3 ms·
Regarding title and careless use in article: SWIFT is not a system. SWIFT is an instruction protocol tied to a network that SWIFT Alliance Access (mentioned i
by zhte415 11y ago
Regarding title and careless use in article:
SWIFT is not a system.
SWIFT is an instruction protocol tied to a network that SWIFT Alliance Access (mentioned in article) gives access to, SWIFTNet.
Without going into details of failings of SWIFT authentication, which are few, this appears to be simple phishing:
The use of malware, suggested here, seems simple:
* There are a lot of manual steps in fund transfers that are either initiated manually (submitting a paper-based payment request, or even change to a company's authorised signature list) or requiring various manifests such as letter or credit clearing.
* Malware means the typical system of checking inputs are indeed true and correct (an inputter of the paper form, and a checker to verify it is true and correct) can be disrupted by replacing the scanned file between scanning and input (based on scan) or direct system access changing key numbers of codes.
* This comment is not a slight on Bangladesh. It is a general comment on developing economies I've interacted with in banking operations across Asia: Staff are often under-trained at a branch level and expected to perform a multitude of tasks under under-trained management. Local actors, for example local banks, often have completely insecure systems compared to international banks despite acting as correspondent bank in many transactions (added to the security-failure tool-chain). This is in contrast with outsourced operations in similar countries that run large service centers and most-often do an excellent job.
This appears to be fully not an error of SWIFT, but of using (the power of) SWIFT in combination with discrete and serious errors in injecting false records in non-audited/un-auditable systems that interact with SWIFT instructions and SWIFTNet.
- nickpsecurity 11y agoYour comment is mostly accurate. However, I'd imagine anyone hearing a message was sent through SWIFT would assume a protocol got it to SWIFTnet followed by their own systems processing it. The two are inseparable. We used to call this sort of thing a "system of systems." Anyway, it's accurate to think of protocol + SWIFT's mgmt systems as "the SWIFT system" given they work collectively to hanndle a SWIFT transaction.
- jcoffland 11y agoI'm assuming the Bangladesh bank did not write their own software so these vulnerabilities must also exist at other banks on the SWIFT network. SWIFT is just a protocol but any bank who signs on to SWIFT must also have software which implements SWIFT and therefore is potentially vulnerable to similar attacks. I'm sure this prospect terrifies the banking industry but it cannot be explained away. These risks exist even for Western banks.
- zhte415 11y agoIndeed. However, that malware is indicated suggests this could be to lax local lock-down of PCs. Pretty common. International banks should be pretty locked-down, but no reason to be complacent. I imagine various regional and country heads of compliance are aware of this right now, or have been already. What is likely worrying local bank security managers is just how many VBA-type programs they're running as quick-fixes to operational problems that are vulnerable, the weak links. The number of hacked-together-at-the-weekend-bought-in-services in banking is astounding, especially in emerging markets. Yes, these hack/programs exist in established international corporate banks.
- ryanjshaw 11y agoFrom the description this sounds like a highly targeted attack on proprietary software the bank uses to manage payments. (Most large banks don't use SWIFT Alliance Access directly - instead they have numerous internal systems that will ultimately use SWIFT as the final step for certain payments.) I would be very surprised to learn this was not a result of somebody who worked at the bank.
- DanielDent 11y agoOnce upon a time I did some work at a software firm which serviced financial institutions, including many very recognizable names. I came into work one day and a colleague had a piece of paper on his desk requesting that we not touch his machine. A macro was running which was switching between two open programs, highlighting fields, and copy and pasting data. I'm still not sure if I should be alarmed or in awe. It was probably the most sensible option of the available options...
- r00fus 11y agoAmazing to me that for credit cards, we have PCI DSS[1] which is incredibly invasive in it's requirements, ins't there something equivalent for SWIFT-connected locations? [1] https://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Security_Standard https://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Sec...