Vulnerabilities / Threats
4/26/2011
06:05 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%
Repost This

China Implicated In Hacking Of SMB Online Bank Accounts

FBI warns that small- to midsize businesses are being targeted in an attack that so far has bilked companies' accounts of millions of dollars and wired the money to Chinese companies

This time it wasn't an "advanced persistent threat" that China was associated with: a fraud alert issued by the FBI today implicates China in a cybercrime operation that bilked U.S.-based small- to midsize businesses of $11 million over the past year.

The FBI warned that it has identified 20 incidents in which SMBs' online banking credentials were stolen and their bank accounts siphoned, with the money wired to China-based economic and trade companies near the Russia border. The attackers attempted to steal some $20 million overall during the March 2010 and April 2011 timeframe.

What was most striking about the FBI alert was the rare level of detail the bureau provided for both SMBs and banks. It spelled out the transaction increments and paths used by the attackers, as well as their geographic drops and phony company names. The FBI says the stolen funds were wired to companies located in China's Heilongjiang province, with company names that include Chinese ports such as Raohe, Fuyuan, Jixi City, Xunke, Tongjiang, and Dongning, and the words "economic and trade," "trade," and "LTD."

The transactions ranged from $50,000 to $985,000, with most above $900,000. According to the FBI, the attackers had the most success in getting their hands on the money when they transferred under $500,000 per transaction. When the money is transferred, it's immediately withdrawn or transferred elsewhere. They also use money mules in the U.S. "The malicious actors also sent domestic ACH and wire transfers to money mules in the United States within minutes of conducting the overseas transfers. The domestic wire transfers range from $200 to $200,000. The intended recipients are money mules, individuals who the victim company has done business with in the past, and in one instance, a utility company located in another U.S. state," according to the FBI. These ACH transactions from the compromised bank accounts were anywhere from $222,500 to $1.3 million.

"We'd like see more of this from the FBI--specific and actionable information on a regular basis," say Nick Selby, managing director of consultancy Trident Risk Management, and a police officer. "The FBI is telling the banks what to look out for, and the business owners [as well]--both sides of the equation."

Read the rest of this article
on Dark Reading

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-3946
Published: 2014-04-24
Cisco IOS before 15.3(2)S allows remote attackers to bypass interface ACL restrictions in opportunistic circumstances by sending IPv6 packets in an unspecified scenario in which expected packet drops do not occur for "a small percentage" of the packets, aka Bug ID CSCty73682.

CVE-2012-5723
Published: 2014-04-24
Cisco ASR 1000 devices with software before 3.8S, when BDI routing is enabled, allow remote attackers to cause a denial of service (device reload) via crafted (1) broadcast or (2) multicast ICMP packets with fragmentation, aka Bug ID CSCub55948.

CVE-2013-6738
Published: 2014-04-24
Cross-site scripting (XSS) vulnerability in IBM SmartCloud Analytics Log Analysis 1.1 and 1.2 before 1.2.0.0-CSI-SCALA-IF0003 allows remote attackers to inject arbitrary web script or HTML via an invalid query parameter in a response from an OAuth authorization endpoint.

CVE-2014-0188
Published: 2014-04-24
The openshift-origin-broker in Red Hat OpenShift Enterprise 2.0.5, 1.2.7, and earlier does not properly handle authentication requests from the remote-user auth plugin, which allows remote attackers to bypass authentication and impersonate arbitrary users via the X-Remote-User header in a request to...

CVE-2014-2391
Published: 2014-04-24
The password recovery service in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 makes an improper decision about the sensitivity of a string representing a previously used but currently invalid password, which allows remote attackers to obtain potent...

Best of the Web