Crooks Arrested Over KVM-Based Bank Heist Attempt 79
judgecorp writes "Twelve men have been arrested over an attempt to take control of computers at a Santander bank branch in London using a stealthily planted KVM (keyboard, video and mouse) switch installed by a bogus maintenance engineer. The men were caught by the Metropolitan Police's Central e-Crimes Unit."
Foolish. (Score:5, Insightful)
Everyone knows if you want to rip off a bank. You need to BE the banker.
That way you get the money. And then the goverment comes and gives you MORE money. Win. Win. No jailtime.
Re: (Score:1)
The former president of the bank I use (a small local bank) is now Mayor of Springfield, elected after our previous Mayor [wikipedia.org] (Does he look familiar?) shot himself. [wikipedia.org]
I wonder what's more lucrative, being President of a small bank or Mayor of a capital city? I'm sure it pays better than any criminal activity except maybe being a Colombian drug lord. A whole lot safer, too.
Re:KVM? (Score:5, Informative)
"Now"? KVM has been an acronym for years, if not decades.
Re:KVM? (Score:5, Informative)
Re:KVM? (Score:5, Informative)
When you are part of an industry and use a certain term multiple times you get to decide when and what you create acronyms for. Since a lot morons among the AC crowd don't seem to get simple concepts, I will explain this one for your benefit. Acronyms are made to make speaking easier/quicker when you MUST repeat yourself. People that make KVM switches probably took about 10 seconds into their first meeting talking about making this product to decide that repeatedly saying keyboard video mouse was a waste of time. Just because the entirety of your experience with acronyms begins and ends with lol, fml and diaf as you text your twelve year old friends does not mean that the world in general doesn't understand that time is money. If you had even a modicum of experience in a non-entry level position in a larger company you would realize that most acronyms in the world are business related; created and mostly used by the people that create the idea or product then picked up by the general public over time. The military is an exception to that rule. They have a serious addiction to creating acronyms for everything.
Re: (Score:2)
Yes, since people started using mice in their computers. Before that it was a KVS (Keyboard Video Switch).
Re:KVM? (Score:5, Funny)
Re: (Score:1)
it was a KVM with wireless capability. Bank was in a mall. The crooks just had to sit at a cafe and watch and learn remotely. Something like these
http://www.kvm-switches-online.com/wireless-kvm.html was used. I'm still looking for the ones that "can be bought online for 10 pounds"
Picked this up from Sky news this morning via my Apple TV which has a free feed.
Pretty smart except for needing 12 guys and getting caught.
Re: (Score:1)
I found out about them in the mid nineties when I got an extra pc with no peripherals from a neighbor and wanted to use it just for games. They were amazing, magical devices back when it was easier to just get another computer than it was to find a big enough hard drive to hold everything you wanted to have access to.
Re: (Score:1)
The clarification was almost certainly intended to disambiguate KVM switches [wikipedia.org] from Linux KVM virtualization [linux-kvm.org].
Apparently, you're not old enough to have ever seen a KVM switch, and your awareness of current technologies isn't keen enough to know about KVM virtualization. Neither of these conditions is a bad thing, but the snide tone of your comment was unwarranted in light of the facts.
Re: (Score:2, Interesting)
http://www.raritan.com/products/kvm-over-ip/
this is hardly esoteric
Re: (Score:3)
you received several ac replies, i'll do it while logged in.
'kvm switch' (the last word missing from the summary for some reason) is a product that has existed for a long time. they are primarily used in server rooms along with a rackmountable display/keyboard//mouse (usually a touchpad, although i prefer trackball a lot more). nowadays these sets are lcd so they fold in 2u or so. before that, you'd allocate place for a crt monitor in some rack.
a kvm switch sits behind that terminal and has a shitload of ca
Re: (Score:2)
is ipmi console a standard protocol ? how widely is it used ? i'll admit not seeing it being it actually used even once, but maybe i was not looking at right organisations...
Re: (Score:2)
Re: (Score:2)
Update of technology knowledge coming :)
LCD/keyboard trays now fit into 1U and IBM, among others, have Cat5e-based console managers that daisy-chain different server connection devices using RJ45 connectors. These end devices can have PS/2, USB, VGA, HDMI, DVI and even RS232 options. On the IBM unit we have, the LCM 16, there are two sets of connectors for the LCD tray and 16 RJ45 KVM ports which can cascade to 16 servers each for 256 devices in 1U. And there is network KVM access available for an extra li
Re: (Score:2)
Re: (Score:2)
Now you can walk in and plug in
Ohh.... (Score:5, Funny)
Should see the MET statement. (Score:5, Interesting)
'The Metropolitan Police said its "time-critical, dynamic response" had thwarted a "very significant and audacious cyber-enabled offence". '
http://www.bbc.co.uk/news/uk-england-london-24077094 [bbc.co.uk]
I think there should be a general rule: Anyone who uses the word 'cyber' in a non-sarcastic manner should be ignored.
The article looks like it wasn't written by a tech journalist too, as it contains such obvious errors as 'The device, if operational, would have allowed data and contents of the desktop to be downloaded over the network.' News organizations so often make mistakes in their rush to be the first to break a story - even the BBC.
Re:Should see the MET statement. (Score:4, Interesting)
Like my mistake in capitalizing 'MET' when I know full well it should be 'Met.'
Re: (Score:1)
Don't know what they were using but many KVM over IP products do support remote media devices (via USB along with keyboard/mouse) - usually for remote OS installation. No reason data couldn't be written to one to facilitate this.
Re: (Score:2)
Anyone who uses the word 'cyber' in a non-sarcastic manner should be ignored.
What's wrong with the word cyber? [merriam-webster.com] Do you have a better synonym?
Re: (Score:2, Informative)
Yes. "Computer".
Re: (Score:3)
To me it sounds dated and hackneyed; like asking "do you surf the information superhighway?" Just a personal irk.
Re: (Score:2)
The article looks like it wasn't written by a tech journalist too, as it contains such obvious errors as 'The device, if operational, would have allowed data and contents of the desktop to be downloaded over the network.'
It's not obviously an error to suggest that the attackers could have uploaded the data and contents of the desktop over the internet. So aside from using the wrong word (journalists change up to down all the time, especially in tech where they regularly get this wrong) what's obviously incorrect? It's obviously correct that once they had access to the system, they could get the data.
Re:Should see the MET statement. (Score:4, Informative)
I would guess his objection is that it probably was not the KVM Switch which "allowed data and contents of the desktop to be downloaded over the network", but the per-existing network infrastructure that did that. Unless they used some sort of custom device, it is unlikely that it created its own route (wirelessly?) out of the network or did anything to breach the network security. The KVM switch merely allowed the "hackers" to surreptitiously access the data and send it on its way to whatever nefarious data-haven the criminals had set up (probably Dropbox).
A subtle and admittedly pedantic difference, but an important one. Seeing as the purpose of the news industry is to - nominally - provide accurate and timely information, it is an unfortunate mistake. Whether it is an important distinction to the common reader is another question entirely. However, since they make it a point of actually mentioning the type of device, it would have been nice if they had taken the time to accurately describe its capabilities.
Else on Monday some hapless tech somewhere is going to be argue with a clueless CEO who fears that every KVM switch attached to the servers will allow hackers to remotely steal their data because the executive got the wrong message from the media.
Re: (Score:2)
Even the people who participate in cyber-sex consider the term vulgar. We usually refer to it as adult roleplay or just 'RP.'
Re: (Score:2)
> Even the people who participate in cyber-sex consider the term vulgar.
I DON'T!!!
oh wait...
Ok, but... (Score:2)
Re: (Score:3)
I'm guessing here, but to be of any use, the KVM would most likely be an IP based one, connected to a server somewhere, which in turn could be traced to the crooks, who like most crooks, were not very sophisticated and didn't think to go through Tor or anonymous hosting in a foreign country.
He got physical access to the machine! (Score:5, Insightful)
Well, he could have easily slipped in an unobstrusive thumbdrive with a key logger in to a back usb port, and collected it back in the next "maintenance" visit! One could imagine a usb device based KVM without cables transmitting data wirelessly. Such devices are very useful, I could stash my tower in a sound proofed cooling enclosure far away and keep my KVM on my desk. So they will be in the market, if they are not already in the market. At that point all the bogus engineer had to do was to slip in an unobstrusive usb device in a back port.
Once the crooks have physical access to the machine, it becomes very difficult to protect against. Once a crook and an insider cooperate it becomes very very difficult to guard against.
Re: (Score:2)
Re:He got physical access to the machine! (Score:4, Informative)
He was more likely using an IP-connected KVM device, like one of these http://www.raritan.com/products/kvm-over-ip/ [raritan.com] and not the heavily cabled ones. Hooked up to a cellular router, they don't even need cables except for a power pack.
Full access to the workstation might be needed if the bank implements machine-based access control that requires something on the machine itself for authentication besides username and password. The South African Post Office does this and a bunch of crooks nicked money after stealing a machine that had management access to accounts and then broke into the premises of another branch to plug it into the LAN. That was proved an inside job by tellers.
baren article (Score:5, Informative)
installed KVM as phony IT guy, were arrested and here are their names
this is all the information the article provides. no details of any kind. no picture of the (hopefully stealthy) KVM, how they were caught or anything of any interest at all!
Here's the real scoop:
A man dressed as a "maintenance engineer" (IT guy) claimed to be sent by a some company working for the bank. Then he goes to the bank branch's main server and plugs an external KVM-over-IP box connected to an ethernet to wifi adapter [techworld.com] or at least that was the plan. The plan was thwarted at the last minute... no info as to why/how but I'm betting that the server either didn't have a PS/2 port or didn't have VGA output not that it matters without a username and password to login.
A spokesman for Santander insisted that the bogus engineer had not managed to install the device and no customer money was ever at risk.
We are pleased that we have been able, through the robustness of our systems, to prevent the fraud and help the police gather the evidence they needed to make the arrests. Santander operates multiple levels of controls to protect customers' funds and this attack would not have been successful.
Hours after the bogus engineer attempted to fit the device to the computer server, officers from Scotland Yard swooped arresting 12 men on suspicion of conspiracy to steal. As for how they were caught, I think someone just realized there wasn't supposed to be an IT guy there and then the cops got called.
Re: (Score:3)
As for how they were caught, I think someone just realized there wasn't supposed to be an IT guy there and then the cops got called.
Since there were so many people involved, my guess is someone got sloppy and was overheard (maybe in a bar or something) and the cops were tipped off.
The more people involved in any criminal activity, the greater the chance of getting caught.
Re: (Score:2)
How does some random guy get access to the "main server"? Any bank worth its salt would have massive security just to get near to it. I could understand getting to some guy at the bank's desktop machine, and even that could be really dangerous, but the server?
Re: (Score:2)
That's what gave the plot away: There's someone claiming to be an IT guy working on our system. And he's not an asshole.
Call the police!
Re: (Score:2)
How does some random guy get access to the "main server"? Any bank worth its salt would have massive security just to get near to it
Most bank branches are fairly small operations these days; 3-4 desktops and probably a branch server out the back. A couple of tellers and that's it. Besides, it sounds like the police were onto th plot in advance; just waiting for the gang to incriminate themselves.
chase bank out outsourced branches IT to work (Score:2)
chase bank out outsourced branches IT to work to a mix of outside contractors / sub contractors.
Re: (Score:2)
I suspect that the crew tried to recruit an inside man who shopped them to the cops and acted as a double agent.
Modern plutocratic justice (Score:3)
People with no job conspire and fail in trying to shave off a few millions out of a bank's billions?
Get arrested, thrown in prison for years.
Work for a bank, conspire and succeed in destroying the global economy and cheat your customers out of trillions of dollars?
Get the government to give you even MORE money.
Not saying these guys here should not have been arrested. But the worst crooks in the story are working inside the bank, not outside.
Under what circumstances... (Score:1)
CrookA calls CrookB on his cel^H^H^Hrotary phone. CrookB asks a bicycle courier outside his building to deliver some building plans across town to CrookC and CrookD.
The next night, they all meet up and get to work hammering down a wall from some parking garage which leads into the vault.
Hey Man! (Score:2)
I've just finished development on my new bitchen KVM system!
Wanna give one a try and tell me how you like it? ......
In Soviet Russia, the key hits YOU! (Score:2)
What if you are a political blogger whose keyboard is bugged? The Miniluv can do everything they want against you, and no TOR, I2P, VPN, foreign hosting or full-disk encryption will save you from Room 101.
They should have (Score:1)
They should have used Xen or VMware for the financial industry.
How Much Longer? (Score:2)
Hey, newspaper guy! It's called "Social Engineering" and it's broadly the same as "Con Artistry".