Vulnerabilities / Threats
4/26/2011
06:05 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

China Implicated In Hacking Of SMB Online Bank Accounts

FBI warns that small- to midsize businesses are being targeted in an attack that so far has bilked companies' accounts of millions of dollars and wired the money to Chinese companies

This time it wasn't an "advanced persistent threat" that China was associated with: a fraud alert issued by the FBI today implicates China in a cybercrime operation that bilked U.S.-based small- to midsize businesses of $11 million over the past year.

The FBI warned that it has identified 20 incidents in which SMBs' online banking credentials were stolen and their bank accounts siphoned, with the money wired to China-based economic and trade companies near the Russia border. The attackers attempted to steal some $20 million overall during the March 2010 and April 2011 timeframe.

What was most striking about the FBI alert was the rare level of detail the bureau provided for both SMBs and banks. It spelled out the transaction increments and paths used by the attackers, as well as their geographic drops and phony company names. The FBI says the stolen funds were wired to companies located in China's Heilongjiang province, with company names that include Chinese ports such as Raohe, Fuyuan, Jixi City, Xunke, Tongjiang, and Dongning, and the words "economic and trade," "trade," and "LTD."

The transactions ranged from $50,000 to $985,000, with most above $900,000. According to the FBI, the attackers had the most success in getting their hands on the money when they transferred under $500,000 per transaction. When the money is transferred, it's immediately withdrawn or transferred elsewhere. They also use money mules in the U.S. "The malicious actors also sent domestic ACH and wire transfers to money mules in the United States within minutes of conducting the overseas transfers. The domestic wire transfers range from $200 to $200,000. The intended recipients are money mules, individuals who the victim company has done business with in the past, and in one instance, a utility company located in another U.S. state," according to the FBI. These ACH transactions from the compromised bank accounts were anywhere from $222,500 to $1.3 million.

"We'd like see more of this from the FBI--specific and actionable information on a regular basis," say Nick Selby, managing director of consultancy Trident Risk Management, and a police officer. "The FBI is telling the banks what to look out for, and the business owners [as well]--both sides of the equation."

Read the rest of this article
on Dark Reading

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2021
Published: 2014-10-24
Cross-site scripting (XSS) vulnerability in admincp/apilog.php in vBulletin 4.4.2 and earlier, and 5.0.x through 5.0.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted XMLRPC API request, as demonstrated using the client name.

CVE-2014-3604
Published: 2014-10-24
Certificates.java in Not Yet Commons SSL before 0.3.15 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

CVE-2014-6230
Published: 2014-10-24
WP-Ban plugin before 1.6.4 for WordPress, when running in certain configurations, allows remote attackers to bypass the IP blacklist via a crafted X-Forwarded-For header.

CVE-2014-6251
Published: 2014-10-24
Stack-based buffer overflow in CPUMiner before 2.4.1 allows remote attackers to have an unspecified impact by sending a mining.subscribe response with a large nonce2 length, then triggering the overflow with a mining.notify request.

CVE-2014-7180
Published: 2014-10-24
Electric Cloud ElectricCommander before 4.2.6 and 5.x before 5.0.3 uses world-writable permissions for (1) eccert.pl and (2) ecconfigure.pl, which allows local users to execute arbitrary Perl code by modifying these files.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.