Bank Hackers Steal Millions Via Malware 131
An anonymous reader writes: When cybersecurity firm Kaspersky Lab was called in to investigate ATMs that had begun dispensing cash without input from users, they expected to find a simple problem. Instead, they found the ATMs were just the tip of the iceberg. The bank's internal computer systems were completely compromised, and in addition to the slow but steady siphoning of funds through physical machines, a criminal group was quietly transferring millions of dollars into foreign bank accounts. A report set to be published on Monday shows the attack extended to over 100 banks in 30 nations.
"Kaspersky Lab says it has seen evidence of $300 million in theft from clients, and believes the total could be triple that. But that projection is impossible to verify because the thefts were limited to $10 million a transaction, though some banks were hit several times. In many cases the hauls were more modest, presumably to avoid setting off alarms." Kaspersky Lab is unable to name the banks involved because of non-disclosure agreements, and no banks have come forward to acknowledge the breach. "The silence around the investigation appears motivated in part by the reluctance of banks to concede that their systems were so easily penetrated, and in part by the fact that the attacks appear to be continuing."
"Kaspersky Lab says it has seen evidence of $300 million in theft from clients, and believes the total could be triple that. But that projection is impossible to verify because the thefts were limited to $10 million a transaction, though some banks were hit several times. In many cases the hauls were more modest, presumably to avoid setting off alarms." Kaspersky Lab is unable to name the banks involved because of non-disclosure agreements, and no banks have come forward to acknowledge the breach. "The silence around the investigation appears motivated in part by the reluctance of banks to concede that their systems were so easily penetrated, and in part by the fact that the attacks appear to be continuing."
The Best Way to Rob a Bank is to Own One (Score:4, Insightful)
William K. Black [amazon.com]
"Why stop at one?" (Score:2)
Re: (Score:1)
Robbing is a legal concept, the federal reserve has never robbed.
Re: (Score:1)
Re: (Score:3)
Re: (Score:2, Flamebait)
It learned from the Depression that its defense of the gold standard and reluctance to commit to expansionary monetary policy prolonged the depression.
Really? Im pretty sure that politics had more to do with the prolonging of the great depression. I know FDR likes to get credit for it, but truth is he made things worse, it wasnt until war was around the corner that we actually started to come out of it
I have yet to hear anyone talking about the feds role in things, do you have any reading suggestions?? Id love to look into it more
Re: (Score:1)
The money for quantitative easing was created, not taxpayer-funded. No robbing took place. The Fed, however, should have forgiven the mortgage defaults of the mortgages it bought, instead of letting banks continue to foreclose.
Re:Two words (Score:5, Insightful)
Printing money like crazy is just a different kind of robbing. But the Fed actually was more clever than that. They printed $2 Trillion while incenting banks to deposit $2 Trillion in reserves with the Fed, thus enabling the government's spending addiction without expanding the money supply. That part was clever. What happens once banks decide to start investing that money they have parked with the Fed is anyone's guess.
Did the Fed invent a new way to support deficit spending in a downturn, or a new way to destroy a currency through hyperinflation? Only time will tell, but kudos for at least trying something new.
(BTW, the Fed didn't buy so much in the way of direct mortgage debt as it did complicated mortgage-backed securities of dubious value. The Fed shouldn't have bailed out anyone. Every single bank involved in those securities should have been allowed to collapse (nothing of value would have been lost), and everyone who signed for a mortgage they couldn't possibly pay deserves bankruptcy. It's not like we have debtors prison: you're clear of bankruptcy after a few years, and maybe learn a thing or two about living within your means in the widow when you can't borrow money.
Re:Two words (Score:5, Interesting)
It's not like we have debtors prison: you're clear of bankruptcy after a few years, and maybe learn a thing or two about living within your means in the widow when you can't borrow money.
I've never understood the opposition to bankruptcy, as seen in our political debates on topics ranging from health care to the mortgage crisis. Perhaps I'm somewhat jaded because I've gone through Chapter 7 twice (once for medical bills, the second time for divorce); there was literally nothing to the experience, 20 minutes in an assembly line legal hearing, a few months of waiting, and presto! New start. Chapter 13 is a bit more drawn out, 3 to 5 years depending on your repayment plan, but even that isn't a terribly burdensome ordeal if your lawyer has half a brain.
Corporations engage in stratgeic bankruptcies [wikipedia.org] all the time but it's somehow the end of the world if a consumer has to file Chapter 7 or 13? I've grown cynical enough watching our rigged financial system that I'm tempted to engage in a repeating cycle of strategic chapter 7 bankruptcies until the day I die. Why the hell not? You can park limitless amounts of money in retirement accounts that can't be touched, buy tangible goods on credit that can't be or aren't worth being repossessed, and milk those fucking "too big to fail" banks for every last penny you can get out of them. All you need is a little bit of estate planning, knowledge of the credit system and bankruptcy code, and the willingness to see your name in the paper every eight years.
I doubt I'll actually do this but boy there are days when it's incredibly tempting. Spend a few years rebuilding your credit, get insanely huge credit lines, live off them for a few years while parking as much real money into exempt retirement accounts as you can, bankruptcy, rinse and repeat. I had nearly ten times as much money as I owed to my creditors in my 403(b) and IRAs during my last bankruptcy and that fact was completely irrelevant. All that mattered was I couldn't pay them with my income. At least our financial system does something right for the little guy.
Re:Two words (Score:4, Insightful)
The money for quantitative easing was created, not taxpayer-funded.
How'd that work out for the Wiemar Republic?
Do note that I'm a knee-jerk anti-Fed zealot, I think most of those people are hopelessly naive at best. It just remains to be seen whether or not QE is a long term success or simply masked fundamental structural problems that will re-emerge at a later date. It's worth noting that our cheap money policy has virtually destroyed every form of investing other than stocks; I can't find any "safe" investments that can keep pace with inflation right now, can you? Wall Street sure is profiting from QE, I'm not so certain about Main Street. This is a very disturbing trend [tradingeconomics.com] that few people are talking about, one that we're not likely to reverse so long as there's no incentive (near 0% interest rates) to save money and every policymakers response to a recession is "consume, consume, consume!"
Mark your calendar and we'll come back to this discussion in 10 or 15 years to find out what happened.
Re: (Score:3)
There are two US government bonds you can buy which by definition keep pace with inflation as defined by the Consumer Price Index:
TIPS -- from https://www.treasurydirect.gov... [treasurydirect.gov]:
Treasury Inflation-Protected Securities, or TIPS, provide protection against inflation. The principal of a TIPS increases with inflation and decreases with deflation, as measured by the Consumer Price Index. When a TIPS matures, you are paid the adjusted principal or original principal, whichever is greater. TIPS pay interest twice a
Re: (Score:3)
The money for quantitative easing was created, not taxpayer-funded. No robbing took place.
Wait, what? When they print more money, all of my money is now worth less. They robbed everyone. Of course, it's irrelevant to the obscenely wealthy, who cannot live long enough to spend all their money.
Re: (Score:3)
Most industrialized economies are designed to be ran with continual inflation. Central banks around the world consider 1.5-3.0% annual inflation to be ideal with 2.0-2.5% to be the sweet spot. The only time you hear about inflation is when it gets outside this range. Capitalist(ish) economies usually suffer a near collapse or total collapse when the currency hits 0% inflation or starts to deflate. Because of this, the money you keep always devalues and always will as long as we keep this economic model
Re: (Score:3)
I think that there can be better systems but, it would take someone much smarter than me to design one and have it work for a global economy. (We're talking Nobel prize territory here.)
That sounds like what turned Brazil's economy around. How Fake Money Saved Brazil [npr.org]
And, basically, inflation did end, and the country's economy turned around. In the years that followed, Brazil became a major exporter, and 20 million people rose out of poverty.
Re: (Score:1)
The Fed creates money, why would it need to rob? Note that the dollar has gained strength: the more dollars the Fed creates, the stronger it gets.
Re: (Score:3)
Re: "Why stop at one?" (Score:1)
Re: (Score:2)
Re: (Score:1)
:-) Don't you mean the IMF?
Re: (Score:2, Troll)
True! The IMF has the power to create money too but it doesn't, instead imposing draconian austerity measures on countries that don't work. The IMF is a killer, robbing countless Greeks of their lives.
Re: (Score:1)
Re:The Best Way to Rob a Bank is to Own One (Score:5, Interesting)
Second best way is to impersonate the person that owns one. Sounds like what these guys did. However, according to TFA they were very patient and methodical, leading up to the assertion that they were 'cybercriminals' rather than state actors. Of course, the last time this weird dichotomy came up, the attackers were state actors because they were so patient and thus weren't plain ol criminals.
Sounds a bit clueless to me. Given the level of information we get from fine articles such as this, I have to wonder just what, if anything at all, really happened.
Best thing about the article is Sergey Golovanov's T-shirt.
Re: (Score:2)
Second best way is to impersonate the person that owns one. Sounds like what these guys did. However, according to TFA they were very patient and methodical, leading up to the assertion that they were 'cybercriminals' rather than state actors. Of course, the last time this weird dichotomy came up, the attackers were state actors because they were so patient and thus weren't plain ol criminals.
I'm not usually given to CTs but I am just cynical enough about the banking industry to wonder if some of this isn't an inside job. Certainly not all the way to the top, those asshats have golden parachutes and legally steal^Wearn their inflated salaries, but at the mid-level? It's not that much of a leap to wonder.
Re: (Score:2)
...Of course, the last time this weird dichotomy came up, the attackers were state actors because they were so patient and thus weren't plain ol criminals....Sounds a bit clueless to me.
That's because according to all the rabid wannabe economists here on slashdot, if you're a government, you don't need to break into a bank to steal money. In the Sony break-in, there was no actual money to be stolen. Those Hollywood accountants are really good ;-)
Re: (Score:2)
Comment removed (Score:5, Interesting)
Re: (Score:2)
I wonder what would happen if government made all banks non-profit or something list that.
Re: (Score:2)
I think that would be a communist paradise, because then the last entities that make a profit won't make one anymore either.
Re: The Best Way to Rob a Bank is to Own One (Score:1)
Re: (Score:2)
I wonder what would happen if governments made all banks non-profit or something like that.
Bitcoin Unaffected (Score:2, Funny)
Bitcoin Unaffected.
Buh buh buht... uhhh... yeah... Damn. Bitcoin Unaffacted. That's all I can say.
Re:Bitcoin Unaffected (Score:5, Insightful)
Right, because no one has ever stolen bitcoin by hacking into a computer and emptying accounts... oh wait...
Re: (Score:1)
If this happened to bitcoin, people would have lost money. Thanks to insurance, no bank customer was robbed.
Re: (Score:2)
Why are we protecting these guys? (Score:5, Insightful)
The theory behind "not naming banks" is that if named, people would leave the bank and go to another one.
Why are banks allowed to do this? This completely negates the "vote with your wallet" power that the public should have.
Re:Why are we protecting these guys? (Score:5, Insightful)
Any bank, literally ANY bank, can be driven out of business if there is as much as a hunch that they are unable to pay.
Quite seriously, no bank on this planet has any liquid assets worth mentioning. If the average manufacturing company had that much unsecured foreign capital floating about, they'd be liable for delayed filing of insolvency.
Re: (Score:2)
...for varying definitions of liquid. Those "liquid" assets are not cash in a big safe vault.
Re: (Score:1)
Why are banks allowed to do this?
Because the customers let them. They are welcome to withdraw their money on mere suspicion. We already know that the big banks are criminal organizations, yet nobody is closing their accounts. Too inconvenient for one thing. So, here we are.
Bank of America? (Score:5, Interesting)
The theory behind "not naming banks" is that if named, people would leave the bank and go to another one.
Why are banks allowed to do this? This completely negates the "vote with your wallet" power that the public should have.
Because they signed a nondisclosure agreement, and because people are afraid of defamation lawsuits.
It is worth noting that Bank of America just had a five-day IT outage/upgrade/etc... during which their credit card interfaces had limited data, etc... It may be unrelated, but... it was for *five days*.
It may well be unrelated--credit cards v. bank accounts and all that--but it may not be. That's a *really* long time to do the public part of upgrading a system.
Anyway, it's all insured (don't read the stuff about losing your online banking password too closely), and you can always sue if they tried not to cover you, so it's not worth a run on any banks unless they start losing a lot more. At least they're paying attention.
Re: (Score:2)
For the answer on why we don't reveal this information read up on the 1929 bank failures [history.com]. For the tl;dr crowd: There's a very good reason that we don't say which banks are having problems because they get ran out of business quickly (often within hours) and everyone that didn't make it in time looses their money. It happened in 1929 in the U.S. and it destroyed our economy for a decade.
Re: (Score:2)
For the answer on why we don't reveal this information read up on the 1929 bank failures [history.com]. For the tl;dr crowd: There's a very good reason that we don't say which banks are having problems because they get ran out of business quickly (often within hours) and everyone that didn't make it in time looses their money. It happened in 1929 in the U.S. and it destroyed our economy for a decade.
Are you saying people would actually lose money if their bank went under? That there's no FDIC (Federal Deposit Insurance Corporation) or other safeguards? Are you saying that the federal reserve wouldn't overnight a truckload of cash if there was a run on the bank?
Are you saying that banks can do a slip-shod job, have no repercussions, and this is a *good* thing?
Just as GM can lose business by making a faulty ignition switch, banks should lose business when they lose the public trust.
Banks SHOULD lose busi
Re: (Score:2)
You do realize who picks up the tab when the FDIC has to bail out a bank right? The answer is you and me. I agree the banks should be punished for bad behavior but, history has taught us that standard capitalist repercussions are bad for the economy as a whole and different solutions to the problem need to be used.
Re: (Score:2)
You obviously have no idea how this works. Your balance is NOT transferred because there is no one to guarantee that whoever takes over the debt (the money the bank owes its account holders) will get paid so, no one will accept the debt. The FDIC then has to step in, take over the deposits, loans, etc. and then sell them to a bank at a huge loss, that is picked up by the taxpayer, and pay any portion of the deposits that fall short up to a maximum of $100,000; again at taxpayer expense. Banks should be
Re: (Score:2)
yes. does this help people who believe stuff like "you can vote with your wallet" understand that they are working with a flawed model of the world? sadly, no.
Is nothing Hackproof? (Score:3)
It became clear to me years ago that I could only make something fool-resistant, since as soon as I imagined foolproof had been achieved, they kept making a better fool.
My takeaway: The most devilishly clever security system, devised by the most gifted programmers, in a scenario where money was no object, can still be compromised because of the human user element in the implementation of the system.
Re: (Score:3)
The most devilishly clever security system, devised by the most gifted programmers, in a scenario where money was no object, can still be compromised because of the human user element in the implementation of the system.
Banks don't have any of that shit. That's the problem.
Re: (Score:3, Interesting)
Yes, it is possible to create a hack proof system. Is it economically feasible? That's the real question here.
And here even the old metric of risk assessment goes out the window. No, seriously. We're talking about a mission crippling threat (or, in simple terms, "if it happens, we're fucked"), something that usually is required to protect against. For the obvious reason, if it happens, we're done for. Like a rocket engine on a space ship, you want one that DOES work no matter what because if it for some odd
Re: (Score:2)
...because of the human...
But we're talking about banks.
This is a clear example of why Bitcoin won't work. (Score:4, Insightful)
..... Wait, what?
Oh. Nevermind then.
Re: (Score:1)
>who will cover stolen Bitcoins?
You could implement the same scheme the government does when they cover the bank's losses. Just take a sliver of bitcoin from every single account to replace what was lost.
It's the same effect, you're all a little bit poorer each time they replace that money.
Re: (Score:1)
dollars in a bank can be insured, how's that bitcoin insurance industry doing?
Re: (Score:2)
Re: (Score:3)
Re: (Score:2)
No, some companies just started offering it. But "bitcoin is insured" is a generally false statement right now.
Trace the Transfers? (Score:5, Interesting)
So shouldnt' they be able to trace the transfers to the destination accounts? And continue doing so until the money is withdrawn?
Hell, even in places like Kazakhstan they don't have pallet loads of $100 bills waiting around for people to withdraw millions in cash. And you don't really walk into a bank ANYWHERE in the world and pull out millions in cash from a newly opened account without tons of ID, paperwork, being on cameras, access to large armored trucks, etc.
I'm familiar with the concept of mules and blinds, but for a scheme so sophisticated it sounds suspicious to use low level mules to pull out millions in cash. Multiple points of failure/discovery.
How the hell do they get the actual money OUT?
Re: (Score:2)
How the hell do they get the actual money OUT?
Bypass encryption from a Country not beholden to cooperate with the U.S. Sadly, the list is growing.
Here's the craziest part of the whole story. One of these banks may not have cashed a check I had, made out to me... by my employer ... who rented office space out of the same building, simply because I was one shy of three IDs.
$Tens of millions U.S. leaves out in the night without any real-time human authentication.
Re: (Score:2)
That last part is easy. You can always trust people who know that you'll break their legs if they betray you.
Re: (Score:2)
I don't think those ways would work for this magnitude of theft. The "Cayman Islands" approach is much more plausible. Or using some government's intelligence agency to launder it.
thanks for sharing kapersky (Score:1)
Re: (Score:2)
Not quite. That particular malware makes it into their database so other customers should be slightly safer.
I'm not sure how effective this anonymity through obscurity is though, presumably people in Kiev know which bank's ATMs randomly regurgitate cash. It will also have been reported so Ukranian (or Russian) speakers will be able to use Yandex or Google.
Re: (Score:3)
This.
And, banks aren't alone.
Cyber security will only happen after litigation kicks in.
Re: (Score:2)
Huh? Why should cyber security be different from any other legislation concerning companies?
Whether a corporation does something to protect against something that could be considered negative depends on three things: Cost to implement it, cost if bad thing happens, likelyhood of bad thing happening.
Laws and fines are part of the "cost if bad thing happens" part.
Re: (Score:2)
No.
Your criteria fail to explain why businesses (US) have sprinklers, fire extinguishers, fire exits, fire retardant furnishings and fire-specific building codes ... all backed by ordinances.
Only after many lives were lost and much litigation did these become "the cost of doing business."
Re: (Score:2)
Because insurances get cheaper if you have those things, and by more than their cost, and the fines for not having them if they are required by law are higher than the cost to have and maintain them.
That's basically the reason. Certainly not because any of the peons slaving away in there matters. Any of them can be replaced by any others.
Spyware and malware (Score:1)
Re: (Score:2)
Although I enjoy a good conspiracy theory as much as the next guy, I can't figure out why McAfee, which is based in the US, and Kaspersky, which is based in Moscow, would work together to conceal each others' government spyware from us via some sort of universal white list. You'd think everybody would have a different white list to serve their own governments' conspiracies.
Hey...wait a minute...I just realized how naive I've been not to have realized that all world governements actually are conspiring toge
Re: (Score:2)
The thing is, your "one whoppin' good conspiracy!" is correct, except that you included one word too many. You should have said: "Hey...wait a minute...I just realized how naive I've been not to have realized that all world governements actually are conspiring to oppress us. Now that's one whoppin' good conspiracy!" Only the word "together" makes it incorrect. But sometimes some of them cooperate. (OTOH, I do accept that the secrecy is enforced contractually in this case. )
Robust versus Secure (Score:5, Insightful)
The internet was designed to be amazingly robust, able to successfully get a message through a nuked-out infrastructure -- point A to point Z via any number of non-predetermined intermediate points. It was not designed to be secure because such security wasn't deemed necessary to the completion of the mission of getting a message to point Z from point A regardless the damage inbetween the two points.
What security it does have has been bolted on after-the-fact much like bolting a wind spoiler onto a Volkswagen Beetle. and with pretty much the same comical effect. "Secure" internet will require some serious redesign at the various hardware and sofware levels before it can be secure.
An interesting question is whether or not it can be both very robust and very secure at the same time?
My point being that the warnings about the above were made loud and clear in the mid-1990s when the internet was "discovered" by the citizenry and the commercial interests and yet everyone yelled "Full speed ahead!" and so here we are.
Not quite true Re: Robust versus Secure (Score:5, Informative)
We can and do use the insecure internet to securely transmit information.
All to often we do it wrong though. Doing it wrong means we can be fooled.
Sometimes we do it wrong on a technical level, such as using out of date encryption, fundamentally broken encryption, or worse.
Sometimes we do it on a human level, such as not occasionally verifying that the account-holder or bank employee is the one and only person who has used his credendials recently using a non-technical means.
Sometimes we do it wrong in our business practices, such as by not doing frequent-enough random audits and not forseeing that a particular type of attack is worth monitoring for. I will grant some leeway here in that "ridk management" != "risk elimination."
Re: (Score:2)
Excellent point.
I grew up with all this shit. I got my first micro computer in 1978 (I was a 33-year old electronics tech) and my first coding gig in 1986.Computers were very easy to hack via floppy disk (the 5 1/4" kind).
Each computing device has much greater responsibility nowadays, but the security has made NO advances.
Re: (Score:2)
Each computing device has much greater responsibility nowadays, but the security has made NO advances.
Neither has human nature.
Re: (Score:2)
Each computing device has much greater responsibility nowadays, but the security has made NO advances.
I've noticed the same problem with cats and mice. No matter what advances the cats make, the mice remain. One can only assume that the mice make advances at about the same rate as the cats.
Re:Robust versus Secure (Score:5, Interesting)
An interesting question is whether or not it can be both very robust and very secure at the same time?
You can have a very secure network right now, and have it be very robust, too. You can deny all non-encrypted communications, use certs for all comms, and exercise close control over your certs. You can prevent users from running any unauthorized software, and you can use software without extraneous bullshit, e.g. avoid using Windows as a thin client which is truly a full retard move. But that's a huge PITA, so nearly nobody ever does these things properly, even banks.
Banks should have to announce to their customers when their networks have been penetrated.
Re: (Score:1)
But why should banks have to announce anything? If I have a factory that gets robbed, I don't have to tell anybody as long as I still deliver the promised goods to my clients. If none of their customers are actually out any money (for more than a few days or hours while they clean up the mess) why does it really matter? It's between the bank, their insurance provider, and possibly the government.
4 Words (Score:2)
Payback is a bitch.
Re: (Score:2)
If only computers ... (Score:2)
... had been vaccinated at birth.
Bank Hackers Steal Millions Via Malware? (Score:2)
"First, they get physical access to the ATMs and insert a bootable CD [kaspersky.com] to install the malware -- code named Tyupkin by Kaspersky Lab. After they reboot the system, the infected ATM is under their control."
"The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file [virustotal.com] for the Windows GUI subsystem"
This is recycled old news. (Score:1)
"When cybersecurity firm Kaspersky Lab was called in to investigate ATMs that had begun dispensing cash without input from users, they expected to find a simple problem."
The problem is that Kaspersky wasn't "called in", it's just a dubious PR tactic coupled with a journalist who (surprise, surprise) didn't do any own research. They took a discovery from December, renamed the network, inflated the amounts and spun someone else's work as their own.
Graham Cluley had a suspicion about the details which looked a
Re: (Score:2)
You oversimplify. It also involves a lot of hard work, and some of them didn't do anything very unethical....they just took advantage of an existing non-level playing field. (I'll grant that others ensured that the playing field *would* be non-level, but they aren't necessarily the same people.)
OTOH, I do agree that there's no justification for the excessive imbalance being maintained. And I see no way to reform the system from my position.
Re: (Score:2)
You say "to the detriment", and that isn't clear. The non-level playing field *is* clear. E.g., it's not clear that Steve Jobs was highly unethical rather than only mildly unethical. And it's not clear that he acted "to the detriment of billions of other people".
I'll agree that it's quite easy to come up with other examples where it *is* clear. But no class of people is uniform. Not even a pair of identical twins. Whenever you see them that way, you can be certain that you are simplifying...and perhap