Swift: fraudulent messages sent over international bank transfer system
World money exchange tells 11,000 financial institutions to update their software after US$81m was stolen from account of Bangladesh central bank.
Swift, the global financial network that banks use to transfer billions of dollars every day, has warned its customers it is aware of “a number of recent cyber incidents” where attackers had sent fraudulent messages over its system.
The disclosure came as law enforcement authorities in Bangladesh and elsewhere investigated the cyber theft of US$81m (£55.9m) from the Bangladesh central bank account at the New York Federal Reserve. Swift has acknowledged the scheme involved altering Swift software on Bangladesh Bank’s computers to hide evidence of fraudulent transfers.
Monday’s statement from Swift marked the first acknowledgement that the Bangladesh Bank attack was not an isolated incident but one of several recent criminal schemes that aimed to take advantage of the global messaging platform used by some 11,000 financial institutions.
“Swift is aware of a number of recent cyber incidents in which malicious insiders or external attackers have managed to submit Swift messages from financial institutions’ back offices, PCs or workstations connected to their local interface to the Swift network,” the group warned customers.
The warning, which Swift issued in a confidential alert sent over its network, did not name any victims or disclose the value of any losses from the previously undisclosed attacks. Swift confirmed to Reuters the authenticity of the notice.
Swift, or the Society for Worldwide Interbank Financial Telecommunication, is a cooperative owned by 3,000 financial institutions.
Also on Monday, Swift released a security update to the software that banks use to access its network to thwart malware that security researchers with British defence contractor BAE Systems said was probably used by hackers in the Bangladesh Bank heist.
BAE’s evidence suggested that hackers manipulated Swift’s Alliance Access server software, which banks use to interface with Swift’s messaging platform, to cover their tracks.
BAE said it could not explain how the fraudulent orders were created and pushed through the system.
But Swift provided some evidence about how that happened in its note to customers, saying that in most cases the
attackers obtained valid credentials for operators authorised to create and approve Swift messages, then submitted fraudulent messages by impersonating those people.
Cyber security experts said more attacks could surface as Swift banking clients look to see if their access had been compromised.
Shane Shook, a banking security consultant, said hackers were turning to Swift and other private financial messaging platforms because they could steal larger amounts.
“These hacks specifically target financial institutions because smaller efforts result in much larger thefts,” he said. “It’s much more efficient than stealing from consumers.”
Justin Harvey, chief security officer with Fidelis Cybersecurity, said hackers followed the money and would be drawn into such schemes in hopes of emulating a big heist like the one on Bangladesh Bank.
“After the Bangladesh Bank heist became public, every other attacker out there is looking to see if they can do the same,” he said.
Swift spokeswoman Natasha Deteran told Reuters that the commonality in these cases was that internal or external attackers compromised the banks’ own environments to obtain valid operator credentials.
“Customers should do their utmost to protect against this,” she said in an email to Reuters.
Swift told customers that the security update must be installed by 12 May.
“We have made the Alliance interface software update mandatory as it is designed to help banks identify situations in which attackers have attempted to hide their traces – whether these actions have been executed manually or through malware,” she said.
SOURCE: https://www.theguardian.com/technology/2016/apr/26/international-bank-transfer-system-hacked-swift-group-admits