15 ms·
Hackers Breached Virginia Bank Twice in Eight Months, Stole $2.4M
- readhn 8y agoVerizon has a cybersecurity unit that can be subcontracted by outside companies? Interesting. EDIT: http://www.verizonenterprise.com/products/security/ http://www.verizonenterprise.com/products/security/
- SteveNuts 8y agoIt's hilarious that they don't have a certificate on their domain.
- readhn 8y agoGood catch! I wonder why?
- theluketaylor 8y agoEvery big telco I've ever worked with will sell add on security including SOC and investigative services. *edit: the quality isn't necessarily the best
- qaq 8y agoIR people are in very high demand pretty hard for them to hire the best
- walshemj 8y agoWell my former employers BT hire Bruce Schneier I suspect the phone companies who are ex PTT / Civil Service might well have better teams. Certainly BT security had a bit of a rep - not always in a good way :-)
- exabrial 8y agoInitial malware that came in through a Microsoft Word Document... It's 2018 and everything that is old is new again
- daxorid 8y agoIt never got old. Phishing+macros+lateral movement are still a very significant vector. The industry exacerbates this by running with the feel-good "don't blame the user!" mantra. At some point you really do need to give up on your fancy canaries, gateway and host IDS, perimeter blinky boxes, threat intelligence feeds, endpoint protection products, etc, and just start firing those in your employ who willfully and joyously thumb their noses at basic security hygiene.
- lbotos 8y ago> and just start firing those in your employ who willfully and joyously thumb their noses at basic security hygiene. Until it's your top salesperson who 2x'd the quarterly revenue target... I'd like to live in a world where everyone knew basic security hygiene, but we have to teach it first, not punish.
- Severian 8y agoBut then it can be over emphasized, and no one in your organization trusts any links or attachments because of phishing. Then it all becomes a horrible mess of skype/slack IMs with the actual links to Sharefile or Dropbox shares. Then you wave goodbye to async communication because everytime someone sends you a hyperlink they _absolutely need_ to know if you were able to get the file...
- mannykannot 8y agoI have worked at financial companies where they get it right, and it is not a problem. Having crappy infrastructure and procedures is never an excuse for poor security.
- ecolonsmak 8y ago
- esseti 8y agowondering why i've to use 2fa (with a damn token) to access my inbank but there's no need of 2fa (on phone maybe?) to withdraw money from atm. PS: do they seriously have a system that can turn off the need of entering the pin to withdrwa money? why?
- michaelt 8y agoATM withdrawls are already two-factor - unless your ATM experience is very different to mine. You need the card (something you have, factor 1) and the PIN number (something you know, factor 2).
- islanderfun 8y agoI guess that is traditional 2fa that never occurred to me. Shouldn't we update that to include one-time passcodes like we do know for most things?
- icedchai 8y agoWe live in a tech bubble. Most people don't use one time pass codes for anything.
- paulcole 8y ago> include one-time passcodes like we do know for most things The only things I can think of that uses one-time passcodes are the occasional password reset or login from a new device? Are there other uses I'm not aware of?
- sumedh 8y ago> Shouldn't we update that to include one-time passcodes like we do know for most things? Some people I know are still not comfortable using an ATM, if you add passcodes they are going to have a very bad time.
- esseti 8y agoto add an addition OPT password, sent on the phone or something like that. however, if your system allows one to disable even the PIN code that's pointless.
- deleted 8y ago[deleted]
- slimshady94 8y ago$2.4M in 8 months doesn't seem a lot. They could have saved their effort by just doing an ICO.
- astura 8y agoThere were two distinct attacks (probably by the same persons) within an eight month time frame. Each attack took place over the span of a weekend.
- zokier 8y agoI would imagine that a heist like this would take significant amount of prep work. The weekends were just the tips of the icebergs. While $2.4M is fair chunk of money, I too think that the payout for the amount of effort seems relatively meager.
- darkstar999 8y agoI'm on the bank's side of the lawsuit based on what I read in this article. They were covered under "computer and electronic crime" insurance. If the hacks don't fall under that coverage, what would?
- swarnie_ 8y agoI've seen similar insurance claims invalidated because the company couldn't prove then had taken reasonable steps to prevent an attack. The fact there were two similar incidents 8 months apart tells me there was a fundamental security issue which wasn't addressed correctly.
- mattnewton 8y agoThat seems a bit like a catch 22 to me - if you get hacked enough, it must be your fault, so no payout.
- jrhurst 8y agoWait. How is this a catch 22? There is no. "In order to do Y you must first do X. But in order to do X you must first do Y"
- shawabawa3 8y agoIn order to get paid you must be hacked, in order to be hacked it must be your fault, if it's your fault you can't be paid
- fundingshovel 8y agoThat's not what this is staying at all though. It's saying "In order to get paid you must show you took reasonable precautions not get hacked AND get hacked." It's pretty hard to argue ignoring a known issue for 9 months is taking reasonable precaution. I don't see how that's any different then not paying when someone falls on because of broken steps you knew about and didn't fix, which would be pretty common.
- kevinconaway 8y agoWhat’s interesting to me about this is it seems like the hack still required physical presence to pull it off. The criminals had to actually visit hundreds of ATMs over the span of a holiday weekend to withdraw the cash I suspect it had to have been people in on the scam because I don’t see how you could conceivably convince strangers to withdraw cash for you at that scale without raising eyebrows
- jjeaff 8y agoIf a guy in an Indian call center can convince people that the IRS is about to have them arrested if they don't immediately pay their back taxes with iTunes gift cards, you can certainly convince people to withdraw money from an ATM and send it somewhere.
- jessaustin 8y agoIt seems more likely that the ATM withdrawers were just normal criminals already integrated into normal criminal organizations. Everybody gets a cut, but nobody takes too big a cut because violence and repeat business. Normal criminals love ATM stuff because it's quite low-risk.
- darkstar999 8y agoI wish we could learn more about that. The article said it was Russian IPs and tools, but that doesn't account for the local ATM activity. It also seems like you'd need a lot of domain knowledge to make this happen. If you gave me an open machine in a bank I'd have no idea what to do.
- zokier 8y agoThe article does touch on the matter: > The bank’s complaint against Everest notes that the financial institution doesn’t yet know for sure how the thieves involved in the 2017 breach extracted funds. In previous such schemes (known as “unlimited cashouts“), the fraudsters orchestrating the intrusion recruit armies of “money mules” — usually street criminals who are given cloned debit cards and stolen or fabricated PINs along with instructions on where and when to withdraw funds.
- dmix 8y ago> According to the lawsuit, in June 2018 Everest determined both the 2016 and 2017 breaches were covered exclusively by the debit card rider, and not the $8 million C&E (“computer and electronic crime”) rider Jeez, insurance companies are all the same. Regardless if you're an individual or a bank with millions on the line... you get treated with the same slight of hands and nonsense interpretations of reality. > those exclusions rules out coverage for any loss “resulting directly or indirectly from the use or purported use of credit, debit, charge, access, convenience, or other cards . . How could a spear phishing campaign using malware that hijacked critical parts of the banks infrastructure not be part of the C&E coverage, and merely 'debit and credit'. The last part was merely how the money was exfiltrated. But the entire crime was the result of the intrusion. This seems like an easy to win case to me. But who knows.
- kennxfl 8y agoThe incumbents in the insurance/banking industry will have to invest heavily in security and in some cases overhaul entire systems. Personally I think its more cost effective long-term than hiring a bunch of lobby groups and lawyers to find loopholes. I mean the Equifax security was laughable and no one got in trouble. I wouldn't be surprised if this case takes a complete 180 from common sense.
- javiramos 8y agoAre there objective audits or rankings where financial institutions are assessed for their cyber-security measures/infrastructure? How do I even know whether my bank has good security? Cyber-security being such a major threat, I would be willing to change banks if my bank is proven to have crappy online security.
- kennxfl 8y agoIf any exists, its by third parties who have no insight from the inside. Central banks wouldn't disclose 'cyber-security index' in stress tests due to the risk of scaring customers off or causing a bank run.
- jessaustin 8y agoIANAL, but this bank needs a better general counsel. The contract says "big payouts unless ATMs are involved, in which case small payouts". Sure, in order to draw out the court case longer than a day, they'll make some vaguely plausible argument to ignore the plain language of the contract. Still, it would have been so much better to realize ahead of time that "we're a bank, tied to an ATM network, so our insurance should cover the use of ATMs too!"
- deleted 8y ago[deleted]
- March_f6 8y agoAm pretty curious what kind of "skeleton key" ATM card they were using to access all of the ATM's as different users. Lest they were posed as repair people and stood there with a laptop hooked in.
- stuntkite 8y agoFrom what I've seen the attackers pay organized teams of people to do the withdrawals that wouldn't have a problem getting caught by the cops for a percentage. Load a stack of blank cards, then send out the squad.
- mi100hael 8y agoCould've been something like this: https://samy.pl/magspoof/ https://samy.pl/magspoof/
- raesene9 8y agoGenerally in these cases spoofed cards + access to back end system. They just look like ordinary customers from the ATM perspective.
- donarb 8y agoNo mention of what was done when the policy was sold. Most insurance companies do a check to minimize their liability. I would think that the insurance company would do a PCI and whatever other audits are used to verify security of the financial institution before writing a policy. An audit (and corresponding mitigation) would save the bank money on their insurance cost.
- ddalex 8y agoNo need to due diligence on a policy if you don't intend to ever honor it
- newnewpdro 8y agoIt's as if these systems don't emit an audit stream, which when combined with the least bit of monitoring would have set off all sorts of red flags during these obviously anomalous events. Such negligence tends to make me wonder if it's to leave open the possibility of some easy insurance fraud. In this particular case, that seems to have backfired with supposed hackers arriving first, and the insurer sleazily wiggling out of their own obligations. At a past job, we ran thousands of shared linux servers for web hosting purposes. This was back in the early 2000s, and even then we had replaced all the installed shells with versions logging all interactive commands via UDP to a centralized syslog server. There was a simple IRC bot filtering the logs and echoing suspicious stuff into an IRC channel we monitored. Things like attempts to gain root, looking at /etc/passwd, lines starting with "./", running known irc bouncers or other script kiddie activities would be clearly visible and someone would intervene. That was just a web hosting company with a small team and quite limited resources. I expect better from these national financial service providers, this is just pathetic.
- interlocutor 8y agoSome US financial institutions are incorporating cybersecurity disclaimers. Case in point: ETRADE. Just received an update to the customer agreement. The definition of “Force Majeure Event” (unforeseeable circumstances) was updated to include cybersecurity incidents. Also this: ETRADE ... makes no representation or warranty of any kind ... with respect to security.
- tantalor 8y agoEr, what about FDIC? The actual deposits are insured, right?
- jsoc815 8y agoIn the event of failures: FDIC insures deposits in U.S. branches up to $250k per account, IIRC; SIPC covers securities held by brokerages, (forget the amount).
- solotronics 8y agoBitcoin! nobody holds it but you and you can always transfer it no questions asked
- freeone3000 8y agoNo depositor lost any money in this case. The bank had trouble getting its insurance to pay up. If this was bitcoin, the money would be gone, because bitcoin does not have the same restrictive regulation scheme as united states dollars held in a united states bank.
- krageon 8y agoIf you store it in a long-term storage solution that makes sense (cold storage), it would not be "gone" because this wouldn't have happened.
- freeone3000 8y ago
- deleted 8y ago[deleted]
- deevolution 8y agoBullish on bitcoin.
- chris_mc 8y agoWhen do we kick Russia off of the internet? They seem to not care about being a hotbed of hacking, so why continue to allow their citizens to victimize the world?
- vkou 8y agoAs soon as we kick the NSA off the internet.
- radoslawc 8y agoMy friend, here's live cyber attacks map: https://threatmap.checkpoint.com/ThreatPortal/livemap.html https://threatmap.checkpoint.com/ThreatPortal/livemap.html it will help you ban more nationalities from internet. For example last week most frequent attack source for China is USA. Enjoy.
- dang 8y agoNationalistic battle is not ok here. Please do not post like this again. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- chris_mc 8y agoIt's not nationalistic since I was not "having strong patriotic feelings, especially a belief in the superiority of one's own country over others" per the definition of the word. I was asking "when is enough, enough?" That's not me trying to promote a certain nationality or nation, that's me saying, "Russia is acting like dicks, let's take away their ability to do so if they don't stop acting like dicks soon." In the end, it's probably not a good idea, anyways.
- williamscales 8y agoIt feels to me like the first incident should be covered and the second one should not. It doesn't seem fair to keep relying on insurance when you know you have a problem.
- dev_dull 8y ago> Verizon was hired to investigate the 2017 attack, and according to the bank Verizon’s forensics experts concluded that the tools and servers used by the hackers were of Russian origin Wow. One incompetent company leading another incompetent company. What could possibly go wrong? I don’t have hope for these types of companies. Their security is a joke. Their industry security is a joke.
- lovich 8y agoThey have zero incentive to do security. It costs them more money than the fines and since everyone in the industry is insecure, it's not like they lose much business either
- linkregister 8y agoThe security consultants that work for Verizon aren't the same folks that allowed the Yahoo/Oath credentials dump from half a decade ago. Verizon has a reputable security consulting arm that competes with Bishop Fox, FireEye, Rapid7, NCC Group, and other recognized computer security firms. Verizon is a massive company and isn't just wireless and home internet.
- Rjevski 8y agoHowever, I don't care how different or secure their security division is. If they're happy to run it under the Verizon brand they I will continue to assume they are incompetent monkeys and they deserve to loose business for this. Either up your security so Verizon is finally considered a credible brand, or spin the security business off as a separate entity.
- wattaman 8y agoI wish I knew how to do that
- robertyy 8y agoDo you know that you can hack any ATM machine !!! We have specially programmed ATM cards that can be used to hack any ATM machine, this ATM cards can be used to withdraw cash at the ATM or swipe, stores and outlets. We sell this cards to all our customers and interested buyers worldwide, the cards has a daily withdrawal limit of $5000 in ATM and up to $100,000 spending limit in it stores. We also have credit cards for online shopping, we give the credit cards details to our interested clients worldwide including the credit card cvv.if you are in need of any other cyber hacking services, we are here for you at any time any day. Here is our price list for ATM cards: BALANCE PRICE $2500 ----------------$200 $5,000----------------$300 $10,000 ------------- $650 $20,000 ------------- $1,200 $35,000 --------------$1,900 $50,000 ------------- $2,700 $100,000------------- $5,200 ,order now: via email...braeckmansj@outlook.com you can also text us with this icq number..743271928.