5 ms·

This seems like a technology problem, not a personnel problem. There should be more checks in a system when you are changing bank accounts where so much money i

This seems like a technology problem, not a personnel problem. There should be more checks in a system when you are changing bank accounts where so much money is going to be deposited.

swoorup 8y ago
Really? It is pretty obvious that it is social engineering. Can't you check the email domain?
- sjroot 8y ago
  From the article: the email was spoofed to appear to be from the building company.
  - bt3 8y ago
    You can see in the screenshot (scan of the email) it was a low-tech spoof. They simply bought the same domain with a different TLD (.com vs .us) There were many red flags that weren't caught, this being one of them.
    - sjroot 8y ago
      Yeah, there is a lot of UX work that could be done to address this. For example, a "HTTPS green lock" equivalent for ongoing email conversations.
thieving_magpie 8y ago
It's a multifaceted problem. Certainly a social engineering problem here. I think anyone that's ever seen how an ACH file works would agree there's room to improve on the technology side.
- paulie_a 8y ago
  I think anyone that has ever seen an ACH file and how it is transferred and processed should be amazed capitalism even exists.
danso 8y ago
Seems like it should be more of a process and personnel problem, and one that should account for the problem of social engineering. > As a result, one particular email, sent June 27, didn’t set off any alarms. Sent by a James Ellis of Clark Builders, a construction company working on the project, the email opened with the affable “Hiya” before asking the school’s accounts receivable department to reroute payments to a new National Bank of Canada account. The order to change bank accounts should not have been trusted without another factor of authorization, such as a phone call (from the CFO's office) or an in-person confirmation. Yes, a software solution could be implemented to enforce this process, but that doesn't seem worth the time or effort and provides yet another vector of attack. The university, being a public institution, likely already has a legacy system of paperwork and manual processes. It should be less work to enforce existing rules or add an old-fashioned verification step than to build a new software system. Especially for something as rare as changing bank account numbers. edit: at the end of the article, it seems that the university's solution has indeed been to go for old-fashioned verification: > Employees are now required to verify all changes to vendor files by phone and a followup email, and all financial changes must first be reviewed by a supervisor, manager or director. A supplied audit report system was also implemented, tracking every change made to vendor files. The university has made employee training in social engineering attacks, phishing and other online scams mandatory. I think the social engineering training is key, though. An employee could still follow the above rules and still be fooled, based on the letter used in the phishing attack: https://www.thestar.com/content/dam/thestar/edmonton/2018/10/09/how-a-fraudster-got-12-million-out-of-a-canadian-university-they-just-asked-for-it/_20181001141124982_1_.jpg https://www.thestar.com/content/dam/thestar/edmonton/2018/10... I'm assuming a supervisor or manager don't have a special ability to know the vendor's actual financial details, and thus a "review" may be little more than a rubber stamp. What's key is that the office person fielding the request not only use a second form of authentication -- such as a phone call -- but that they call the number as recorded on university file and not the phone number listed in the spoofed email.
- rahimnathwani 8y ago
  "such as a phone call (from the CFO's office)" Caller ID is trivial to spoof. What you want is a phone call to the CFO's office, not from.
aaroninsf 8y ago
The "so much" part doesn't matter to the person doing the paperwork change. It's just numbers to them and what they do between lunch and leaving. One small part of why the social hack worked well.
rwmj 8y ago
This scam has been going on in the UK for a few years. It's called "authorised push payment (APP) fraud". Typically you're having some building work done (or any other large project or purchase), and an email will arrive from the builder saying they've changed their account details, could the purchaser please send future bank transfers to the new account. Of course the email is fraudulent and usually happens because the builder has a virus on their computer (or even the customer). The problems are: * since cheques are no longer in widespread use, the only good way to send money is by a bank transfer to another account; in the UK these are free and nearly instantaneous * but every account is identified only by a 6 digit sort code and 8 digit account number[edit 1]; the numbers don't even have parity checking, forget about any sort of way to verify the destination account * complete insecurity of email and computers in general Finally, after years of foot dragging, the banks are promising they will introduce an "amazing" new feature, where before you do a bank transfer the name (I think surname only) of the account holder will be displayed. This should, when it finally arrives next year, prevent most of these frauds, although I guess the scammers will quickly adapt. The fraud: https://www.theguardian.com/money/2018/sep/25/uk-bank-customers-lost-500m-to-scams-in-first-half-of-2018 https://www.theguardian.com/money/2018/sep/25/uk-bank-custom... How the banks propose to solve it: https://www.psr.org.uk/psr-publications/consultations/APP-scams-report-and-consultation-Nov-2017 https://www.psr.org.uk/psr-publications/consultations/APP-sc... [edit 1] True story to illustrate what a shitshow this is: When I started working for my current company they asked for my 6 digit sort code and 8 digit account number to pay my salary in. However the first payment was bounced by the bank. When my employer checked with me, it turned out they had only entered the first 7 digits of my account number into the payments system. Surprisingly this was not an error. For example say my a/c number is 12345678, they entered 1234567, and the system assumed that meant 01234567 (this is a feature of all UK banks, not something to do with the payroll, because bank accounts are really just natural numbers, the first customer is given bank account number 1, etc.) Luckily the 01234567 account was dormant or closed so the payment was returned, otherwise several people would have had a bad day (and one person a good day).
- tacostakohashi 8y ago
  As much as people make fun of the widespread use of checks in the US, it actually seems much better for this use case, for at least two reasons: 1) the check will be handed over in person to someone you've met before, or at least mailed to a known postal address which is harder to spoof than email. 2) If you present a check for $12m to a bank, it will get the scrutiny it deserves, and won't clear immediately.

This seems like a technology problem, not a personnel problem. There should be more checks in a system when you are changing bank accounts where so much money is going to be deposited.

swoorup 8y ago

Really? It is pretty obvious that it is social engineering. Can't you check the email domain?

sjroot 8y ago
From the article: the email was spoofed to appear to be from the building company.
- bt3 8y ago
  You can see in the screenshot (scan of the email) it was a low-tech spoof. They simply bought the same domain with a different TLD (.com vs .us) There were many red flags that weren't caught, this being one of them.
  - sjroot 8y ago
    Yeah, there is a lot of UX work that could be done to address this. For example, a "HTTPS green lock" equivalent for ongoing email conversations.

thieving_magpie 8y ago

It's a multifaceted problem. Certainly a social engineering problem here. I think anyone that's ever seen how an ACH file works would agree there's room to improve on the technology side.

paulie_a 8y ago
I think anyone that has ever seen an ACH file and how it is transferred and processed should be amazed capitalism even exists.

danso 8y ago

Seems like it should be more of a process and personnel problem, and one that should account for the problem of social engineering. > As a result, one particular email, sent June 27, didn’t set off any alarms. Sent by a James Ellis of Clark Builders, a construction company working on the project, the email opened with the affable “Hiya” before asking the school’s accounts receivable department to reroute payments to a new National Bank of Canada account. The order to change bank accounts should not have been trusted without another factor of authorization, such as a phone call (from the CFO's office) or an in-person confirmation. Yes, a software solution could be implemented to enforce this process, but that doesn't seem worth the time or effort and provides yet another vector of attack. The university, being a public institution, likely already has a legacy system of paperwork and manual processes. It should be less work to enforce existing rules or add an old-fashioned verification step than to build a new software system. Especially for something as rare as changing bank account numbers. edit: at the end of the article, it seems that the university's solution has indeed been to go for old-fashioned verification: > Employees are now required to verify all changes to vendor files by phone and a followup email, and all financial changes must first be reviewed by a supervisor, manager or director. A supplied audit report system was also implemented, tracking every change made to vendor files. The university has made employee training in social engineering attacks, phishing and other online scams mandatory. I think the social engineering training is key, though. An employee could still follow the above rules and still be fooled, based on the letter used in the phishing attack: https://www.thestar.com/content/dam/thestar/edmonton/2018/10/09/how-a-fraudster-got-12-million-out-of-a-canadian-university-they-just-asked-for-it/_20181001141124982_1_.jpg https://www.thestar.com/content/dam/thestar/edmonton/2018/10... I'm assuming a supervisor or manager don't have a special ability to know the vendor's actual financial details, and thus a "review" may be little more than a rubber stamp. What's key is that the office person fielding the request not only use a second form of authentication -- such as a phone call -- but that they call the number as recorded on university file and not the phone number listed in the spoofed email.

rahimnathwani 8y ago
"such as a phone call (from the CFO's office)" Caller ID is trivial to spoof. What you want is a phone call to the CFO's office, not from.

aaroninsf 8y ago

The "so much" part doesn't matter to the person doing the paperwork change. It's just numbers to them and what they do between lunch and leaving. One small part of why the social hack worked well.

rwmj 8y ago

This scam has been going on in the UK for a few years. It's called "authorised push payment (APP) fraud". Typically you're having some building work done (or any other large project or purchase), and an email will arrive from the builder saying they've changed their account details, could the purchaser please send future bank transfers to the new account. Of course the email is fraudulent and usually happens because the builder has a virus on their computer (or even the customer). The problems are: * since cheques are no longer in widespread use, the only good way to send money is by a bank transfer to another account; in the UK these are free and nearly instantaneous * but every account is identified only by a 6 digit sort code and 8 digit account number[edit 1]; the numbers don't even have parity checking, forget about any sort of way to verify the destination account * complete insecurity of email and computers in general Finally, after years of foot dragging, the banks are promising they will introduce an "amazing" new feature, where before you do a bank transfer the name (I think surname only) of the account holder will be displayed. This should, when it finally arrives next year, prevent most of these frauds, although I guess the scammers will quickly adapt. The fraud: https://www.theguardian.com/money/2018/sep/25/uk-bank-customers-lost-500m-to-scams-in-first-half-of-2018 https://www.theguardian.com/money/2018/sep/25/uk-bank-custom... How the banks propose to solve it: https://www.psr.org.uk/psr-publications/consultations/APP-scams-report-and-consultation-Nov-2017 https://www.psr.org.uk/psr-publications/consultations/APP-sc... [edit 1] True story to illustrate what a shitshow this is: When I started working for my current company they asked for my 6 digit sort code and 8 digit account number to pay my salary in. However the first payment was bounced by the bank. When my employer checked with me, it turned out they had only entered the first 7 digits of my account number into the payments system. Surprisingly this was not an error. For example say my a/c number is 12345678, they entered 1234567, and the system assumed that meant 01234567 (this is a feature of all UK banks, not something to do with the payroll, because bank accounts are really just natural numbers, the first customer is given bank account number 1, etc.) Luckily the 01234567 account was dormant or closed so the payment was returned, otherwise several people would have had a bad day (and one person a good day).

tacostakohashi 8y ago
As much as people make fun of the widespread use of checks in the US, it actually seems much better for this use case, for at least two reasons: 1) the check will be handed over in person to someone you've met before, or at least mailed to a known postal address which is harder to spoof than email. 2) If you present a check for $12m to a bank, it will get the scrutiny it deserves, and won't clear immediately.