8 ms·
Two Bytes to $951M
- mburst 10y agoSounds like an inside job. Really cool write up!
- jtchang 10y agoThis is some real life swordfish shit right here. This is not some run of the mill trojan keylogger. Whoever wrote this had plenty of access and time to get the malware correct.
- anilgulecha 10y agoSomething this intricate had to have some testing -- My hypothesis is that they did a test heist for small amounts prior to the big one.
- yompers888 10y agoIs there a nation-state actor who would have cause to put forth these resources to disturb the Bangladeshi central bank?
- meowface 10y agoPure speculation, but impressive as this is, it feels just amateurish enough to not be a nation-state. They made some mistakes like typos in the sending address of the wire recipient, and also made the attack discoverable the night/morning after, when an employee noticed SWIFT reports weren't printing properly. I think they were probably just in it for the money.
- yompers888 10y agoOk, fair enough. I could have seen it being either way, but I've mostly only read the big reports about nation-state actors, so I'm probably biased to see it that way. As a separate note, state actors can be very amateurish. The Chinese did things, as disclosed by the Mandiant APT1 Report, like taunting users, using very non-native English phishing messages,and leaving plaintext signatures as a means of bragging.
- deleted 10y ago[deleted]
- mahyarm 10y agoIf you are fine with robbing a bank and for that amount wouldn't you?
- colejohnson66 10y agoCan someone explain how the money just "disappears"? Do the thieves send it to a bank account overseas and the receiving bank doesn't cooperate and send it back? Wouldn't there be a log detailing exactly where the money was sent if they bounced it through multiple banks? Could someone wire it to a bank, withdraw it as cash, then deposit it somewhere else?
- funkyy 10y agoYou can simply re-wire money between different jurisdictions. Lets say you send money to Phillipines -> Gibraltar -> Caymans -> Russia -> UK -> Panama -> Switzerland Because each country is on different continent, following different rules and laws, accessing data is extremely hard. Many countries from different geographical locations wont be happy to give access to banking information. Before they can track the money, it will be deposited to shell company. With amounts like that there are often bigger powers that will help make them disappear, like politicians and bank executives. I personally have been dealing with banks on higher level and their willingness to ignore the rules and regulators is enormous. Thats in EU, I believe in countries like Gibraltar or Cayman Islands must be pretty easy.
- ben_jones 10y agoIt reminds me of Wolf of Wall Street and the Swiss banker. If I was ever involved in such a situation I'd be expecting to call the banker (who's complicity laundering) and hear "what money? you have no money with us).
- slmyers 10y agoA few reasons why the "banker" may not be interested in stealing your money. 1) In the black markets reputation is meaningful... if word gets around that you rip people off, then you might have trouble finding more customers. 2) Stealing that much money is a good way to get killed. I wouldn't put it past a powerful white collar criminal to organize a murder or two.
- dzdt 10y ago
- therein 10y agoGreat write up and it certainly sounds like an inside job. I mean, it seems the authors of the malware had an incredible amount of insight into the entire SWIFT platform anyway.
- pedalpete 10y agoI was thinking the same thing, then started wondering if the knowledge could have been gained by watching transactions and investigating code once you had access to the system. However they gained the knowledge, it is incredible.
- meowface 10y agoThey believe at least one person helped the attackers. Odds are it was an outside criminal group that did the development, and bribed an employee.
- sipos 10y agoSWIFT is a very widely used (global) system, used by many many institutions. I imagine keeping the details of how it works secret is basically impossible.
- dogma1138 10y agoIt's not kept secret the documentation is available more or less to the "public", so is the SDK. You can also register for training, I underwent SWIFT training and I never worked for a bank, I'm not sure how it was arranged but I doubt it that strict of a process. There are 100's if not 1000's online and offline providers for SWIFT training from training bank employees on how to use the software as end users through IT specialists which deploy the software to developers which build applications on SWIFT. To get a swift.com account you need to have details, name, institution code (BIC code for banks) and some additional details. SWIFT doesn't handle the authorization the institution you are registering on behalf does which means it's probably even more easier to phish/social engineer yourself in. Gaining access to swift.com credentials also shouldn't be that hard, especially if have already compromised the bank's network or any of it's employees. To get access to the SWIFT documentation and other materials you also don't have to compromise your initial target which makes it even easier. Registration to SWIFT's "Mystandards" is open to the public completely which both gives you access to quite a bit of information as well as allows to you participate in discussion groups which may lead to a few more vectors for social engineering.
- sonoffett 10y agoI wonder if a Blockchain system would mitigate the feasibility of this kind of attack and make it easier to trace the destination of the stolen funds?
- dangero 10y agoA basic blockchain system would not necessarily change the feasibility of this attack, but it would probably make it easier to trace the funds. The crux of this attack is that the transacting and reporting computer were compromised. This means that fraud transactions were initiated and then notifications of those transactions were removed from the reporting machine. With a blockchain system I could see a similar outcome if the transacting and reporting machines were compromised. Of course, with a blockchain system there are many ways you could improve security to decrease the chances of this attack: 1. Multi-signature transactions could require a hacker to compromise multiple machines possibly on separate network segments. 2. Multiple reporting and auditing machines could be employed on several separate networks to again increase intrusion requirements. I suspect SWIFT already allows for or could employ similar methods on their network to mitigate these types of scenarios as well.
- RockyMcNuts 10y agoTrace the funds to where? an Internet cafe in an ex-Soviet nation where they were split up into smaller amounts to be put in cold storage? then what, when those smaller amounts start being used to buy gold 5 years later? Isn't the whole point of Bitcoin that any transfer is irreversible, and it's hard for authorities to interfere and regulate, unlike say USD?
- dangero 10y agoThe question was about blockchain not bitcoin, so I'm assuming the correlary is a private shared blockchain used to replace SWIFT between a consortium of banks. Bitcoin would not make sense as a SWIFT replacement because it's completely public. Banks have no interest in showing their balance sheets to the general public.
- lifeisstillgood 10y agoWow. tl;dr - the recent SWIFT / Bangladesh heist has been followed from outside by BAE systems of all people and they analyse some malware. It reminds me little more than what I would expect a (malicious) set of scripts developed by a good inhouse IT team to look like as they solve some MIS problem. It's that custom-built. The main .exe replaces the eponymous two bytes in the swift system, preventing it from executing code if a check fails (presumably a swift authorisation check to access the underlying Oracle DB). This is a JNZ instruction in the target application and even I remember this one. Then there is code dealing with SQL statements, so it can both delete malicious swift instructions from the local database and inject its own(?) and even tampers with the local printer to delete confirmation messages (where presumably hard copies of each transaction as printed). The actual printer model is it seems hard coded in the attackers toolkit. This has several lessons, firstly if you have something valuable someone will really work hard to attack you specifically. Second there is really no excuse anymore not to move every OS over to randomised memory location access, and more. But even so I am not convinced this would help here. The specificity of the attack is incredible. Lastly, Already modern software development seems to be about duct taping together other people's code and stopping once it "works". The cost of developing secure systems is way beyond the cost of developing "works on my machine" systems, and that cost needs to be raised at a business level as an insurance premium. Then we can make sensible trade offs. Not sure there is a 961M dollar trade off but still.
- matheist 10y agoSecond there is really no excuse anymore not to move every OS over to randomised memory location access, and more. But even so I am not convinced this would help here. It might make it harder... but in this case couldn't an attacker search the entire address space for the location of the library? ASLR protects against buffer overflows as an attack vector, but here the attacker already has access. (I'm no expert and would appreciate correction.)
- lifeisstillgood 10y agoTo be honest the attack space for 2 malicious bytes in a system of phones, routers, servers and applications consisting of what, trillions of bytes of code, is so mind bogglingly huge that even the experts arent experts. At some point we need to go back to secure kernels only a few thousand lines long and they ddole out permissions and access - making all attack vectors ridiculously harder. Can we do it? Will Facebook hand over its billions to the project? Will anyone?
- known 10y agoBest I read in HN till date;
- known 10y agoIs there no audit system ?
- chillydawg 10y agoPrinter! :D
- metaphor 10y ago> ...but the main focus of the report will be on 525a8e3ae4e3df8c9c61f2a49e38541d196e9228 as this is the component that... Apparently, evtdiag.exe was irreparably ambiguous. =|
- willvarfar 10y agoHow can the user install software on a node authorizing payments? Once they do that, why can the Trojan read/write code? Very shoddy terminal security :( We can guess that the Bank of Banglesdesh uses not-locked-down Windows desktops to run their system.
- ianpurton 10y agoYou guessed wrong.
- jaytaylor 10y agoInteresting that this has been previously submitted five times and only caught on now.
- djmips 10y agoThat looks easier than cracking games!
- jbverschoor 10y agoNot too impressed by the NOP. But loving the print job :)
- adriancooney 10y agoI love these write ups! Does anyone know where I can find more like this and disclosures (like the Hacking Team)?
- damian2000 10y agoSome get posted here ... https://www.reddit.com/r/malware https://www.reddit.com/r/malware
- firasd 10y agoI just finished reading this: The Hack at ShapeShift http://moneyandstate.com/looting-of-the-fox/ http://moneyandstate.com/looting-of-the-fox/
- madaxe_again 10y agoWait, is this write up by BAE systems, as in British aerospace engineering? If so, I'm scratching my head, as it appears they do have knowledgeable infosec people, but their security is laughable. Anyone want schematics and parts lists for anything they make? There's an email address you can send a message to that will respond with them. All plain-text, no validation. The attitude that good security costs trillions and is therefore unattainable is all pervasive.
- r0xz 10y agoThis write up is from their cyber division, which is separated from the main aerospace business.
- ShinyCyril 10y ago> Anyone want schematics and parts lists for anything they make? There's an email address you can send a message to that will respond with them. All plain-text, no validation. Could you expand on this?
- sipos 10y agoHow valuable are the designs to most military parts though? If I am a government looking to buy cruise missiles (for example), do I really care if lots of people have the design? What I care about is whether a company will sell to me, how much it will cost to get the number I want made, whether they can continue to support them and, continue to produce them at the rate I want. Sure, there are some technologies that I want to not be leaked to allies where significant parts of how they work aren't public knowledge (stealth material/coating composition maybe?) but, it is only those that I would actually care about being secret, if I was a government/military buying hardware. If it isn't hard to figure out, I'd rather it was easy to access the knowledge so my engineers/technicians can get access. BAE Systems are a significant weapons manufacturer. Sorting security 'problems' like the one you are describing isn't that expensive so, if it was bothering their clients, you'd think they would do it. It is more plausible that they just don't care that the this information is so easy to access because it is easier either for them or their clients.
- nickpsecurity 10y ago
- Paul_S 10y agoThe world banking system runs on windows? Of all things in that article this was most surprising to me.
- nickpsecurity 10y agoMostly run on IBM mainframes. Some run on Windows. Only thing that saves former is investment required to learn to hack it plus arcane controls/procedures encoded in it. It's why attacks are often inside jobs at least partly.
- Drdrdrq 10y agoSerious question: what OS should it run on? I agree that Windows is a bad choice but other options are not much better as far as security (for this kind of attacks) is concerned... Are they?
- Retric 10y agoBSD UNIX can be good from a security standpoint. But, there are also OS out there written from the ground up to be secure.
- Drdrdrq 10y agoSure, but this attack modified local binaries so that they performed operations for attackers. How do you fight that?
- Retric 10y agoThe short answer is to only run signed binary's and or not allow new code at all. How to manage that while maintaining flexibility and minimizing costs ends up getting really complex. But, really there is a long continuum between say a personal blog at one end and an ICBM at the other. IMO, the banking system is at the high end of that scale.
- Arwill 10y agoI would say a cross-platform kernel, and the business logic running in a virtual machine, like Java. That combined with a hardware encryption module. Much of what that article is about, their software relies on Oracle DB for just about everything.
- Bromskloss 10y ago> we’ve recently identified tools uploaded to online malware repositories Why were they uploaded there, and where are said repositories?
- anothermoron 10y agoI guess they meant that the tools were uploaded to website like virustotal.com to test if they pass most antivirus check.
- rubyfan 10y agonop strikes again! many a cracked shareware have fallen to this simple trick
- jokoon 10y agoWow, they even knew the model of the printer?
- fareesh 10y agoIf this is not an inside job I'd be extremely impressed and interested to hear how they did it.
- tonmoy 10y agoControl flow guard (http://research.microsoft.com/pubs/64250/ccs05.pdf http://research.microsoft.com/pubs/64250/ccs05.pdf [2005]) could have prevented this attack. I think most modern programs use stack guards, so this should not be too hard to include either.
- userbinator 10y ago"CFI requires that, during program execution, whenever a machine-code instruction transfers control, it targets a valid destination, as determined by a CFG created ahead of time." That wouldn't do anything for this. If you can change arbitrary bytes of the binary and have it execute, you can rewrite the whole thing, including patching out all these extra checks too.
- Steeeve 10y ago> This malware was written bespoke for attacking a specific victim infrastructure, Nothing in the post indicates that it was specific to a single victim. The JNZ update was something everyone used to do to get rid of nag screens in shareware. I'd be very surprised if there wasn't a generic utility for extracting the locations of the right bits at this point, but either way it's a simple process for finding them. Going after the print files just indicates familiarity with SWIFT and PCL. It doesn't actually look like a particularly clever attack to me, at least not from what's in this article. Very basic security mitigations would have prevented it. (Like validating oracle files)
- discardorama 10y ago"nroff_b.exe" ?!? Did these guys really have to drag nroff into this?? Better look for an old-school Unix hacker.
- webXL 10y ago"Many pieces of the puzzle are still missing though: how the attackers sent the fraudulent transfers; how the malware was implanted; and crucially, who was behind this." Well, we have a clue for piece #2: "... sends result to attacker domain over HTTP" How the hell does that happen in this day and age? You trust any traffic coming out of your network??