine. If you know what you're doing, getting inside one of these links can be quite easy.

    I work with FCAL technology (Sun A5*00 arrays, mostly) and so on and I've heard of these type of set-ups as well. I think that the security of SANs and NAS devices will become an issue over the next couple of years.

    Despite repeated demonstrations of how easy some of these systems are to break, the banks just don't seem to be interested in trying to make it more secure. They don't want to spend the extra money because it eats into the profit margin. Security through obscurity seems to be their favourite mantra.

    Agreed. There's a huge amount of complacency in the UK regarding computer security. In August, a bunch of guys at DNSCon [dnscon.org] "outed" a couple of websites which were vulnerable to hackers, including the Scottish Government's site. Unfortunately, although they claimed to have tightened security [bbc.co.uk], the new measures obviously weren't quite secure enough, as they were hacked [bbc.co.uk] not long afterwards.

    There's a growing feeling in the UK that companies are failing to place enough emphasis on information security, and that a lot of so-called information security consultancies are incompetent. Many of them are formed by IT auditors, who might know how to count computers, but know fuck-all when it comes to effective information security risk management. Even the British Standards Institute's [bsi.org.uk] BS7799 standard for information security management is widely acknowledged to be a joke. The majority of systems which are certified as conforming to BS7799 are still vulnerable to attack.

    The recent revision of the UK's Data Protection Act has taken a step towards making the directors of companies directly responsible for ensuring that the private information which is held on their companies' information systems, is adequately protected.

    However, I feel that it won't be until the shareholders realise that their companies' profits are in danger, because of management incompetence, that we'll see real moves towards implementing effective information security practices.

    The Dodger

  • This issue has been discussed on the UK Crypto mailing list since the article appeared in the Sunday Times last weekend. The hwole meat of the article is unsubstantiated and is simply not true. The same spiel has been going the rounds for several years now, apparently hyped up by the spooks at GCHQ who are trolling for business reviewing commercial software system security.

    Now I wonder why GCHQ want to know how banks and institutions secure themselves?

  • Now, there may have been some extortion attempts against banks recently by script-kiddies. During the Secondary DNS Con, civic minded hackers announced that the Scottish National Party's web site had no security. They then gave the web masters 2 weeks to fix it (the idiots applied a single M$ patch), then cracked the system and defaced the home page with some very funny stuff. Obviously the hack was long in the making.

    That is a lie.

    The individuals who made the announcement and DNSCon had warned both the Scottish Executive and the Post Office well in advance, and did not announce that their websites were vulnerable until after they had received confirmation that their warnings had been received.

    The people who "outed" the Scottish Executive did not hack their website.

    You don't know what you're talking about, so please refrain from pretending that you do.

    D.

  • I can think of two possible scenaria, one which makes sense and another which does not:

    • It would make sense for a bank to pay for the information HOW did the cracker get into the bank. If they get the exact description, they can also prevent any crackers comming in that way later. Thus they are effectivly paying in order to improve the security, which makes sense.
    • It makes absolutely no sense to pay-off the blackmailer withouth getting the above mentioned info. This way the bank looses money, stays completely clueless, and the cracer is free to come-in again the same way later or simply sell his knowledge to anyone.
  • And anybody who's taken a glance at Lord Gnome's organ (Private Eye) lately will also be aware of his general incompetence...

    Being convinced that the internet is the tool of anti-capitalist anarchists, and was used to orchestrate violence at a demonstration in london, he contacted the organisers of the demonstration purporting to be interested in more direct action, as opposed to shouting and waving a placard about... ie yer basic journalistic sting. The only problem was, he used his Times email address to send the email, which was a bit of a bad oversight, really.

    Not one to be worried, he tried again, this time sending from a hotmail account. Unfortunately, the thought never occurred to him that he should register the account in a name other than his own, thereby advertising who he was for all to see in the From: header.

    Doesn't exactly inspire much confidence in his abilities...
  • I think you've been watching too many films - most people would demand tens of thousands as its far easier to get away with. Millions is hollywood and people that havent thought it through. Most people in the UK that have been caught, have tried to set up systems to withdraw the ransoms from cash machines in several hits, and have been caught by the cash machine cameras. Not very clever as the cash machine is the perfect way to get the cash away from a random unknown location...

  • Re:Homer: mmmmm....Crackers.... (Score:3)

    by substrate ( 2628 ) on Tuesday September 21, 1999 @10:39PM (#1668422)
    No they got it 100% right this time. They are hackers, they're using their hacking skills for malicious purposes therefore they're also crackers. The term hacker itself is grey, there are good hackers and there are bad hackers. The problem is that in the media hackers has been used to refer to the population of hackers who operate contrary to the law as opposed to the entire population of hackers.

    Even leaving it at reports of 'malicious hackers' would've been correct. They're hackers and they're malicious. It isn't implying that all hackers are malicious anymore than saying 'corrupt police officer' would imply that all police officers are corrupt.
  • Cut out the blank lines will you? It just makes you look like a berk, and annoys the hell out of the rest of us.

  • Many worldwide banks offer NetBanking as a way of allowing customers access to their account, bill payments, loan payments, etc over the net. The way this is done is not through a browser, but through a secure on-line client terminal, developed by the bank


    That may be the way it works in Oz, but here in the UK you do access NetBanking via a simple browser. And because of the US government's insane stance on cryptography, it'll be a browser with crippled, weak security.

    The financial institutions over here have made it particularly easy for crackers to get into their systems, so it's probably no big surprise that we're the ones being targetted.
  • It's gonna happen one way or another. But what if the crackers are just pulling their leg? I mean, they could just call up a bank, get the Head Suit, and tada, big payoff. But, If they are telling the truth, its their vault, pay whoever they want with it.
  • Ungoed-Thomas has been trying out his nefarious tricks elsewhere:

    (extracted from Schnews [schnews.org.uk] - Brit eco-activist newsletter)


    If you receive any unsolicited emails from wide-eyed activist females, don't count yourself so popular; it could be our mates at the Sunday Times with another lesson in the value of media liaison. While journalist Mark Macaskill came across reasonably enough, emailing activists with an approach to interview them, his colleague took a different tack.

    So, it must now be our turn to take the piss out of super-sleuth journo John Ungoed-Thomas, who sent out a few emails under false names, in the hope of getting back some juicy info for an article.

    'Jo' is just one 'committed environmental and anti-corporation activist' apparently now flocking to the ranks of our burgeoning movement, if an email recently received by Friends of the Earth is anything to go by. She wants to know how to get more involved indirect action, having ' really enjoyed' June 18 [anti- capitalist riots in London earlier this year]. Likewise, 'Laura' who eco-columnist George Monbiot of the Guardian was privileged to hear from, describes herself as a 'committed anti-corporationist' and is eagerto help in any way she can. Any ideas? Perhaps Laura and Jo might benefit from a few words of advice from someone more canny in covering their tracks, for both sent emails from addresses leading back to Clouseau-esque Ungoed-Thomas, the master of disguise himself. Hardly for us to take the piss now; he's practically giving it away.
  • It looks like they're also starting on a process of educating the reader on the difference - working up to a future where they can just say "cracker" and everybody will understand what they mean, and where everybody ELSE will use it right, too.

    Just as people don't call rustlers "cowboys" or (sea) pirates "sailors", so they won't call crackers "hackers" (though the former is almost an included set of the latter in all three cases).

    Good for you, USA Today!

  • Once upon a time the ATMs were standalone. They trusted the card. That didn't work for long: Clone a card, get another maximum daily withdrawal, and overdraw the account as much as you like (rather than just a couple hundred bux).

    So soon they were networked, and checked the real records of the account. Big improvement.

    But it costs a lot to keep the banks' machines up 24x7. So they went to standalone mode on weekend nights. And again they trusted the card, and again they were vulnerable.

    I hear that one major bank in Detroit didn't bother with the extra shift on Sunday night when they were only losing $10K/weekend. When it got up to $100k, they paid for the extra shift, and the window of opportunity became very narrow and sporadic. (And nowadays the hosts are up so much of the time that they can program the ATMs to go out-of-service if they can't reach the host. So for these machines the window is zero.)

    The same will likely happen with the blackmailers. If there are ever so many that it's cheaper for the banks to fight them than to pay them off they'll fight 'em. Menawhile, they can gain breathing room to work on their security by keeping the current few at bay with payoffs. And they can try to trace the payoffs and bust the blackmailer-of-opportunity now and then.

  • Im in Australia and our banks only allow 128 bit encryption, yet they wont tell you how to get it.

    They just say either Internet Explorer or Netscape is required. Thanks....

    What I tell people to do is to use Fortify (http://www.fortify.net [fortify.net]) which updates your browser to 128bit (apparently)

  • If they steal a bunch of money they get prosecuted and sent to jail. If they blackmail the bank pays up and lays low to avoid bad press.
  • Criminals alwasy find a way to leverage physical force for money. It's an old, old, game. Of course, being able to do it remotely and internationally, is just cool as all hell. When's a good CRACKER movie coming out??
  • So the next obvious question is, does this get covered by insurance? If so, why isn't the insurance company screaming about getting some security installed and maintained? Or are they making more in premiums than losing in payouts and fine with things as they are?
  • While I don't know for sure, I'd be reasonably confident that the transaction-processing network is secure. For one thing, it's not TCP/IP based, it's probably DES encrypted (and despite its vulnerability to a well-funded attack, there's no evidence that anybody other than the EFF and the various TLAs have built the necessary hardware), and the banks have had plenty of practice securing these systems.
    However, I'd imagine that the PC networks of your average bank is like most companies' networks - leaking like a sieve. I'm sure there's plenty of material lying around on those corporate hard drives that's quite blackmail-worthy.

  • Catch them when they pay the bribe? (Score:3)

    by chandoni ( 28843 ) on Tuesday September 21, 1999 @06:03PM (#1668439) Homepage
    "OK, we'll give you the $10 million. Where do you want that sent?"

    It seems much more likely that authorities could trace a single such (planned) transaction (even if it goes through an online Swiss bank or something) than if J. Random Cracker just transferred the $10 million to his account without the bank's knowledge. So, why would J. even demand a payoff at all unless he's bluffing or too stupid to realize he's increasing the chances of being caught?

  • How about the golden rule? (Score:1)

    by Anonymous Coward
    No, it's not that old saw about whoever has the gold, makes the rules. Rather there's an ancient wisdom that says that you should never ask for more money than it will take to have you quietly killed. The ease of offing someone is inversely related to how well known they are, and I'm guessing that none of these crackers live terribly high-profile lives...

    Now, there may be some arguments about morality and ethics and all that, but we are after all talking about large corporations, which aren't exactly paragons of virtue. They should phone up Big Tobacco or the gun lobby in the States if they need some pointers on technique.

  • It's Ungoed-Thomas (Score:5)

    by rafial ( 4671 ) on Tuesday September 21, 1999 @06:15PM (#1668442) Homepage

    As I suspected when I saw the reference to the Sunday Times, the original article [sunday-times.co.uk] that was cited in USA today was authored by Jon Ungoes-Thomas. Readers of ntk.net [ntk.net] will be familiar with Ungoed-Thomas as a journalist who is long on unsubstantiated sensation, and very short on fact checking, and who is building a career out of predicting the collapse of civilization as a result of the Internet.

    I'd take this particular article with a few large and tasty grains of salt.

  • if once you have paid him the danegeld
    You never get rid of the Dane.

    From "Danegeld" by Rudyard Kipling

  • Money transfer networks (Score:3)

    by GodEater ( 7709 ) on Tuesday September 21, 1999 @06:28PM (#1668444) Homepage
    I work in the financial messaging sector of IT, and I find it difficult to believe that crackers have actually managed to move money from Bank Account A to Bank Account B.

    You'd not only need to be a fairly talented cracker to get into the bank's network in the first place - but you'd also have to have an in-depth knowledge of how banking transactions work to actually pass the money around.

    I've been working in this industry for five years now - working with a large number of banks - and I still don't think I could get away with it...
  • Like I said, the DNS Con hackers are civic minded. They gave the web masters plenty of notice of the holes, with the exact details of what needed to be fixed, and plenty of time to do it in. The web masters did nothing until DNS Con made headlines, then applied ONE patch recommended by micros~1, and didn't go any further. Various security mailing lists in Europe have had fun picking apart the Scottish Executive's responce.

    The crackers who later defaced the website put a lot of work into a careful spoof of the contents of the site. They even speled most wurds corectly :-) I would classify it as a harmless hack, since it was done with some foresight and planning and didn't really cost the SExec anything but a slightly redder face.

    Check out the defaced page on http://www .attrition.org [attrition.org]

    But since I work in the security industry, I've noticed a lot of UK businesses are asking for fast and easy security for their websites, since web site cracks are happening almost all the time. For some reason telling them to hire a competent admin and install the latest patches falls on deaf ears. But tell them that for twice the price they can buy a handful of firewalls, and they hand us a blank cheque. :-)

    the AC
  • When you look at the stakes... and what it takes to really secure a financial network (not talking about a crack this challenge), I think it is a justified approach.

    In the past, the biggest source of the losses are inside jobs and sheer incompetence.

    How do you compensate for incompetence?! Spending money on security still has the same problems of incompetence and deliberate back doors...
  • Many worldwide banks offer NetBanking as a way of allowing customers access to their account, bill payments, loan payments, etc over the net. The way this is done is not through a browser, but through a secure on-line client terminal, developed by the bank (which is not open source ;-) ).

    Used to be that way. Not any more. Look at Citibank -- they used to have a special-purpose client with, basically, an ATM interface. Now it's gone and to access your account electronically all you need is a plain-vanilla browser.

    Besides don't forget that the security of individual accounts depends on a four-digit PIN number -- this is by far the weakest link. Of course, if you are talking about corporate accounts and wire transfers, things do get more interesting...

    Kaa
  • Welcome to the next level. In the very near future, this type of activity will become all too common, and it will spread. Banks are high-publicity targets because the world in which we live is utterly obsessed with money.

    How long will it be before eco-fanatics stop spray painting fur coats and simply trash the offending company's network? How long until terrorists simply threaten to destroy New York's phone systems until their demands are met? Not long, I say.

    Yes, countries will always send soldiers with guns to do the dirty work. Many things won't change.

    The potential situation with banks is just the tip of the iceberg...

  • Hey, that's security through obscurity.

    The money should be out on the kitchen table. Near the windows.

    heh
  • Now, there may be some arguments about morality and ethics and all that, but we are after all talking about large corporations, which aren't exactly paragons of virtue.

    Why do you think you can say that? Sure, there are abuses in some large corporations.

    I don't buy for a moment, however, the sentiment that they can all be painted by the same brush.

    If you're going to just offhand throw out moral and ethical arguements, then this discussion is null and void.
  • the moral of the story is that "joe O'Public" is very gullible and can be led like sheep by unscrupulus "journalists". Because as you know anything to do with computers, e-mail, and micro-wave ovens is arcane and evil.
  • It's really weird that everyone assumes that access is through the internet. One would think Banks are not connected to the net for any other purpose except to advertise themselves. On some occasions however, this is not true.

    Many worldwide banks offer NetBanking as a way of allowing customers access to their account, bill payments, loan payments, etc over the net. The way this is done is not through a browser, but through a secure on-line client terminal, developed by the bank (which is not open source ;-) ).

    I imagine what the crackers are doing, is using this client, a bit of reverse engineering and some other unscrupulous methods to do the do. Otherwise, the only other way in is via a remote dial in.

    I used to work for a co. that processed data records for a bank on to microfiche. Initially the data came on tapes, then a dedicated secure connection to the bank was connected for more efficient data transfer. There were some very, very, tight restrictions on our network and external connection before that thing went in.
  • A little editorial control wouldn't have gone amiss here. Surely it is patently obvious that a story at "USA Today" is very unlikely to be "News for Nerds. Stuff that Matters"? Indeed, it's not even really a "USA Today" story, just lifted from "The Times" (no longer "the newspaper of record"; more of an upmarket National Enquirer). Slashdot really shouldn't be cluttered with second-hand reworkings of stuff that Ungoed-Thomas (as another poster has pointed out) probably made up in the first place.










  • Please help me, I am confused.

    What kind of message are we trying to give it to the Joe o' Public out there?

    That blackmailing banks are good?

    That crackers (or in the NYT-speak, Hackers) are bad people who make a living by blackmailing others?

    That banks are wimps waiting to be blackmailed?

    That the future is bleak because our money is not safe no more in those wimpy banks?

    What actually is the moral to this story, huh?!









  • Stories like these (and, less frequently, those debunking them) have been going around for years. I'm extremely skeptical, especially with this latest article. Okay, so banks are giving payouts of millions of dollars to hackers, but the author can't get one single law enforcement officer or spokesperson to give a comment on the record? Gimme a freakin' break. Police departments would be more than happy to speak out about this, using it as an excuse to increase their funding. It's just as likely that banks are putting forth this excuse to cover up losses due to embezzlement and other crimes by their own bad-apple employees.

    Whether any of it is true or not, I wouldn't rely on this article as a source if you paid me. Makes me wonder who's really being "taken for a ride," as the article puts it.

    Cheers,
    ZicoKnows@hotmail.com

  • Somehow I remember reading exactly the same story about two/three years ago.

    I guess newspapers have some kind of archive which they use to fill up their pages over and over again.

Slashdot Top Deals

Friction is a drag.

Close