4 ms·

Im surprised that this attack on a govt entity was successful. In such entities, every vendor record is a database entry in some legacy custom CRUD system, whic

Im surprised that this attack on a govt entity was successful. In such entities, every vendor record is a database entry in some legacy custom CRUD system, which require 5 different people to approve X record update. Each of those people also have their own checklist of things to do prior to approval, one of which is literally pick up phone and confirm with vendor the X update. Govt has a reputation for not being agile - but maybe the scammers have identified a niche in city agencies? Now im wondering how many of these have never been reported on...

atdrummond 5y ago
I know of multiple municipalities (Illinois in this case) where there's a single point of failure for these kind of attacks. I am sure there are quite a few of these cases that never get reported to the public, especially after my experience with the quality of many of the audits that smaller and mid-size communities go through.
- csharpminor 5y ago
  And it’s especially easy to fake invoices since most local govs need to publicly post contracts and contract value. I wonder if there is some phishing going the vendor’s direction as well where the city requests to review the next invoice. It’s truly amazing to me that you can completely lose your money in an ACH transaction with little to no recourse.
MattGaiser 5y ago
I am an ex municipal employee. Procedures are often just blindly checked through. The paperwork for the procedure often exists and is filled out, but the procedure itself is often not conducted.
fortran77 5y ago
The episode 111 of "Darknet Diaries" describes how Bullitt County, KY was hacked. 25 people were added to their payroll system and paid! They did it with a "man in the browser" attack so the transactions didn't raise red flags: https://darknetdiaries.com/transcript/111/ https://darknetdiaries.com/transcript/111/ Multiple people needed to sign off on these transactions, and the attackers were able to fake that once they had remote control of the browsers.
throwaway0a5e 5y ago
Those 5 different people don't understand the big picture and even if they do they likely don't care (and probably have been burned from caring in the past). Getting comically insane stuff (like a 400k transfer to a scammer) to actually happen is way easier when everyone exists in "I just stamp the form if all the fields are filled out, checking what's in the fields is the next guy's job" type silos.
- wccrawford 5y ago
  And there's a good chance that many of them think "Oh, the other 4 will catch it if I don't, so it's not a big deal." Adding a committee to something doesn't make it automatically smarter.

atdrummond 5y ago

I know of multiple municipalities (Illinois in this case) where there's a single point of failure for these kind of attacks. I am sure there are quite a few of these cases that never get reported to the public, especially after my experience with the quality of many of the audits that smaller and mid-size communities go through.

csharpminor 5y ago
And it’s especially easy to fake invoices since most local govs need to publicly post contracts and contract value. I wonder if there is some phishing going the vendor’s direction as well where the city requests to review the next invoice. It’s truly amazing to me that you can completely lose your money in an ACH transaction with little to no recourse.

MattGaiser 5y ago

I am an ex municipal employee. Procedures are often just blindly checked through. The paperwork for the procedure often exists and is filled out, but the procedure itself is often not conducted.

fortran77 5y ago

The episode 111 of "Darknet Diaries" describes how Bullitt County, KY was hacked. 25 people were added to their payroll system and paid! They did it with a "man in the browser" attack so the transactions didn't raise red flags: https://darknetdiaries.com/transcript/111/ https://darknetdiaries.com/transcript/111/ Multiple people needed to sign off on these transactions, and the attackers were able to fake that once they had remote control of the browsers.

throwaway0a5e 5y ago

Those 5 different people don't understand the big picture and even if they do they likely don't care (and probably have been burned from caring in the past). Getting comically insane stuff (like a 400k transfer to a scammer) to actually happen is way easier when everyone exists in "I just stamp the form if all the fields are filled out, checking what's in the fields is the next guy's job" type silos.

wccrawford 5y ago
And there's a good chance that many of them think "Oh, the other 4 will catch it if I don't, so it's not a big deal." Adding a committee to something doesn't make it automatically smarter.