Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

4/25/2016
05:30 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Malware At Root Of Bangladesh Bank Heist Lies To SWIFT Financial Platform

Customized malware hid $81 million of wire transfers until the money had been safely laundered.

A cyber bank heist of $81 million from Bangladesh Bank (BB) in February probably involved highly customized malware written specifically to exploit vulnerabilities in the bank's poorly secured local environment, according to researchers at BAE Systems. Though it did not exploit a vulnerability in the SWIFT financial software per se, the malware hid all evidence of the attackers' fraudulent wire transfers by fooling the SWIFT software in a variety of ways.

As Reuters reported in February, the attackers -- whose identities remain unknown -- first obtained the credentials the bank uses to approve payments. Then, they "bombarded the Federal Reserve Bank of New York with nearly three dozen requests to move money from the Bangladesh Bank's account there to entities in the Philippines and Sri Lanka."

The campaign would have been even costlier if the attackers hadn't drawn attention to themselves by simply being careless with their spelling. "Hackers misspelled "foundation" in the NGO's name as "fandation," prompting a routing bank, Deutsche Bank, to seek clarification from the Bangladesh central bank, which stopped the transaction, one of the officials said." By this time, $80 million of transactions had already gone through, but, fortunately, $850 to $870 million of other attempted transactions were stopped. Some of the funds have been recovered.

If the attackers had had better editors, BB might have been out $1 billion, based upon what BAE Systems has discovered about the stealth malware on their systems -- which BAE believes was probably part of a bigger toolkit installed on the environment. They are not sure at this point how the initial infection took place, but the malware registers as a service in the environment running the SWIFT software.

One of the malware's tricks: it includes a module that replaces a 2-byte conditional jump with a do-nothing instruction -- "effectively forcing the host application to believe that the failed check has in fact succeeded," thereby giving itself the ability to execute database transactions, BAE said.

It manipulated the record of account balances, and monitored all the messages sent via SWIFT. It evens sent doctored copies of wire transfers to printers, and then deletes the records of them.

The code itself contained detailed information about the bank's environment. From Reuters, today:

Adrian Nish, BAE's head of threat intelligence, said he had never seen such an elaborate scheme from criminal hackers.

"I can't think of a case where we have seen a criminal go to the level of effort to customize it for the environment they were operating in," he said. "I guess it was the realization that the potential payoff made that effort worthwhile."

SWIFT, meanwhile, responded today, deflecting any responsibility for the vulnerability:

SWIFT is aware of a malware that aims to reduce financial institutions’ abilities to evidence fraudulent transactions on their local systems. Contrary to reports that suggest otherwise, this malware has no impact on SWIFT’s network or core messaging services.

We understand that the malware is designed to hide the traces of fraudulent payments from customers’ local database applications and can only be installed on users’ local systems by attackers that have successfully identified and exploited weaknesses in their local security.

Bangladeshi Police are not letting SWIFT entirely off the hook, according to Reuters, stating that both the bank -- which had "seriously deficient" security -- and SWIFT are to blame.

This heist has also been cloaked in some mystery. A cybersecurity researcher investigating the attack reportedly went missing March 16, the day after stating that he'd discovered three user IDs involved, and was possibly abducted. Police found him wandering the streets of Dhaka, Bangladesh's capital city, March 23, "alive but in a dishevelled state," and decided to simply drive him home without questioning him while he was in that state, according to IB Times.

Related stories:

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Whoopty
50%
50%
Whoopty,
User Rank: Ninja
4/26/2016 | 8:22:40 AM
Bitcoin
While I know Bitcoin has its own pitfalls, it does seem like decentralized funds avoid problems like this by not providing one point of attack for hackers. 

I don't think Bitcoin is quite ready to become the world's choice for banking, but an interesting point to consider. There are certainly some strengths of crypto currencies over more traditional means of monetary transactions.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/9/2020
Omdia Research Launches Page on Dark Reading
Tim Wilson, Editor in Chief, Dark Reading 7/9/2020
Mobile App Fraud Jumped in Q1 as Attackers Pivot from Browsers
Jai Vijayan, Contributing Writer,  7/10/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15105
PUBLISHED: 2020-07-10
Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session (base64-encoded). The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor authenticati...
CVE-2020-11061
PUBLISHED: 2020-07-10
In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates the problem. This issue is also patched in...
CVE-2020-4042
PUBLISHED: 2020-07-10
Bareos before version 19.2.8 and earlier allows a malicious client to communicate with the director without knowledge of the shared secret if the director allows client initiated connection and connects to the client itself. The malicious client can replay the Bareos director's cram-md5 challenge to...
CVE-2020-11081
PUBLISHED: 2020-07-10
osquery before version 4.4.0 enables a priviledge escalation vulnerability. If a Window system is configured with a PATH that contains a user-writable directory then a local user may write a zlib1.dll DLL, which osquery will attempt to load. Since osquery runs with elevated privileges this enables l...
CVE-2020-6114
PUBLISHED: 2020-07-10
An exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS (Commit bb274de1751ffb9d09482fd2538f9950a94c510a) . A specially crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerabi...