$10 Router, No Firewall Blamed In $80M Bangladesh Bank Hack (reuters.com) 96
Earlier this a year, a spelling mistake in an online bank transfer prevented nearly $1 billion heist at Bangladesh's central bank and the New York Fed. The hackers, however, still had managed to steal about $80 million. Bangladesh government blamed the New York Fed for not spotting the suspicious transactions earlier. As it turns out, they should also be taking some blame, if not all. An anonymous reader writes: Bangladesh's central bank was vulnerable to hackers because it did not have a firewall and used second-hand, $10 switches to network computers connected to the SWIFT global payment network, an investigator into one of the world's biggest cyber heists said. The shortcomings made it easier for hackers to break into the Bangladesh Bank system earlier this year and attempt to siphon off nearly $1 billion using the bank's SWIFT credentials, said Mohammad Shah Alam, head of the Forensic Training Institute of the Bangladesh police's criminal investigation department.
Make the 81M come of the VP's bonus (Score:5, Informative)
Make the 81M come of the VP's bonus.
That $10 switch seems alot of like some cost reduction yahoo is calling the shots and does not want to pay for the needed costs to due it right.
Re:Make the 81M come of the VP's bonus (Score:5, Interesting)
Re:Make the 81M come of the VP's bonus (Score:5, Informative)
Ok - after reading the article, I think they might not have had any security architecture whatsoever. No compartmentalization of data flows. No firewall. Probably no monitoring. And judging from the comments, no traffic accounting/auditing capability.
It seems like they had no understanding of the IT risks at all.
Re:Make the 81M come of the VP's bonus (Score:4, Funny)
Coming soon - this bank outsources IT to neighboring India.
Re: (Score:1)
Coming soon - this bank outsources IT to neighboring India.
They couldn't do that for $10 though. Based on the sophistication( or lack of it), It looks like the teenage son of the bank president set this up based on his experience in setting up a home network..
Re: (Score:2)
They couldn't do that for $10 though. Based on the sophistication( or lack of it), It looks like the teenage son of the bank president set this up based on his experience in setting up a home network..
Don't forget to chmod -R 777 / -- makes life easier.
Re: (Score:2)
let's all chip in and buy them a linksys router,
Re: (Score:2)
There's probably thousands of cases where it's the other way round. Bangladesh is cheaper.
it's the consultant's fault! (Score:2)
I am guessing they lack the know-how in house, and was unwilling to spend real money to keep full time IT staffs on board, so they instead hired some consultant who billing them a few thousand dollars for a ten dollar router...
Re: (Score:2)
I wouldn't even go that far. I expect a manager was tasked to setup the network. So he just did what he would do for his home network.
Re: (Score:1)
Something doesn't add up. With those kind of assets, why wasn't this system hacked a long, long time ago?
Re: (Score:3)
Re:Make the 81M come of the VP's bonus (Score:5, Informative)
I dunno... (Score:5, Interesting)
Make the 81M come of the VP's bonus.
That $10 switch seems alot of like some cost reduction yahoo is calling the shots and does not want to pay for the needed costs to due it right.
I dunno... reading through the hacking team [schneier.com] break-in (by which I mean, reading the hacker's first-person description [pastebin.com], it's unclear to me how *anyone* could be considered responsible for these sorts of things.
The hacked system should encrypt passwords, use a salt, have offsite backups that are regularly tested... all that "of course" stuff applies.
But I'm not at all sure how having a modem or router hacked could be the responsibility of the system.
How can you tell? Is there an exploit for your high-end Juniper firewall [wired.com]?
The hacking-team narrative suggests that the person who did it replaced the [router?] firmware with a custom one with his own backdoor. A single 0day exploit on an internet-facing appliance.
Did someone intentionally weaken the PRNG in your Intel CPU at the mask level? Did someone replace the firmware on your hard drive? Is your BIOS compromised?
I read where someone put malware into the firmware of an intelligent *battery*.
Welcome to the future: everything has firmware, and all firmware can be reflashed by the factory.
(The update service installed when you install our product will automatically upgrade the system as needed. Just download and execute! This fixes the rendering issue in the Tagalog language pack, it's a *must have* upgrade!)
I'm not sure how anyone can guarantee their systems are secure any more.
If the State department can't secure their computers [cnn.com], what hope is there for regular mortals?
Re:Make the 81M come of the VP's bonus (Score:5, Funny)
You are apparently unaware of how finances work in states like Bangladesh.
1. The government apportions the appropriate money for a task assuming market. Rates
2. Department head siphons off 5% of the money and uses it to pay for Hookers and Blow.
3. The Department manager awards the contract to a friend who then gives them 10% of the money remaining back as cash.
4. The department representative responsible for ensuring the requirements are met then gets his 5% remaining kickback as well to look the other way as the requirements are not met. There are various other kickbacks as well, the city inspector and other involved.
5. The company now responsible for the implementation has lost about 25% of the total. They then taken their 50% profit and buy $10 off the shelf routers to do a job that had originally required commercial grade products with support contracts and zero day support.
Re: (Score:3)
That $10 switch seems alot of like some cost reduction yahoo is calling the shots and does not want to pay for the needed costs to due it right.
GDP per capita in Bangladesh is 750$US/yr. A $10 switch sounds like a wild extravagance.
Re: (Score:2)
I think they actually make some routers in china that include firewalls.
They actually might be the world leader in firewalls, having a Great Firewall of China.
I don't care where a switch is made, it doesn't replace a firewall.
Re: (Score:2)
No.
More like bob we don't need a firewall just need a switch to get on the network so what can you do for $10 get a router/firewall that can't handle the load or just a basic switch that will work.
Re: (Score:2, Informative)
No.
More like bob we don't need a firewall just need a switch to get on the network so what can you do for $10 get a router/firewall that can't handle the load or just a basic switch that will work.
It is so painful reading your posts...
Re: (Score:1)
Re: (Score:3)
Good point, App Guy! If they were running their bank using apps they would have been on wifi, and they'd at least have been behind NAT and had a minimal firewall.
It would be an improvement!
Re: (Score:3)
Re: (Score:3)
Be nice. Slashdot readership is no longer technical. Be happy that he (almost) did better than Hollywood screenwriters.
Re: (Score:2)
Wi-fi isn't intrinsically using NAT. However, the very cheapest consumer access points are all using it by default.
I wasn't presuming that a company that used second-hand switches would buy an enterprise-grade access point, which of course wouldn't come with any of that "router" stuff, because the router wants to do that. I'm assuming they would use a second-hand consumer "soho" model. Customers would return it as broken if it didn't do NAT out of the box!
Re: (Score:3)
The answer is obvious (Score:4, Funny)
More H-1b visas! Send them our way since they're so good at securing their own networks.
How can you digitally steal money? (Score:2)
Presumably, if money is moved solely though digital means, it would be far easier to track where it ends up?
Re: (Score:2)
I think you're looking for bitcoin. In this case the money was sent to a bank in the Philippines where almost certainly someone had opened an account with stolen ID, and closed the account out in cash as soon as the transaction cleared.
Re: (Score:2)
I think it unlikely that one would be able to close an account and walk out with the equivalent of millions of dollars. What bank has such large sums of cash available for customers to withdraw?
Re: (Score:2)
Many countries operate out of suitcases full of cash.
I used to work for a Bangla guy who'd pay in $100 bills rather than write a check. Perfectly legit, tax-paid business, but he dealt in cash.
Re: (Score:2)
I am quite sure that cash is more common in many non-Western countries. But millions of dollars worth? That would be out of the ordinary.
Re: (Score:2)
Depends how much of it you "accidentally" leave in the manager's office.
P.S. if he says he needs some extra to cover "fees and expenses", he's not ripping you off. That's for the police chief.
Re: (Score:2)
. . . until you move it to payment cards, and buy items with it. . . or any of several thousand OTHER ways of laundering the money. Disposable accounts. Cash Cards. et cetera ad nauseam . . .
Wrong trust boundary (Score:2)
Confusion? (Score:3, Informative)
Headline states $10 router, but story states $10 switches. Who's not paying attention?
Re: (Score:2)
Yeah pretty much. What you can do, if you are integrating these things with real gear, is connect multiple ports from the same switch which send bpdus, to L3-configured (when operating) ports on the crap gear. Then set up a bpduguard on the real gear with a recovery timer, so when this happens the real gear shuts down the ports for a few minutes while the device reboots, and it'll only come up in sub-second blips Not perfect, but better than spanning tree loops and opportunities for hackery.
ISTR there
Re: (Score:3)
From the way the article words it they hadn't even segmented the broadcast domains -- the sensitive servers were in the same VLAN as everything else -- nothing to do with logging capabilities, really -- they were apparently using a dumb switch with no dot1q capabilities whatsoever.
As the screw turns... (Score:2)
Re: (Score:1)
Most banks screw their own customers first. A bank screwing itself is something else. Another reason to use a credit union.
Don't be so sure on the credit union. All they do is take the money and then put it in the coffers of another bank. You're still at the mercy of the banks with a credit union, its just that now you have a middle man between you.
Re: (Score:2)
Sometimes, when liability is concerned, a middleman is what you want.
Re: (Score:2)
You're still at the mercy of the banks with a credit union, its just that now you have a middle man between you.
My credit union doesn't charge a fee for having a checking account, making an in person transaction with a teller, or using an out of network ATM. The monthly fees I pay for being a credit union customer is zero.
Irrelevant information (Score:2, Informative)
If you buy a cheap switch/router/hub you get a poor performance switch/router/hub or an unreliable switch/router/hub, not a hackable network. The protocol is totally encrypted end to end and getting access to a switch won't give you the keys to anything. So, the cheap switch/router/hub is totally irrelevant in this picture.
Next, the lack of a firewall, again here, it all depends on how the network is built. Is it a single compute
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re:Irrelevant information (Score:4, Informative)
I work in a school.
Our switches cost 2000 GBP each, and we have a firewall that costs on the same order. They have features you cannot get on anything cheaper (RADIUS, et al are "freebie" features nowadays - we're talking direct MDM on the switch and all kinds of security).
The question is not "was the $10 switch to blame?" but "why would you ever use a $10 switch anyway?" These people are storing money thousands of times more than anything we ever have to deal with, for thousands more customers than we will ever have, with thousands of times more budgets than I will ever see.
And their stuff isn't even from the "19" rack networking" section of the catalogue. It's from the "bargain buys for home uses to 'double up' their network cables" section.
Additionally, I'm bound by PCI DSS standards which demand things like firewalls and antivirus EVEN IF there's no need for them. I promise you. And IDS and IPS and separated networks and all kinds of security. That's just to TAKE a credit card payment to pass onto the bank. The banks themselves aren't then doing more?
It's got nothing to do with what could be true at the bank. It's about not even trying to follow industry best practices, let alone actually getting close to them.
Re: (Score:2)
Using cheap and crappy hardware at the link layer level of a network protocol doesn't make the protocol insecure, it makes it unreliable. You cannot crack on the protocol crypto because of a cheap, crappy and bad router/switch or whatever. It is simply just not involved at all in the cryptography and this is exactly for th
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
"I work in a school.
Our switches cost 2000 GBP each, and we have a firewall that costs on the same order."
You are expending too much.
"They have features you cannot get on anything cheaper (RADIUS, et al are "freebie" features nowadays - we're talking direct MDM on the switch and all kinds of security)."
See? You don't need to expend so much.
I know, I know... paying that kind of money (maybe even public money to make things even worse) gives you a sense of accomplishment: "Mum, look at me! I'm using expensiv
Re: (Score:2)
It's not public money.
It's a private school.
With 1:1 BYOD's.
With site-wide wireless.
With site-wide PoE for CCTV, VoIP, access control and bell/speaker systems, all QoS'd.
With need for multi-gigabit backbone.
With device MDM so that when we block an BYOD (because it's not up to date, say, or is missing AV), it blocks it site-wide on the wireless and Ethernet, alerts, stops sending down paid-apps, etc. etc.
And the network sockets are opened on the basis of device owner (set from VPP from Apple, Google, etc.),
Re: (Score:2)
Exactly my point.
Re: (Score:2)
You see kids, this is why spelling is important. (Score:1)
Even if you decide to turn to a life of crime.
Could be North Korea? (Score:4, Interesting)
North Korea's been hurting under the new sanctions. The amount of money that was almost stolen is insane for a person to steal but makes sense for a country (or more specifically, a military and ruling party) to steal. It was a well-organized effort involving many people. They were caught because of a mistake that an English-speaker wouldn't make.
Serves them to get screwed. (Score:2)
Hahahaha!
And i never troll.
Resourceful employee of the year (Score:2)
My old workplace had an IT worker apply for a job who prided himself on finding the CHEAPEST possible solution to any problem. For example, he would grab any discarded printers or computers he could find on the side of the road or in dumpsters. The used appliance shelves at thrift stores were his source for cable modems and such. He bragged about how his last employer hadn't needed to spend much on IT because he cobbled together whatever was needed for cheap.
Now, he was applying for a job with a compa
Re: (Score:2)
Such skills are only valued by someone that thinks the ridiculously small cost of hardware is even relevant in the scheme of things. Such as a company that sees it's IT budget as an expense and not an investment in productivity. The TCO on the recycled hardware would be massive because the labor costs would dwarf any savings on hardware. And only a short sided penny pincher wouldn't see that.
In business IT costs you need to weigh three intangibles.
1. What's the cost of failure (in this case bankrupting the
The network is NOT the computer (Score:2)
Not that I'm against firewalls or managed switches or anything like that, but shouldn't the primary security control really be end-to-end encryption and strong auth at the OS level? I understand that in less secure environments we can rely on IP addresses and stuff like that for part of our protection. But at a bank I would hope that things would be secure even if your switch and firewall are both compromised.
Of course, if you can't even get the simple things like a switch and firewall right, you have no ho
SWIFT is also to blame (Score:2)
Re: (Score:2)
SWIFT can only send money, not deduct money, so why should SWIFT require any security? Don't have it, well you pay for it.
Inside job... (Score:2)
Actually skimmed article... $10 switch = no VLAN (Score:3)
Near the end of the article is the better info...
The SWIFT connected computers should have at least been hived off into a separate VLAN. They weren't.
Not as bad as it seems.. (Score:1)
The loss is not as bad as it seems. Sure $80M was stolen, but they made savings on those $10 routers, so that's maybe only $79,999,500 lost... not so bad as we first thought.