06:30 PM

Reuters: Police Say SWIFT Techs Made Bangladesh Bank More Vulnerable Before Heist

SWIFT rejects 'baseless allegations' that software company's negligent security procedures had anything to do with $81 million wire transfer heist.

Three months before Bangladesh Bank was victim to an $81 million cyber heist, technicians from financial software platform company SWIFT opened the bank up to new vulnerabilities, Bangladeshi police told Reuters.  

Last month, researchers reported that highly customized malware exploited vulnerabilities in the bank's computing environment, then hid its fraudulent behavior by tricking the SWIFT software; but it did not exploit a SWIFT vulnerability, per se. Now, police and a bank official told Reuters that SWIFT's people, if not its platform, may be partly responsible for making the bank's computing environment more vulnerable.

According to police, SWIFT technicians did not follow adequate security procedures when they connected the platform to a new bank transaction system that enables domestic banks and the central bank to transfer large sums between themselves. Their negligence "caused much more risk for Bangladesh Bank," police said. In February, attackers used this system to send fraudulent messages, requesting nearly $1 billion in wire transfers. Most of them were blocked, but $81 million in transfers were successfully carried out. 

Police told Reuters the SWIFT messaging system was "widely accessible, including remote access with only a simple password," partly because technicians left open a wireless connection they had established just for the project, after the job was finished. They also criticized SWIFT for failing to connect the two systems on a private LAN, failing to disable a USB port, choosing to use an outdated networking switch, and failing to install a firewall between the systems.  

Investigators are trying to ascertain whether these actions were a case of negligence, or whether they intentionally made the bank more vulnerable. 

SWIFT rejected the police statements, telling Reuters in a subsequent story they were "baseless allegations" and that Bangladesh Bank, not SWIFT, "is responsible for the security of its own systems interfacing with the SWIFT network and their related environment."

Police did not provide evidence for their allegations and Reuters has not yet obtained third-party confirmation. 

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
6/21/2016 | 9:59:01 AM
Re: Yup.
Damage control and diversion of blame.
Joe Stanganelli
Joe Stanganelli,
User Rank: Ninja
5/10/2016 | 9:27:31 AM
Hey, if they can't find the criminals, then finding someone to sue is the next best thing, right?
Government Shutdown Brings Certificate Lapse Woes
Curtis Franklin Jr., Senior Editor at Dark Reading,  1/11/2019
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Current Issue
The Year in Security 2018
This Dark Reading Tech Digest explores the biggest news stories of 2018 that shaped the cybersecurity landscape.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2019-01-18
TP-Link WDR Series devices through firmware v3 (such as TL-WDR5620 V3.0) are affected by command injection (after login) leading to remote code execution, because shell metacharacters can be included in the weather get_weather_observe citycode field.
PUBLISHED: 2019-01-17
** DISPUTED ** An issue was discovered in BMC PATROL Agent through 11.3.01. It was found that the PatrolCli application can allow for lateral movement and escalation of privilege inside a Windows Active Directory environment. It was found that by default the PatrolCli / PATROL Agent application only...
PUBLISHED: 2019-01-17
A spoofing vulnerability exists when a Skype for Business 2015 server does not properly sanitize a specially crafted request, aka "Skype for Business 2015 Spoofing Vulnerability." This affects Skype.
PUBLISHED: 2019-01-17
A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka "Team Foundation Server Cross-site Scripting Vulnerability." This affects Team.
PUBLISHED: 2019-01-17
An information disclosure vulnerability exists when Team Foundation Server does not properly handle variables marked as secret, aka "Team Foundation Server Information Disclosure Vulnerability." This affects Team.