How I 'stole' $14 million from a bank: A security tester's tale

#4597474

3dPlayer

2013-05-16 08:20

Holy moly.Where do i start?! :banana:

#4597497

sverek

2013-05-16 09:15

Holy moly.Where do i start?! :banana:

1) Overall knowledge and weaknesses of Internet protocol suite 2) Knowledge of linux distributions (CentOS / Debian) 3) Can freely use MySQL / PostgreSQL / Microsoft SQL With knowledge of Internet protocol suite, you should be flexible at finding servers within and outside of network. 2 and 3 is needed when you got access to the server. It will be about gaining access to Database and insert / update records.

#4597599

scatman839

2013-05-16 12:36

Story is slightly cut off, here's the rest.

If he wanted to, he could have walked into any bank branch, transferred the money to an offshore account, and never have had to work again. Instead, he went to an ATM to print out a record of his ill-gotten wealth. "The bank executives were extremely surprised," Bhalla said. "Their faces were shocked." The bank promptly deleted Bhalla's bounty, he said, and took steps to shore up its network. In the heist that came to light last week, federal officials say the thieves hacked into networks at firms that process transactions for pre-paid debt cards and manipulated accounts to create high spending limits. From there, it was just a matter of making physical debt cards for those accounts and going around to ATMs to withdraw the cash. "They just updated the database with that debit-card information," Bhalla said. "That's how simple it was." In many cyber bank heists, including the recent $45 million scam, it's hard to pin down who is ultimately liable for any losses. It's typically not individual customers. U.S. law protects consumer checking and savings accounts from losses stemming from fraud. Business accounts, though, have fewer protections. Bhalla said some financial institutions have insurance to cover the losses -- but he noted that insurance companies are reluctant to issue policies with high coverage limits because the risks in this area area still poorly understood. In the end, he said the losses are likely borne by a combination of the company, insurance firms and governments. To top of page

#4597622

VultureX

2013-05-16 13:26

So all dutch banks that got attacked recently now probably all have new unknown bank accounts with millions of euro's on them 😛 I knew there was a reason for those seemingly pointless attacks.

#4597688

phill1978

2013-05-16 14:59

hacking, not from the outside but the 'near' side is super easy. also its not hard to imagine money being stolen by banks / bankers / top level organisations under the guise of a hacker, or even pay a hacker to take a fall with a get out of jail free card. some wireless systems still use LEAP and WEP ?! no LAN port blocking, no USB port blocking etc.. Its quite safe to assume most admins use simple or default passwords on their network servers and don't apply broadcast storm control on switches. a tip* find a quiet spot in an organisation near a lan socket, identity / mac spoof, hide a 900mhz transmitter under a table or plant pot, steal data beyond the eye of any wi-fi monitoring @ 2.4 or 5ghz .. all this stuff be it illegal or not is easy if you want. makes me wonder why any criminal bothers with a shotgun and a mask these days

#4597725

sverek

2013-05-16 16:35

makes me wonder why any criminal bothers with a shotgun and a mask these days

Hacking is like sniping, requires lots of patience. Not all got it.

#4597726

alanm

2013-05-16 16:37

This article will just encourage would be hackers whom otherwise would never have known about it to have a go at it.

#4598143

Speed Weed

2013-05-17 07:24

Want to learn how that's done? Buy the Syngress series of books entitled ' Stealing The Network.' There are loads of ideas on how to carry out a caper like this in real-time, without ever being caught. 😉

#4636195

iamcreasy

2013-08-13 04:06

amazingly, the information being sent between the tellers' computers and the branch's main database was not encrypted.

w.h.a.t.?

#4636200

airbud7

2013-08-13 04:27

Holy moly.Where do i start?! :banana:

Count me in too:banana:.........:)

#4636211

Chouji

2013-08-13 05:31

w.h.a.t.?

Private pipes probably, think internet that only allows specific network data. OR, a cable modem, that has channels specific to inter-bank data. and doesn't connect to the internet as a whole. since the data isn't actually on the internet, they figured they won't need to encrypt it, would be like networking 2 computers directly together with a patch cable. except 1 computer also connects to the internet via wifi. ^_^ you remotely hack the wifi, but the data between the 2 computers goes uninterrupted. Still you'd think they'd encrypt that stuff.

#4636218

Sprig

2013-08-13 06:50

If that had been in NZ, he would have been arrested regardless of his intentions. Probably in the States too.

#4636304

alanm

2013-08-13 11:41

Even if someone hacked a bank and created a $14 mil account as this guy did, he wouldnt be able to get away with it. He would need valid ID credentials to cash it in. He can probably transfer or move the amount around to other accounts for a while, but sooner or later a real ID at an end point when any cash is withdrawn will be required. Then its only a short matter of time before he's busted.

#4636340

Corrupt^

2013-08-13 13:18

Hacking is like sniping, requires lots of patience. Not all got it.

Tbh goes with anything. In my previous job I actually got to know how I could disable alarms before even entering a building. Want a heist done right, both irl or cyber, planning is in order 🤓

#4636616

iamcreasy

2013-08-13 23:56

Private pipes probably, think internet that only allows specific network data. OR, a cable modem, that has channels specific to inter-bank data. and doesn't connect to the internet as a whole. since the data isn't actually on the internet, they figured they won't need to encrypt it, would be like networking 2 computers directly together with a patch cable. except 1 computer also connects to the internet via wifi. ^_^ you remotely hack the wifi, but the data between the 2 computers goes uninterrupted. Still you'd think they'd encrypt that stuff.

For me it never feels right to send non-encrypted transmission when there is a possibility of eavesdropping. If they were so certain that nobody would ever enter their wifi network... I don't know...there might be some other issues involved. Like, added expense for setting up encryption filter. I am noob.

#4636672

Chouji

2013-08-14 02:27

I figured it was just early protocols still in place. Still, no matter how sure you are, it should still be encrypted. Even if it's strictly internal, infranet etc.

#4636749

iamcreasy

2013-08-14 07:43

Yea...