In a startling development, security researchers at Symantec and BAE investigating the cyber bank robbery of the Central Bank of Bangladesh, about which I reported to you in March, are now saying that it appears that the cyber bank robbery was the work of North Korea. If so, this would be the first time that a nation state used a cyber attack to steal money.
In February, cybercriminals hacked into Bangladesh’s central bank and managed to steal approximately 81 million dollars. It appears that, as with so many types of cybercrimes, this one started with social engineering spear phishing which lured bank employees to unwittingly download the malware used by the hackers to infiltrate the bank’s computers and obtain not just the passwords and cryptographic keys used for electronic fund transfers, but also the emails of bank employees so that they could copy and adapt the emails by which they made their transfers appear legitimate. Armed with this information, the cybercriminals sent dozens of account transfer requests using the international SWIFT banking messaging service from the Bangladesh Central Bank to the Federal Reserve Bank of New York where the Bangladesh Central Bank has accounts containing billions of dollars. The account transfer requests processed by the Federal Reserve Bank of New York electronically sent about 81 million dollars to accounts in the Philippines where the funds were transferred multiple times including transfers to Philippine casinos in an effort to launder the money.
Late last year banks in the Philippines and Vietnam also suffered similar cyber attacks. Now cybersecurity investigators are saying that the same type of malware used in all three attacks was the same used by state sponsored North Korean hackers against South Korean banks in 2013 and Sony in 2014.
All businesses and governmental agencies have got to do a better job at cybersecurity in general. In particular, greater attention has to be paid to the dangers of social engineering spear phishing which has been at the root of the almost all of the major data breaches at both companies like Target and governmental agencies, such as the Office of Personnel Management. The international banking system is under attack and although the security of the SWIFT system itself appear not to have been breached, that is little consolation when individual banks are hacked thereby obtaining the authorizations necessary to utilize the SWIFT system to steal money. Although SWIFT continues to say that its messaging system is secure, it is apparent that just as the individual banks need to increase their security, so does SWIFT have to recognize the security vulnerabilities that exist in banks around the world and introduce dual factor authentication and confirmation protocols in order to protect the security of the international banking system.