8 ms·
What if financial systems were hacked
- elgabogringo 10y ago$100M theft from the central bank already this year: https://en.wikipedia.org/wiki/2016_Bangladesh_Bank_heist https://en.wikipedia.org/wiki/2016_Bangladesh_Bank_heist
- ktRolster 10y agoThat is mentioned in the article.
- bwilliams18 10y agoAnd all that took were a few faxes.
- ktRolster 10y agoA lot of financial systems are running COBOL on mainframes (which can look very pretty, check out the z13: https://www.google.com/search?q=z13&tbm=isch https://www.google.com/search?q=z13&tbm=isch ) There was a talk last year at DefCon that went over mainframe vulnerabilities, and it was like a playground. The biggest barrier to entry is getting a mainframe to experiment with.
- padiyar83 10y agoThis reminds me of an article on wired[1] where someone hacked into hosts that were hooked into legacy X.25 networks. And just like mainframes and COBOL, there are not very many engineers who understand X.25 networks today, and hence had a very relaxed security posture. [1] https://www.wired.com/2016/05/maksym-igor-popov-fbi/ https://www.wired.com/2016/05/maksym-igor-popov-fbi/
- voltagex_ 10y agoThank you for that article. It's fantastic - I'm assuming you also read KrebsOnSecurity? There are similar kinds of stories there.
- jacobwcarlson 10y ago> The biggest barrier to entry is getting a mainframe to experiment with. Is there a barrier to emulating these systems? It's probably difficult (illegal?) to emulate the various Tandem operating systems on virtual hardware, but I'm sure there's a way. I'd be shocked if there wasn't a turnkey AS/400 VM available.
- rollthehard6 10y agoIt's trivial to emulate old versions of z/OS, have a look at Hercules - http://www.hercules-390.org/ http://www.hercules-390.org/ Not sure about OS/400 (IBM i) emulation, but you can get accounts to play with it seems - http://stackoverflow.com/questions/3487895/as400-emulator-or-virtual-machine http://stackoverflow.com/questions/3487895/as400-emulator-or...
- partycoder 10y agoWell that's another motivation for them to move to a blockchain based thing.
- ktRolster 10y agoWon't help if the software has bugs.
- atemerev 10y agoOnce you are there, it is usually an open playground. These systems, however, are usually not on open networks and only pre-whitelisted connections are allowed.
- Animats 10y agoTransactions should be logged to something that can't be tampered with. Then you can go back and recover state by re-running transactions. Sarbanes-Oxley tries to require this, and it produced a boom in write-once media, such as DVD writers. There are also DAT tapes and even disks with controllers which supposedly enforce write-once. It's not clear how good compliance with this actually is.
- tekklloneer 10y agoThere's this tricky edge between "compliant" and "correct". I could build "a box" that takes files and only lets you add new versions, but ultimately it can't enforce me removing its drives and manually editing them. In other words, the compliance level is actually pretty good, but the solutions themselves are weak and not hardened against intent (just normal operating use).
- vog 10y ago> Transactions should be logged to something that can't be tampered with. Then you can go back and recover state by re-running transactions. I believe the technical term for this pattern is Event Sourcing. See also: http://martinfowler.com/eaaDev/EventSourcing.html http://martinfowler.com/eaaDev/EventSourcing.html Event Sourcing describes everything of such a system, except for a mechanism to ensure non-tempering. That's where other technologies such as regularily published hash values come into play - which may be printed in newspapers, cryptographically signed by multiple trusted organizations, agreed on through some blockchain technoloy, or a combination of all.
- nickpsecurity 10y agoThe technical terms are "audit logs" written to "append-only" storage on "write-once, read-many" media. What we've used for a decade or so. I know Fowler is popular but unrelated to the basics of this discussion.
- vog 10y agoI don't get your point. > What we've used for a decade or so. The linked Fowler article is from 2005, which is also more than a decade old. > Fowler is [...] unrelated to the basics of this discussion While Event Sourcing doesn't describe audit logs and storage systems, it does describe how to build a whole working system based solely on that, with real-world experience warnings about pitfalls and so on.
- ittekimasu 10y agoBitcoin rises; Fiat burns.
- easuter 10y agoHaha! I'll take bitcoin seriously once it can actually process a useful number of transactions without choking.
- atemerev 10y agoIt does now. 30 minutes is much better than a day for bank transfer.
- laichzeit0 10y agoHe's probably referring to the current maximum transaction rate due to 1MB block size limit. https://en.bitcoin.it/wiki/Maximum_transaction_rate https://en.bitcoin.it/wiki/Maximum_transaction_rate
- pepesza 10y agoThose will be addressed with Lighting Network [0]. ATM there are ~4 implementations of the concept. None is complete/mature yet. [0] - http://lightning.network/ http://lightning.network/
- easuter 10y agoAnd they're all vaporware as far as I'm concerned until they're actually widely adopted and actually work as advertised.
- easuter 10y agoYep this is what I'm referring to. And an 8 MB block size still won't resolve the problem. It's really tiring to see bitcoin promoted as some sort of second-coming-of-Christ when all evidence points to it being nothing more than an interesting experiment.
- atemerev 10y agoI work in finance. Our systems are as shitty as any other industry, security problems are there, and social engineering is a problem. However, there is one simple rule which allows us to worry less about possible hacks, and when this rule is broken for some reason, shit usually hits the fan (like in the case of Bangladesh heist). The rule is: it always should be possible to manually reverse the transaction. Ethereum got it right. Welcome to the real finance.
- repomies691 10y ago> Ethereum got it right. Welcome to the real finance. Well, ethereum classic fork seems to be still alive, and many exchanges are considering adding it. So, it was reversable, but the work and the after-effects were pretty big. The reversability in older systems is pretty much easier.
- eximius 10y agoThat seems like an awful idea. If that happens, I'll just dump my currency on whichever one I don't want to live. Others will do the same.
- amelius 10y ago> The rule is: it always should be possible to manually reverse the transaction. In a financial transaction there are two parties, and both must agree to a reversal. Especially if you want to reverse thousands of transactions. Unless there are special circumstances. But in no way will it always be possible to manually reverse a transaction.
- clentaminator 10y agoEven if one of those parties is out to commit fraud and would never agree to a reversal?
- JumpCrisscross 10y agoThere are lots of parties to any financial transaction. Transfer agents, exchanges, clearing houses, regulators, central banks, et cetera. Various combinations of the above, along with banks and the "buyer" and the "seller", can reverse transactions.
- emn13 10y agoI think the underlying issue here is that responsibility for preventing these attacks is misplaced. In short: we need to blame the victim. There's a popular notion to "not blame the victim" when it comes to many other crimes (e.g. rape). Because long-standing culture traditions or implicit biases can be involved, it's not almost glaringly obvious that somebody is blaming the victim. As such, it's become a kind of litmus test: you look for warning signs that some policy or statement is (even unintentionally) laying the blame on the victim. And that habit is easily transferred to new misconduct, such as hacking. I think we need to step back and understand why we should not blame the victim for other crimes: I'd argue it is not because they're already suffering, but because the best way to prevent the problem is by focusing on (A) those we can influence and (B) those best placed to prevent the problem. Often that's not the victim - but sometimes it is. In many sex-crimes, the perpetrator is socially well-respected and in a position of power, so that's a (typically) a man that can be influenced (satisfies A), and since he's using his position of power he apparently has it; so he's well placed to prevent the problem (satisfies B). So for example, we might prosecute people breaking into cars. But most people realize that we're not likely to catch enough thieves to really reduce theftto a minimum, so we also invest in locks, and we teach people not to leave valuables in sight. This is a form of blaming the victim - justifiably so, since I'd argue that if you left your car unlocked and/or leave valuables in sight you're not just hurting yourself, you're hurting others too: you're making theft easy, and by making it worthwhile, you may encourage thieves to try more frequently - also against other targets. For another example, consider vaccination. Failure to vaccinate make cause the victim to become sick (or their kids to become sick). But here too, it's not just themselves they hurt; they hurt others by propagating dangerous diseases. Beyond a certain level, they'll contribute to epidemics that can hurt even the vaccinated since no vaccine is perfect. From the perspective of preventing harm, protecting yourself from malicious hacks is more like a cross between theft prevention and vaccines, and not like preventing rape by a powerful individual. Most hacks are trivially easy to prevent (it often takes numerous bugs, mis-designs, and some social engineering to gain access) if there were systematic effort to prevent hacks, so the victim is in a place to prevent the harm from occurring. And since it takes considerable organization to run most vulnerable services in the first place, the victim is also one we can influence. Focusing on the hackers isn't just futile, it's actively harmful in several ways. Not only is it obvious that many hackers cannot currently be found, many are beyond the reach of law enforcement by virtue of living elsewhere (or at least, acting through not-entirely cooperative countries). So it's immediately apparent that's it's never going to suffice to focus on the perpetrators (they don't satisfy A: we can't influence them). But also, by focusing on the hackers, we help keep vulnerabilities secret. Would you rather be hacked by a script kiddy or by an unscrupulous competitor or hostile country? Hiding vulnerabilities rather than fixing them means that the vast majority of hackers that can never be caught simply have more targets. Additionally, by focusing on hackers, we draw attention away from those that can bear the responsibility to prevent hacks: the victims. And that lets them get off the hook too easily. Most companies suffer rather few consequences for running infrastructure that is, in essence, a public menace. And much like theft and vaccination examples, they hurt others by remaining vulnerable. When an organization is hacked, it affects not just it, but many others. In a data leak, most harm is usually suffered by those who's data is leaked, not by the company holding the data. And when financial infrastructure is hacked then it's not just the organization running it that is harmed, but in particular those that rely on it. In short: we need a sea-change. To really address the risks posed by hacking, we need to stop focusing on hackers, and instead blame the victim. By failing to defend themselves they are hurting themselves and others, and focusing on hackers is never going to work anyway (and indeed makes it less likely that vulnerabilities are discovered by non-malicious or mildly malicious actors rather than those really motivated and out to get you).
- JumpCrisscross 10y ago> But if this happens to many banks concurrently, and nobody understands why, would central banks be able to save the situation? Why not? If we restrict ourselves to sovereign, first world central banks (i.e. the Fed, the BoE, the ECB, et cetera), a bank holiday (to reconcile records) followed by a liquidity injection would not only be expected, it would have direct precedent from FDR's bank holiday on 6 March 1933.
- jondubois 10y agoFinancial systems have been hacked since the beginning and now the hacking is getting worse. Regulations will make it progressively harder for newcomers to compete in the marketplace, executive pay will keep rising, corporations will get bigger. Owners of capital won't be able to trust outsiders so they will only recruit their family and close friends into well-paid executive positions. Advertising will completely dominate consumer behaviour; small businesses will disappear; once virtual reality takes over, corporations will make sure that customers forget that these small companies even exist. Machines will replace people in the workplace. The rich won't care because at that point; because of social tensions and advertising, rich people will have grown to literally hate the poor and want them dead.
- techdragon 10y agoYou know... This sounds awfully familiar. ;-)
- imglorp 10y agoHumor aside, the real crimes are the systemic from the top, like the Libor clowns, which will erase public trust at some point, which will cause the public go back to keeping money in mattresses. Fortunately there are some small wins, like these little fish going to jail: http://www.bbc.com/news/business-36737666 http://www.bbc.com/news/business-36737666 but we need to keep it up and restore accountability.
- wangchow 10y agoAt that point money won't be worth putting under mattresses but water and food will.
- ozim 10y agoIn The Netherlands they come up with oath: https://www.bloomberg.com/view/articles/2015-04-01/dutch-bankers-start-taking-an-oath-to-behave-better https://www.bloomberg.com/view/articles/2015-04-01/dutch-ban...
- jondubois 10y ago
- known 10y agoNot surprised http://cnbc.com/id/43471561 http://cnbc.com/id/43471561
- tmaly 10y agoI am surprised they did not mention the FDIC hack. This is dangerous stuff when a small hack can destroy peoples lives.
- infinite8s 10y agoDo you have any links/sources?
- Atwood 10y agoTPFAssembly uses sheet metal and scrap pallet guillotine. It is super effective.
- riskable 10y agoThe article talks about all these sophisticated attacks that could hurt the financial system but I think they're not seeing the elephant in the room: What if someone just ran "rm -rf /" on thousands of servers at just one of the "too big to fail" banks? How long would it take to recover from that? Would it even be recoverable? I don't think any of the big banks employ enough IT people to recover tens of thousands of servers in time to save the world's economies from a major collapse. Recovering from such a situation would take months. Not only that but let's assume they hire temporary contractors to do the work... Can you even vet that many people that quickly? You'll be handing these folks some of the world's most sensitive information. The Fed needs "IT stress testing" in addition to their balance sheet stress tests. They need to ask these sorts of questions: "If half your servers were deleted how long would it take to recover from backups?" "Demonstrate a backup recovery on the following ten randomly-selected servers right now. You have 8 hours. Good luck!"
- ocschwar 10y ago1. Offsite backups onto unpowered hardware are SOP for big banks. 2. Pretty much every transaction with the bank has a counterparty that is outside the bank. It would be recoverable. But very very painful.
- trequartista 10y agoHaving worked at 2 of these "too big to fail" banks, disaster recovery testing is par for the course now. We would do DR testing every quarter on both the primary and secondary data centers. Common simulation scenarios were - network/disk failures in which case the secondary data center would take over the operations. We would also time how long it took for applications to come back up, with high priority apps (trading, payment etc) being given extreme importance.
- kemiller2002 10y agoWe did this too. We tested our DR plan at least once every year (this included busing people to a different location, timed responses etc.), and we were considered a non essential part of the bank. We also had to make sure that all our servers had dual power supplies, and were attached to diesel generators in case of a power outage. They were much more on top of it than any other place I worked.
- rbcgerard 10y agoAs an someone on the outside, I would imagine the OCC, DTCC or some other clearing house getting hacked as creating far more havoc? Any reason this wouldn't be the case? http://www.dtcc.com/ http://www.dtcc.com/ http://www.theocc.com/ http://www.theocc.com/
- gmarx 10y agoReturn to gold standard and have process for rolling back transactions if the gold doesn't match