Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


06:30 PM

Reuters: Police Say SWIFT Techs Made Bangladesh Bank More Vulnerable Before Heist

SWIFT rejects 'baseless allegations' that software company's negligent security procedures had anything to do with $81 million wire transfer heist.

Three months before Bangladesh Bank was victim to an $81 million cyber heist, technicians from financial software platform company SWIFT opened the bank up to new vulnerabilities, Bangladeshi police told Reuters.  

Last month, researchers reported that highly customized malware exploited vulnerabilities in the bank's computing environment, then hid its fraudulent behavior by tricking the SWIFT software; but it did not exploit a SWIFT vulnerability, per se. Now, police and a bank official told Reuters that SWIFT's people, if not its platform, may be partly responsible for making the bank's computing environment more vulnerable.

According to police, SWIFT technicians did not follow adequate security procedures when they connected the platform to a new bank transaction system that enables domestic banks and the central bank to transfer large sums between themselves. Their negligence "caused much more risk for Bangladesh Bank," police said. In February, attackers used this system to send fraudulent messages, requesting nearly $1 billion in wire transfers. Most of them were blocked, but $81 million in transfers were successfully carried out. 

Police told Reuters the SWIFT messaging system was "widely accessible, including remote access with only a simple password," partly because technicians left open a wireless connection they had established just for the project, after the job was finished. They also criticized SWIFT for failing to connect the two systems on a private LAN, failing to disable a USB port, choosing to use an outdated networking switch, and failing to install a firewall between the systems.  

Investigators are trying to ascertain whether these actions were a case of negligence, or whether they intentionally made the bank more vulnerable. 

SWIFT rejected the police statements, telling Reuters in a subsequent story they were "baseless allegations" and that Bangladesh Bank, not SWIFT, "is responsible for the security of its own systems interfacing with the SWIFT network and their related environment."

Police did not provide evidence for their allegations and Reuters has not yet obtained third-party confirmation. 

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
6/21/2016 | 9:59:01 AM
Re: Yup.
Damage control and diversion of blame.
Joe Stanganelli
Joe Stanganelli,
User Rank: Ninja
5/10/2016 | 9:27:31 AM
Hey, if they can't find the criminals, then finding someone to sue is the next best thing, right?
7 Truths About BEC Scams
Ericka Chickowski, Contributing Writer,  6/13/2019
DNS Firewalls Could Prevent Billions in Losses to Cybercrime
Curtis Franklin Jr., Senior Editor at Dark Reading,  6/13/2019
Cognitive Bias Can Hamper Security Decisions
Kelly Sheridan, Staff Editor, Dark Reading,  6/10/2019
Register for Dark Reading Newsletters
White Papers
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2019-06-16
In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections.
PUBLISHED: 2019-06-15
The "Count per Day" plugin before 3.2.6 for WordPress allows XSS via the wp-admin/?page=cpd_metaboxes daytoshow parameter.
PUBLISHED: 2019-06-15
In OrangeHRM 4.3.1 and before, there is an input validation error within admin/listMailConfiguration (txtSendmailPath parameter) that allows authenticated attackers to achieve arbitrary command execution.
PUBLISHED: 2019-06-15
In Webmin through 1.910, any user authorized to the "Package Updates" module can execute arbitrary commands with root privileges via the data parameter to update.cgi.
PUBLISHED: 2019-06-15
formats/xml.cpp in Leanify 0.4.3 allows for a controlled out-of-bounds write in xml_memory_writer::write via characters that require escaping.