Hackers Hit SWIFT Software: How Treasurers Should Respond

[privateinvestors]

Hackers Hit SWIFT Software: How Treasurers Should Respond

By Andrew DeichlerPublished: 2016-04-25

Cybercriminals who stole $81 million from the Bangladesh central bank likely compromised SWIFT software that the bank was using, according to British defense contractor BAE Systems.

It is believed that the criminals hacked the Bangladesh central bank’s systems in February and stole credentials that it used to log into the SWIFT network. BAE told Reuters that the hackers likely used malware to manipulate SWIFT’s Alliance Access software on the bank’s computers in order to erase records of illicit transfers.

In a statement, SWIFT said that it has discovered malware that aims to reduce banks’ abilities to recognize fraudulent transactions on their local systems. “We understand that the malware is designed to hide the traces of fraudulent payments from customers’ local database applications and can only be installed on users’ local systems by attackers that have successfully identified and exploited weaknesses in their local security,” the statement read.

The SWIFT network and its core messaging services apparently were not breached. SWIFT is releasing a software update that will help users spot inconsistencies in their local database records. Nevertheless, the financial messaging network advised users to implement appropriate security measures in their local environments to safeguard their systems. “Such protections should be implemented by users to prevent the injection of malware into, or any misappropriation of, their interfaces and other core systems,” SWIFT said.

What does all of this mean for treasury?

Many organizations’ treasury management systems connect directly to SWIFT through Alliance Lite2. “Any corporates using Alliance Lite2, whether their TMS is installed or cloud-based, should make sure they have made the latest updates,” said Magnus Carlsson, AFP’s manager of treasury and payments. “Corporates should also check with their IT departments about the possible malware.”

Although her company is not a SWIFT user, Anita Patterson, CTP, treasurer for Cox Communications and an AFP board member, agreed that companies should make sure their treasury workstations are secure. “It’s almost like a domino effect—and it all depends on the defenses set up by treasury workstation companies to prevent as well as protection within one’s own company,” she said.

Craig Jeffery, CCM, managing director for Strategic Treasurer, commented that treasury groups need to think of security in terms of layers, and each layer must be tightly maintained. “If, for example, you have a gaping hole in your network security as reported in this case—no firewall, outdated network devices—you make it that much easier to target, degrade and destroy other areas of your security apparatus and control structure,” he said. “Every part of every security layer should at least attain the minimum standards of good corporate conduct. It is preferable to exceed those standards. When an organization is not regularly reviewing their perimeter, interior, banking structure, monitoring and personnel status there will be significant issues at some point. This is not a question of if.”

Jeffery added that it is easy to jump to conclusions about the Bangladesh Bank breach and miss what is important. “If the criminals are able to compromise your network, modify or control your environment and send instructions through your systems, it doesn’t matter how secure the bank system or SWIFT network is as they were able to compromise the system access point or human element in the equation,” he said. “For most organizations, it is absolutely vital to step up your defensive posture and undergo a regular review of all parts of your security and control layers. Things continue to change quickly which means that regularly means at least annually.”

Update, 4/16/16: SWIFT issued a confidential alert to its bank customers that it is aware of “a number of recent cyber incidents” in which criminals sent fraudulent messages across its network, Reuters reported. Although it did not name any banks, SWIFT said that “malicious insiders or external attackers” have been able to submit messages from banks’ back offices, PCs or workstations. SWIFT did not disclose the cost of any of the losses.

SWIFT also provided some insight into how the incidents occurred. Using valid credentials for operators who are authorized to create and approve messages, the attackers submitted fraudulent messages over the SWIFT network.

Cybersecurity experts told Reuters that as more of SWIFT’s banking clients investigate whether their own SWIFT access has been compromised, more attacks could surface. Banking security consultant Shane Shook said that hackers are turning to SWIFT and other private financial messaging platforms because the attacks generate more revenue than targeting consumers and small businesses.

With all the malicious activity, one has to wonder if corporate SWIFT users are also on the attackers’ hit list.

[congregatio]

sorry I do not buy that, only if the Central Bank has been very badly handling the procedure, because frankly they would have to tunnel through the server of the Central Bank itself to camouflage their IP and Mac Variant Addresses. In my book this was an in-house deal.

[privateinvestors]

Apr 27, 2016 0:50:20 GMT 4 congregatio said:

sorry I do not buy that, only if the Central Bank has been very badly handling the procedure, because frankly they would have to tunnel through the server of the Central Bank itself to camouflage their IP and Mac Variant Addresses. In my book this was an in-house deal.

Everything is possible.

Now days, most bankers are corrupted.

[privateinvestors]

SWIFTt goes on the offensive over Bangladesh central bank $81m heist

SWIFT network was never compromised, says financial messaging provider in a letter to users. Brian Caplen reports.

In the wake of the cyber attack on the Bangladesh central bank resulting in $81m of losses, there has been speculation as to how the robbery was carried out.

In a report on April 25, Reuters said: “Developments coming to light in the unprecedented cyber-heist suggest that a lynchpin of the global financial system [the Swift network] could be more vulnerable than previously understood because of weaknesses that enabled attackers to modify a SWIFT software program installed on bank servers.”

In a further report on May 9, Reuters reported: “Bangladesh's central bank became more vulnerable to hackers when technicians from SWIFT, the global financial network, connected a new bank transaction system to SWIFT messaging three months before a $81m cyber heist, Bangladeshi police and a bank official alleged.” In the same report, Reuters admitted it was not able to independently verify the allegations by Bangladeshi officials about the SWIFT technicians and SWIFT itself declined to comment.

Frustrated by some of the press reports and the failure of Bangladesh central bank to provide more details of the heist, SWIFT has sent a strongly worded letter to its users explaining its position. A copy of the letter has been obtained.

It begins: “Dear SWIFT user, We are writing in the wake of the recent incident, in light of the prolonged silence from the user concerned and the ongoing speculation regarding SWIFT. First and foremost, we wish to reassure you again that the SWIFT network and SWIFT messaging systems have not been compromised.”

The letter continues later: “From what we know of the incident in question, the attackers had good knowledge of the bank’s systems and their security procedures. Using that knowledge they were able to compromise the bank’s environment, access its core banking systems, generate messages, gain the credentials to the bank’s Alliance Access system [SWIFT software] and thereby send the fraudulent messages. How complex the compromise was, versus how weak the user’s security environment was, remains unknown. It is still also unknown whether the compromise and fraud were led or facilitated by malicious insiders, or managed remotely.”

SWIFT confirms press reports that the attackers used a piece of malware that targeted Bangladesh Bank’s Alliance Access system to “disguise the traces of the fraudulent messages”. SWIFT responded by issuing an update to its software even though it was aware that this could be misconstrued by competitors as network vulnerability.

The letter to users says: “Contrary to the inevitable public commentary, the update is not a patch; it does not repair a vulnerability in the software or its interconnectivity with the messaging system and it cannot prevent a user’s environment being compromised... the update simply assists Alliance users to protect their local environment by helping them identify whether attackers have attempted to wipe their traces at the interface level after having already compromised their environment and injected fraudulent messages.”

SWIFT goes on to make the point that any system is only secure if it is held in a secure environment. “SWIFT is not, and cannot, be responsible for your decision to select, implement (and maintain) firewalls, nor the proper segregation of your internal networks; we cannot be responsible for selecting your staff and the distribution of credentials and allocation of permissions among them; nor for implementing your security access mechanisms and ensuring their proper maintenance, nor for designing your other security systems and procedures,” it says.

[privateinvestors]

Swift finds evidence of second malware attack

Hackers have again gained access to the world’s largest system for transferring funds among banks, a breach the network’s operator said indicates a wide-ranging effort to penetrate the financial system.

The Society for Worldwide Interbank Financial Telecommunication, a cooperative that runs the international messaging system between banks, said the attack targeted a commercial bank and managed to send Swift messages using the bank’s valid codes. It followed the theft in February of $81 million from Bangladesh’s account at the Federal Reserve Bank of New York.

The Bangladesh case provided startling evidence of the vulnerability of parts of the financial system that had been thought highly secure.

The notice by Swift said in both cases its own system wasn’t breached but that hackers accessed the fund-transfer system using the customers’ credentials and malicious software to cover their tracks.

“Forensic experts believe this new discovery evidences that the malware used in the earlier reported customer incident was not a single occurrence, but part of a wider and highly adaptive campaign targeting banks,” Swift said in a notice to banks reviewed by The Wall Street Journal but set to go out on May 13.

A spokeswoman for Swift said there were a “few” additional incidents but declined to identify the other institutions involved. Belgium-based Swift recently notified customers about a “small number of recent cases of fraud at customer firms”, it said in the notice.

The new evidence in question, Swift said, was sophisticated malware that was found by third-party forensic experts, who brought their findings to the messaging company. The attack happened before the Bangladesh theft, a person familiar with the matter said.

That malware was different than that used earlier to attack Bangladesh’s central bank, it added. In February, thieves attempted to siphon nearly $1 billion out of the Bangladesh bank’s account at the New York Fed.

The bulk of the fraudulent payment orders were stopped, but the thieves made off with $81 million that still hasn’t been traced.

The two sets of malware used in the attacks had two things in common, the Swift notice said. One, the attackers exploited the customer’s systems before messages were sent over Swift’s platform. Secondly, the malware helped the attackers cover their tracks, making it more difficult to identify the fraud.

The newer one identified by Swift attacks a type of computer software for reading files in a “portable document format”, or PDF. The malware is able to read customers’ PDF reports of payment confirmations, manipulate them and then remove traces of any fraudulent instructions, Swift said.

The Wall Street Journal reported that the Federal Bureau of Investigation suspected insiders may have helped the attack on Bangladesh Bank, citing people familiar with the matter. Swift similarly emphasised the risk of malicious insiders in its note to banks.

Swift, a member-owned industry cooperative, handles the bulk of world-wide cross-border payment instructions between banks. On average, the company handles 25 million messages each day.

Banks and brokerages relay information to each other through its trusted computer network, confirming the identities of senders and recipients, amounts being transferred, account numbers and intermediary banks.

The breaches raise the prospect that the system isn’t fully secure.

In the case involving Bangladesh Bank, attackers issued 35 fraudulent instructions attempting to divert funds to accounts in the Philippines and Sri Lanka.

At a conference in Miami in May, New York Fed executive vice president Richard Dzina said the bank acted on properly authenticated message instructions.

News of the second breach was reported earlier on May 12 by the New York Times.