Scam of the day – September 1, 2016 – International banking system continues to be hacked

In February, cybercriminals hacked into Bangladesh’s Central Bank and managed to steal approximately 81 million dollars.  As a result of this attack, SWIFT, which is a cooperative association of member banks that provides an international messaging system for banks has been investigating the security of SWIFT members and earlier this week it told its members that since the attack on the Bangladesh Central Bank there have been a number of other cyberattacks on banks around the world.   According to the letter, an undisclosed number of attacks against banks around the world were successful although SWIFT did not indicate how many banks were successfully hacked and how much money was lost.

It appears in the hacking of the Bangladesh Central Bank, as with so many types of cybercrimes, this one started with social engineering spear phishing which lured bank employees to unwittingly download the malware used by the hackers to infiltrate the bank’s computers and obtain not just the passwords and cryptographic keys used for electronic fund transfers, but also the emails of bank employees so that they could copy and adapt the emails by which they made their transfers appear legitimate. Armed with this information, the cybercriminals sent dozens of account transfer requests using the international SWIFT banking messaging service from the Bangladesh Central Bank to the Federal Reserve Bank of New York where the Bangladesh Central Bank has accounts containing billions of dollars.  The account transfer requests processed by the Federal Reserve Bank of New York electronically sent about 81 million dollars to accounts in the Philippines where the funds were transferred multiple times including transfers to Philippine casinos in an effort to launder the money.

Late last year banks in the Philippines and Vietnam also suffered similar cyber attacks.  Now cybersecurity investigators are saying that the same type of malware used in all three attacks was the same used by state sponsored North Korean hackers against South Korean banks in 2013 and Sony in 2014.

Although SWIFT is pressing member banks to increase their security, SWIFT has no regulatory authority to mandate such actions, however, in its recent letter to SWIFT member banks, SWIFT indicated that if member banks fail to update their security to meet SWIFT standards by November 19th, SWIFT might report them to bank regulators.  In particular the suggested security measures include better password management and authentication procedures as well as installing better procedures to recognize hacking attempts.

TIPS

All businesses and governmental agencies have got to do a better job at cybersecurity in general.  In particular, greater attention has to be paid to the dangers of social engineering spear phishing which has been at the root of the almost all of the major data breaches at both companies like Target and governmental agencies, such as the Office of Personnel Management.  The international banking system is under attack and although the  security of the SWIFT system itself appear not to have been breached, that is little consolation when individual banks are hacked thereby obtaining the authorizations necessary to utilize the SWIFT system to steal money.  Although SWIFT continues to say that its messaging system is secure, it is apparent that just as the individual banks need to increase their security, so does SWIFT have to recognize the security vulnerabilities that exist in banks around the world and pressure member banks to use dual factor authentication and confirmation protocols in order to protect the security of the international banking system.

Scam of the day – February 17, 2015 – Billion dollar international bank hacking

Russian cybersecurity company, Kasperky Lab issued a report yesterday disclosing what may well be the biggest bank hacking in history.  The hacking of more than 100 banks in the United States, Japan, Switzerland, the Netherlands and primarily Russia was accomplished by a criminal group called the Carbanak cybergang composed of Russians, Chinese and Europeans who through advanced malware installed on the computers of the targeted banks permitted the hackers to infiltrate the computers of the banks’ employees in charge of cash transfer systems and ATMs.  They then installed a remote access tool (RAT) on these employees’ computers that enabled the hackers to see everything done on these employees’ computers with the goal of mimicking the look of legitimate transactions when the hackers activated electronic transactions and programmed ATMs to dispense money at specific times to steal as much as a billion dollars over the last two years.

TIPS

As of today, no bank has admitted that it was one of the affected banks.  This makes fighting similar attacks more difficult, which is one reason President Obama has recently been advocating for a law to mandate public disclosure of such security breaches by financial institutions.  An important aspect to this hacking that has been often overlooked in some early reporting of the story is that although the malware used to perpetrate this crime is amazingly sophisticated, the planting of the sophisticated malware into the computers of the targeted banks was accomplished by old-fashioned phishing emails that lured the bank employees to click on infected link.  Everyone including companies, governments and private individuals have got to do a better job of not clicking on links no matter how legitimate they may appear until you have confirmed that they are indeed legitimate. Remember my motto, “trust me, you can’t trust anyone.”

Scam of the day – August 9, 2014 – Identity thieves defeat two-factor identification at banks

In the battle to prevent identity thieves from being able to access online the bank accounts of their victims, many banks in Austria, Japan, Sweden and Switzerland have gone beyond the simple password to the more secure (supposedly) two-factor identification.  With two-factor identification, in order to access their accounts bank customers must enter a second one-time password that has been emailed or texted to the customer.  The thought was that by requiring this second password, identity thieves who may have hacked the customer’s password still would not be able to access the customer’s account because the identity thief would not have the required second password sent by the bank to the customer’s smartphone.  However, now it has been uncovered by computer security company Trend Micro that identity thieves have found a way to defeat two-factor identification.  As with so many identity thefts, this one starts when the customer unwittingly clicks on a link in a phishing email or downloads an attachment in a phishing email that appears to be from a legitimate source.  Unfortunately, when the victim clicks on the link or downloads the attachment, he or she is actually downloading malware that sends the victim to a phony bank website when the customer attempts to do online banking.  Once at the phony website, the victim is prompted to enter their account details, passwords and personal identification number.  They are then prompted to download a mobile application found in Google’s Android store that is represented to provide enhanced security, but in actuality permits the identity thief to intercept the second password that banks would send to the customer.  Armed with all of this data, the identity thief is able to gain full access to the victim’s bank account and empty it.

TIPS

Although two-factor identification is an improvement over the present password system used by many financial institutions in the United States and other parts of the world, it is still vulnerable.  Business and government must come up with better authentication protocols.  Meanwhile as with so many of these complex identity theft schemes, this one requires the victim to download the necessary malware that makes the identity theft possible.  The solution is a simple one.  As I have warned you many times.  Never click on a link in an email or download an attachment in an email unless you are absolutely sure that it is legitimate and the only way to do this is to independently call or email the real company or person purportedly sending the email at an address or telephone number that you know is accurate.  For even greater security, you may wish to have a separate computer for financial transactions where you do no emails and click on no links and download no attachments.