Menu
Bangladesh Bank attackers used custom malware that hijacked SWIFT software

Bangladesh Bank attackers used custom malware that hijacked SWIFT software

The malware deleted transaction records from the database and printed out altered SWIFT confirmation messages, researchers say

The hackers who stole US $81 million from Bangladesh's central bank likely used custom malware designed to interfere with the SWIFT transaction software used by many financial institutions.

The attackers attempted to transfer $951 million out of Bangladesh Bank's account at the Federal Reserve Bank of New York in February, but most of the transfers were blocked before completion. The attackers did manage to send $81 million to accounts in the Philippines, and that money is still missing.

Researchers from BAE Systems have recently come across several malware components that they believe are part of a custom attack toolkit that was likely used in the heist.

The samples were uploaded to online malware repositories by someone in Bangladesh and they are designed to monitor, delete and alter transaction records in the database used by the SWIFT client software.

Brussels-based SWIFT, or the Society for Worldwide Interbank Financial Telecommunication, is a cooperative society owned by thousands of financial institutions that runs the world's largest secure financial messaging network.

One of the malware components bypasses a validation check in a library that's part of SWIFT's Alliance software suite, which stores transaction records in an Oracle Database, the BAE researchers said in a blog post Monday.

The rogue program then monitors SWIFT Financial Application messages for strings defined in an encrypted configuration file. When it detects a matching one, it identifies the corresponding database entry and deletes it.

The malware also monitors for login and logout events in the application and notifies command-and-control servers when they are detected.

Finally, the program can manipulate confirmation SWIFT messages, which are automatically printed out on paper by the bank's systems. Altering database records is not enough to hide fraudulent transactions because these printed confirmation messages could give an attack away, the BAE researchers said.

There are still many unknowns about the well-planned Bangladesh Bank heist, such as who was behind it, how they got into the bank's network in the first place, and how they initiated the rogue transfers. However, the existence of this custom malware toolkit should serve as a warning to other financial institutions.

"This malware was written bespoke for attacking a specific victim infrastructure, but the general tools, techniques and procedures used in the attack may allow the gang to strike again," the BAE researchers said. "All financial institutions who run SWIFT Alliance Access and similar systems should be seriously reviewing their security now to make sure they too are not exposed."

SWIFT is aware of the malware's existence. However, the program doesn't impact SWIFT's network or core messaging services, the organization said in an emailed statement.

"We understand that the malware is designed to hide the traces of fraudulent payments from customers’ local database applications and can only be installed on users’ local systems by attackers that have successfully identified and exploited weaknesses in their local security," SWIFT said.

"We have developed a facility to assist customers in enhancing their security and to spot inconsistencies in their local database records," the organization added. "However, the key defence against such attack scenarios remains for users to implement appropriate security measures in their local environments to safeguard their systems -- in particular those used to access SWIFT -- against such potential security threats."

According to investigators, one factor that contributed to the success of the attack against Bangladesh's central bank was the lack of proper segmentation between the bank's SWIFT systems and the rest of its network. The SWIFT-connected computers were linked to the network via cheap switches with no management capability and lacking a firewall, Reuters reported Friday.

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Featured

Slideshows

Arrow exclusively introduces Tenable Network Security to A/NZ channel

Arrow exclusively introduces Tenable Network Security to A/NZ channel

Arrow Electronics introduced Tenable Network Security to local resellers in Sydney last week, officially launching the distributor's latest security partnership across Australia and New Zealand. Representing the first direct distribution agreement locally for Tenable specifically, the deal sees Arrow deliver security solutions directly to mid-market and enterprise channel partners on both sides of the Tasman.

Arrow exclusively introduces Tenable Network Security to A/NZ channel
Examining the changing job scene in the Kiwi channel

Examining the changing job scene in the Kiwi channel

Typically, the New Year brings new opportunities for personnel within the Kiwi channel. 2017 started no differently, with a host of appointments, departures and reshuffles across vendor, distributor and reseller businesses. As a result, the job scene across New Zealand has changed - here’s a run down of who is working where in the year ahead…

Examining the changing job scene in the Kiwi channel
​What are the top 10 tech trends for New Zealand in 2017?

​What are the top 10 tech trends for New Zealand in 2017?

Digital Transformation (DX) has been a critical topic for business over the last few years and IDC is now predicting a step change as DX reaches macroeconomic levels. By 2020 a DX economy will emerge and it will become the core of what New Zealand industries focus on. From the board level through to the C-Suite, Kiwi organisations must be prepared to think and act digital when the DX economy emerges in 2017.

​What are the top 10 tech trends for New Zealand in 2017?
Show Comments