3 ms·

Great write up and it certainly sounds like an inside job. I mean, it seems the authors of the malware had an incredible amount of insight into the entire SWIFT

by therein 10y ago

Great write up and it certainly sounds like an inside job. I mean, it seems the authors of the malware had an incredible amount of insight into the entire SWIFT platform anyway.

pedalpete 10y ago
I was thinking the same thing, then started wondering if the knowledge could have been gained by watching transactions and investigating code once you had access to the system. However they gained the knowledge, it is incredible.
meowface 10y ago
They believe at least one person helped the attackers. Odds are it was an outside criminal group that did the development, and bribed an employee.
sipos 10y ago
SWIFT is a very widely used (global) system, used by many many institutions. I imagine keeping the details of how it works secret is basically impossible.
- dogma1138 10y ago
  It's not kept secret the documentation is available more or less to the "public", so is the SDK. You can also register for training, I underwent SWIFT training and I never worked for a bank, I'm not sure how it was arranged but I doubt it that strict of a process. There are 100's if not 1000's online and offline providers for SWIFT training from training bank employees on how to use the software as end users through IT specialists which deploy the software to developers which build applications on SWIFT. To get a swift.com account you need to have details, name, institution code (BIC code for banks) and some additional details. SWIFT doesn't handle the authorization the institution you are registering on behalf does which means it's probably even more easier to phish/social engineer yourself in. Gaining access to swift.com credentials also shouldn't be that hard, especially if have already compromised the bank's network or any of it's employees. To get access to the SWIFT documentation and other materials you also don't have to compromise your initial target which makes it even easier. Registration to SWIFT's "Mystandards" is open to the public completely which both gives you access to quite a bit of information as well as allows to you participate in discussion groups which may lead to a few more vectors for social engineering.
dogma1138 10y ago
SWIFT documentation is available. There are tons of IT workers familiar with SWIFT, I've tested SWIFT GW implementations at at least 10 institutions, Registering for SWIFT training is easy enough, especially in developing countries where verification can be harder achieve. https://www.swift.com/our-solutions/services/training?AKredir=true https://www.swift.com/our-solutions/services/training?AKredi... Gaining access to swift.com through either "proper" registration or phising will get you access to the SWIFT SDK as well as tons of other material. So no sorry but to me and to anyone else who's even remotely familiar with how shitty SWIFT and usual banking internal security is, it doesn't sound like an inside job, just a job well done.
- breakingcups 10y ago
  Did I read it correctly that the malware had the name of the printer embedded in it? The sentence 'The PCL language used specifies the printer model, which is "HP LaserJet 400 M401"' seems to suggest it did. This strongly points to an inside job, but does not exclusively prove it.
  - dogma1138 10y ago
    No it only shows they've done their homework. Allot of the "security" of banking processes is based on human verification often via phone, fax, printing etc. so it's not surprising that they've compromised the printing process because that would flag the transactions immediately as the process mandates for the printout to be reviewed (and usually singed, and then filed with compliance). If you can present an all clear signal to the bank staff at all the immediate human readable interfaces no one would notice, at best the fraudulent transactions would be detected 30+ days down the line when the banks perform account consolidation. This is a good post about how money moves around between banks https://gendal.me/2013/11/24/a-simple-explanation-of-how-money-moves-around-the-banking-system/ https://gendal.me/2013/11/24/a-simple-explanation-of-how-mon... it doesn't go into payment/messaging systems (i.e. SWIFT) too much which is a good thing but it does explains how bank handle and settle transfers. SWIFT is a glorified messaging service for banks, that's how it started, today allot of "out of the box" applications have been developed on it but in it's core SWIFT is just a trusted network that enabled it's members to securely transfer messages between each other, these messages often end up being used to facilitate transactions but they aren't what actually moves money around.

by therein 10y ago

Great write up and it certainly sounds like an inside job. I mean, it seems the authors of the malware had an incredible amount of insight into the entire SWIFT platform anyway.

pedalpete 10y ago

I was thinking the same thing, then started wondering if the knowledge could have been gained by watching transactions and investigating code once you had access to the system. However they gained the knowledge, it is incredible.

meowface 10y ago

They believe at least one person helped the attackers. Odds are it was an outside criminal group that did the development, and bribed an employee.

sipos 10y ago

SWIFT is a very widely used (global) system, used by many many institutions. I imagine keeping the details of how it works secret is basically impossible.

dogma1138 10y ago
It's not kept secret the documentation is available more or less to the "public", so is the SDK. You can also register for training, I underwent SWIFT training and I never worked for a bank, I'm not sure how it was arranged but I doubt it that strict of a process. There are 100's if not 1000's online and offline providers for SWIFT training from training bank employees on how to use the software as end users through IT specialists which deploy the software to developers which build applications on SWIFT. To get a swift.com account you need to have details, name, institution code (BIC code for banks) and some additional details. SWIFT doesn't handle the authorization the institution you are registering on behalf does which means it's probably even more easier to phish/social engineer yourself in. Gaining access to swift.com credentials also shouldn't be that hard, especially if have already compromised the bank's network or any of it's employees. To get access to the SWIFT documentation and other materials you also don't have to compromise your initial target which makes it even easier. Registration to SWIFT's "Mystandards" is open to the public completely which both gives you access to quite a bit of information as well as allows to you participate in discussion groups which may lead to a few more vectors for social engineering.

dogma1138 10y ago

SWIFT documentation is available. There are tons of IT workers familiar with SWIFT, I've tested SWIFT GW implementations at at least 10 institutions, Registering for SWIFT training is easy enough, especially in developing countries where verification can be harder achieve. https://www.swift.com/our-solutions/services/training?AKredir=true https://www.swift.com/our-solutions/services/training?AKredi... Gaining access to swift.com through either "proper" registration or phising will get you access to the SWIFT SDK as well as tons of other material. So no sorry but to me and to anyone else who's even remotely familiar with how shitty SWIFT and usual banking internal security is, it doesn't sound like an inside job, just a job well done.

breakingcups 10y ago
Did I read it correctly that the malware had the name of the printer embedded in it? The sentence 'The PCL language used specifies the printer model, which is "HP LaserJet 400 M401"' seems to suggest it did. This strongly points to an inside job, but does not exclusively prove it.
- dogma1138 10y ago
  No it only shows they've done their homework. Allot of the "security" of banking processes is based on human verification often via phone, fax, printing etc. so it's not surprising that they've compromised the printing process because that would flag the transactions immediately as the process mandates for the printout to be reviewed (and usually singed, and then filed with compliance). If you can present an all clear signal to the bank staff at all the immediate human readable interfaces no one would notice, at best the fraudulent transactions would be detected 30+ days down the line when the banks perform account consolidation. This is a good post about how money moves around between banks https://gendal.me/2013/11/24/a-simple-explanation-of-how-money-moves-around-the-banking-system/ https://gendal.me/2013/11/24/a-simple-explanation-of-how-mon... it doesn't go into payment/messaging systems (i.e. SWIFT) too much which is a good thing but it does explains how bank handle and settle transfers. SWIFT is a glorified messaging service for banks, that's how it started, today allot of "out of the box" applications have been developed on it but in it's core SWIFT is just a trusted network that enabled it's members to securely transfer messages between each other, these messages often end up being used to facilitate transactions but they aren't what actually moves money around.