Anti-Fraud , Breach Preparedness , Data Breach

All financial institutions that use the SWIFT interbank messaging network must comply with its new cybersecurity standards - as well as a related "assurance framework."

See Also: From Authentication to Advanced Attack Vectors: Top Trends in Cybercrime in Q1 2016

SWIFT announced the changes on Sept. 27, saying that inspections and enforcement will begin Jan. 1, 2018. Draft standards will be released next month for a two-month vetting process; they'll be finalized and published by the end of March 2017. Then organizations - including those who connect to SWIFT via a service bureau - must self-attest that they comply with the standards, on an annual basis, or face being reported not just to regulators, but also other SWIFT members.

Gottfried Leibbrandt, CEO of SWIFT, says in a statement: "While customers remain responsible for protecting their own environments," the move is meant to ensure that rigorous cybersecurity discussions are taking place at all of the more than 11,000 institutions - across 200 countries - that use SWIFT's interbank messaging software and network, as well as between banks and their regulators.

"Our aim in setting out this framework is to support customers by helping to drive awareness and improvements in the industry's overall security. We will do this by maintaining a dynamic assurance approach, evolving the framework in line with the changing threat landscape, and making sure it complements emerging regulatory guidance."

The Society for Worldwide Interbank Financial Telecommunication, as it's formally known, is a cooperative owned by 3,000 banks, founded in 1973, that bills itself as "the world's leading provider of secure financial messaging services." It's now used by more than 11,000 banks globally to process 25 million communications daily that collectively account for billions of dollars' worth of transfers.

Customer Security Program Rollout Continues

But SWIFT has faced criticism from some industry watchers - and questions from legislators and regulators - following the February hack attack against the central bank of Bangladesh that resulted in attackers stealing $81 million from Bangladesh Bank's account at the Federal Reserve Bank of New York via fraudulent SWIFT messages. Since then, previous and apparently related attacks have come to light, and SWIFT has warned that attackers are continuing to wage "a wider and highly adaptive campaign" against banks.

Following the Bangladesh Bank hack, SWIFT has continued to assert that its platform was not compromised by attackers. It has also called on users to devote more attention to both their in-house cybersecurity practices as well as the security of the SWIFT-using banks with which they do business (see SWIFT to Banks: Get Your Security Act Together).

But SWIFT in June also announced a new customer security program designed to help banks better spot fraud and related hack attacks. Since then, it's continued to announce a raft of related efforts, including digital forensic investigation services as well as forthcoming fraud pattern detection tools for customers.

16 Mandatory Security Controls

Now, however, SWIFT will begin enforcing its new, mandatory framework, which it says its board of directors unanimously approved. Full details relating to the 16 mandatory controls - as well as 11 optional "advisory controls" - have yet to be released, although SWIFT says this will happen by the end of October.

SWIFT says inspections and enforcement will begin in January 2018, and it will report any customers that fail to comply with the 16 mandatory controls to regulators. It says that it will also randomly audit some customer banks, requiring them to provide more detailed proof of compliance via either their internal or external auditors.

In a bid for transparency - and no doubt peer pressure - SWIFT promises that all of its users will have access to each other's compliance reports, "allowing firms to assess [the] risk of counterparts with whom they are doing business."

The organization also notes that financial institutions are free to hold their business partners to an even higher standard. "This quality assurance process will not preclude customers from independently requesting additional assurance from their counterparts," SWIFT says. "In addition, customers will also be able to choose to disclose their compliance with a further 11 advisory controls that will supplement the 16 mandatory controls."

Regulatory Oversight Required

Key to this initiative succeeding, however, will be the participation of regulators. "We recognize that this will be a long haul and will require industrywide effort and investment, as well as active engagement with regulators," Yawar Shah, chairman of SWIFT, says in a statement. "The growing cyber threat requires a concerted, communitywide response."

Indeed, attacks against banks continue to surge. For example, The U.K.'s Financial Conduct Authority, which regulates the country's 56,000 financial services firms, says it's recently seen a surge in the number of breaches that banks have been reporting to it.

Speaking recently at a cybersecurity conference, Nausicaa Delfas, the FCA's director of specialist supervision, said that while breach reporting in the United Kingdom continues to be voluntary, attacks appear to be on the increase. "In 2014, we received five reports, in 2015 27, and 75 so far in 2016," she said. "Whilst this significant increase indicates more attacks are occurring, this may also suggest better detection and greater reporting to us on the part of firms, which we very much encourage."

Cybersecurity Essentials

On a related note, the SWIFT Oversight Forum last week issued a call to all countries' banking regulators, urging them to oversee their banks' cybersecurity procedures. In particular, SWIFT says that all countries' banks should be able to consult relevant cybersecurity guidance provided not just by third-party service providers, but also their banking regulators.

The SWIFT Oversight Board recommends that regulators emphasize a number of approaches, ranging from performing ongoing security risk assessments and implementing and testing security controls, to running security awareness and training programs and sharing information with other banks.

The central banks of the 11 countries in the G10 - Belgium, Canada, France, Germany, Italy, Japan, the Netherlands, Sweden, Switzerland, the United Kingdom and the United States - oversee SWIFT, with the National Bank of Belgium taking the lead role. The SWIFT Oversight Board also includes the central banks of Australia, China, Hong Kong, India, Korea, Russia, Saudi Arabia, Singapore, South Africa and Turkey.

But it remains to be seen whether regulators in emerging markets, in particular, will heed SWIFT's latest warnings and call for financial authorities to more carefully police their country's financial institutions.

In the wake of this week's rollout by NACHA, The Electronic Payments Association, of same-day ACH payments in the U.S., fraud departments at originating and receiving banks should be bracing for the new risks posed by faster payments, says NACHA's Jane Larimer.

Same-day ACH is the first step toward the move to real-time payments over the course of the next two years, Larimer, NACHA's executive vice president of ACH Network Services, says in an interview with Information Security Media Group.

Risks posed by faster payments can be greatly reduced by ensuring fraud departments are adequately authenticating and verifying ACH payment senders, payment recipients and transaction amounts from origination to receipt, Larimer says.

"From a high-level perspective, my hope would be that fraud departments see the risk mitigants and the potential for increased fraud risk" posed by faster payments, Larimer says. "One of the things that fraud departments need to do is ensure that they have those adequate controls in place upfront."

Robust Authentication

That means originating banks need to have robust authentication of senders who initiate transactions, as well as strong security for files that are sent to the receiving bank, she stresses. "On the origination side, it's making sure you have transaction monitoring, or strong authentication of all the controls you need at file initiation."

Receiving banks need to ensure that they have tools in place to review transactions within the same day they are received, Larimer says. If a transaction is flagged, then it has to be returned that day. Banks will no longer have more than 24 hours to review and return those transactions from their exceptions departments, she explains.

"With faster payments, they have to put in adequate controls," Larimer says.

During this interview (see link to audio below image), Larimer also discusses:

In addition to serving as NACHA's executive vice president of ACH Network Administration, Larimer serves as its general counsel. She leads the department responsible for all activities that support NACHA's role as administrator of the ACH Network, including rule-making, risk and compliance, and network development. She also provides legal support for the NACHA operating rules and for NACHA's activities in ecommerce, electronic check initiatives, electronic bill payment/presentment and electronic benefits transfer. Before joining NACHA, Larimer practiced law with the lending, banking and public finance group of Bryan Cave LLP, formerly Powell, Goldstein Frazer & Murphy, in Atlanta.

Breach Response , Cybersecurity , Data Breach

The U.S. presidential nominees - Democratic candidate Hillary Clinton and Republican candidate Donald Trump - ventured into new territory for their first presidential debate: cybersecurity. It marked one of the few subjects on which both candidates broadly agreed, although the exchange was marked with sharp jabs and an interesting attribution theory from Trump.

See Also: Top Trends in Cybercrime; 411 Million Attacks Detected in Just 3 Months

Cybersecurity has never been so relevant, with the U.S. government investigating suspicions that Russia is behind a series of attacks against Democratic Party institutions and possibly trying to skew the election (see How Should US Respond If Russians Hacked DNC System?).

NBC newsman and debate moderator Lester Holt posed this question: "We want to start with a 21st century war happening every day in this country. Our institutions are under cyberattack, and our secrets are being stolen, so my question is: Who's behind it and how do we fight it?"

Clinton had first go, and didn't hold back, saying there's no doubt that Russian President Vladimir Putin has ordered cyberattacks against U.S. organizations.

"One of the things he's done is to let loose cyberattackers to hack into government files, to hack in personal files, hack in the Democratic National Committee," Clinton said. "And we recently have learned that this is one of their preferred methods of trying to wreak havoc and collect information."

In July, WikiLeaks released more than 19,000 emails stolen from the DNC's computer systems. A hacker going by the nickname Guccifer 2.0 claimed to have passed them to the organization while independently publishing confidential documents on a WordPress blog. Some security experts suspect Guccifer 2.0 may be linked with a Russian hacking group called Fancy Bear, one of two groups found to have infiltrated the DNC (see Leaked DNC Emails Show Lax Cybersecurity).

Clinton didn't pass up an immediate opportunity to swipe at Trump, either: "I know Donald's very praiseworthy of Vladimir Putin, but Putin is playing a really tough long game here." While she was speaking, Trump leaned forward and grumbled "wrong" into his microphone.

Trump sparked controversy in late June when he implored Russia to find some 30,000 emails that were deleted from Clinton's private email server she used as secretary of state. Clinton's use of a private email server has been a consistent thorn in the side of her campaign. An FBI investigation concluded that while Clinton was careless in using it, she didn't violate regulations for handling classified material.

Clinton's other answers on cybersecurity assumed a very presidential posture, almost as if she had already secured the job - the election is Nov. 8. She also fired off a preemptive warning about the U.S.'s offensive capabilities.

"We need to make it very clear whether it's Russia, China, Iran or anybody else, the United States has much greater capacity, and we are not going to sit idly by and permit state actors to go after our information, our private sector information or our public sector information," she said.

"And we're going to have to make it clear we don't want to use the kinds of tools that we have. We don't want to engage in a different kind of warfare. But we will defend the citizens of this country, and the Russians need to understand that."

The 400-Pound Cyberattacker

Trump's answer, like many in the debate, initially diverged from the question at hand. When he circled back, he said he agreed with Clinton that the U.S. should have strong cybersecurity capabilities. Then he addressed Russia.

"I don't think anybody knows it was Russia that broke into the DNC," Trump said. "She's saying Russia, Russia, Russia. But I don't. Maybe it was. I mean it could be Russia, but it could also be China. It could also be lots of other people. It also could be somebody sitting on their bed that weighs 400 pounds, OK? You don't know who broke into DNC."

No definitive evidence has emerged that links Russia to the DNC attacks, although several security companies have said forensic clues point to the groups nicknamed Fancy Bear and Cozy Bear, which are believed to be working for Russia.

Trump then turned to the effects of the DNC hack, which revealed deep bias within the organization against candidate Bernie Sanders. The publication of the emails eventually led DNC Chairwoman Debbie Wasserman Schultz to resign, and the revelations infuriated Sanders supporters.

"Bernie Sanders was taken advantage of by your people," Trump said. "Now whether that was Russia, whether that was China, whether it was another country, we don't know because the truth is under President Obama we've lost control of things we used to have control over."

Trump said the terrorist group referred to as ISIS or ISIL is beating "us at our own game" on the internet. "We have to get very, very tough on cyber and cyber warfare," he said. "It is a huge problem."

The full cybersecurity-debate segment is available on ABC News' website.

Data Breach , Litigation

Several civil lawsuits have been filed against Yahoo following a disclosure that 500 million accounts were compromised in what the company claims was a state-sponsored intrusion in late 2014 - one of the largest-ever data breaches.

See Also: Creating a User-Centric Authentication and Identity Platform for the Healthcare Industry

The quick filing of lawsuits has become a ritual after a major data breach. But such lawsuits often are not successful, and an ambiguous Supreme Court ruling that was hoped would provide clarity actually made the legal landscape more ambiguous.

"The results [of lawsuits] to date are very mixed, not in favor of the consumer and very court driven," says Scott Vernick, partner and head of the data security practice at Fox Rothschild LLP in Philadelphia.

Nonetheless, lawsuits are a large headache for companies following a breach, adding to the cost of recovery. Three civil suits have been filed against Yahoo in U.S. District Court for the Northern District of California in San Jose, while USA Today reported that two other similar lawsuits have been filed in Illinois and San Diego.

One of the suits, filed on behalf of New York resident Ronald Schwartz, alleges that Yahoo's "misconduct was so bad" that it allowed access to users' personal information for close to two years. "Despite the fact that the attack took place in late 2014, Yahoo was so grossly negligent in securing its users' personal information that it says that it did not even discover the incident until the summer of 2016," the complaint reads.

Verizon, which announced in July it would acquire Yahoo for $4.8 billion, did not learn of the breach until around two days before Yahoo disclosed it publicly on Sept. 22, the suit says.

"Circumstantial evidence suggests that certain Yahoo insiders did know of the breach long before it was disclosed, but hid it from the public until after a $4.8 billion sale of the company to Verizon," the suit says.

The Wall Street Journal, citing an anonymous source, reported on Sept. 23 that Yahoo actually detected the attack several weeks after it occurred and suspected it originated from Russia. Attackers were seeking data related to 40 Yahoo users, the publication says (see Yahoo Breach: The Great 'Nation-State' Cop Out).

The data breach is expected to complicate Verizon's acquisition of Yahoo, which is winding its way through regulatory and shareholder reviews. Yahoo officials had no comment on the lawsuits.

Did Breach Cause Harm?

To pursue a claim in federal court, plaintiffs must have standing, the legal term for articulating harm caused by another party. Many data breach-related lawsuits have ground to a halt after not gaining standing.

As a result, plaintiffs often then turned to using consumer statutes, such as the Fair Credit Reporting Act and the Telephone Consumer Protection Act, to show violations of law by a defendant in order to get statutory damages.

A class-action suit against data aggregator Spokeo was hoped to provide clarity on whether statutory violations were enough for plaintiffs to gain standing. Plaintiff Thomas Robbins accused Spokeo of sharing inaccurate information about him, which he alleged hurt his employment prospects. Spokeo, he alleged, violated the Fair Credit Reporting Act.

But the Supreme Court ruling on May 16 didn't provide clarity on whether showing a statutory violation was enough for a case to proceed, Vernick says. It gave both plaintiffs and defendants room to argue either way, he said. The case was sent back to a lower court for more litigation (see Supreme Court Rejects Online Privacy Case).

The language of the ruling "is muddled enough that it sort of gives something for everybody [to argue]," Vernick says. So the landscape is checkered. But if cases overcome the hurdle around standing, odds are the case will eventually be settled, he says.

Mixed Results

In May, a federal judge in Maryland dismissed a lawsuit against Baltimore-based health insurer CareFirst BlueCross BlueShield following a data breach that affected 1.1 million individuals.

An investigation showed members' names, birthdates, email addresses and subscriber identification numbers may have been compromised. In dismissing the case, the judge said the plaintiffs had not shown that the leak had caused harm or that data had been abused. A claim that those affected by the breach could be harmed in the future was also dismissed as speculative (see Anthem Breach Lawsuit Proceeds; CareFirst Suit Dismissed).

In August 2014, LinkedIn agreed to a $1.25 million settlement for a data breach in June 2012 that at the time was thought to have compromised 6.5 million account details. Consumers were eligible for up to $50 in compensation (see LinkedIn Settles Data Breach Lawsuit). Earlier this year, LinkedIn confirmed that it had vastly underestimated the scope of breach, with more than 164 million accounts compromised.

Sony Pictures Entertainment, whose network was compromised and then virtually destroyed by North Korean hackers in November 2014, chose to settle a lawsuit filed by current and former employees (see Sony Breach Settlement: A Good Deal?). The settlement provided cash reimbursement for validated losses connected to the attack. Sony dedicated $2.5 million to that fund. Victims are also entitled to free identity theft monitoring services.

In the case of Yahoo, Vernick says it might be difficult to prove consumers were harmed, especially in light of many other breaches. Although the attackers obtained a substantial amount of information from Yahoo, it might be difficult for consumers to show direct harm because cybercriminals sometimes perpetrate fraud based on data from several breaches, Vernick says.

"It's hard to say [a criminal act] is tied directly to the Yahoo breach," he says.

The latest ISMG Security Report leads off with a segment in which Managing Editor Jeremy Kirk explains that the massive Yahoo breach not only exposed the accounts of a half-billion customers, but also the weaknesses in the way enterprises employ hashed passwords.

In the report, you'll also hear:

The ISMG Security Report appears on this and other ISMG websites on Tuesdays and Fridays. Be sure to check out our Sept. 20 and Sept. 23 reports, which respectively analyzes a new self-assessment tool that shows whether an enterprise's cyber-risk initiative aligns with its goals and strategy and a comparison of two widely varying estimates - $200,000 vs. $7 million for the cost of a data breach. The next ISMG Security Report will be Friday, Sept. 30.

Theme music for the ISMG Security Report is by Ithaca Audio under the Creative Commons license.

Anti-Malware , Fraud , Phishing

A new kind of malicious software for Apple Mac computers is believed to have been developed by the same Russia-linked hacking group that allegedly struck the Democratic National Committee and the World Anti-Doping Agency.

See Also: Eight Capabilities IT Pros Should Look for in a CASB

Palo Alto Networks says the malware, called Komplex, pretends to be a 17-page PDF document describing future projects of the Roscomos State Space Corporation, Russia's space agency. The malware is designed to steal information from a compromised system and send it to a remote server.

Komplex was likely developed by Sofacy, one of several nicknames for the Russian hacking group, Palo Alto says. Other names for the group include Fancy Bear, APT28, Pawn Storm and Sednit.

Several computer security companies have pinned the intrusion into the servers of the Democratic National Committee on Fancy Bear and another group, Cozy Bear. Cybersecurity vendor Crowdstrike believes Fancy Bear is affiliated with the GRU, one of Russia's intelligence agencies (see Report: Russia's 'Best' Hackers Access DNC's Trump Research).

The attack on the DNC resulted in the leak of more than 19,000 internal emails, which caused turmoil in the party after the correspondence showed party officials favored Hillary Clinton for the Democratic presidential nomination. The group is also believed to have hacked WADA, releasing documents that called into question drug exemptions granted to top athletes for the Rio Olympics (see Hackers Dump US Olympic Athletes' Drug-Testing Results).

The U.S. government is investigating whether the Russian government is behind the DNC hack and other suspicious activity, although it has not directly blamed it. But in the first presidential debate on Sept. 26, Democratic nominee Hillary Clinton directly accused Russian President Vladimir Putin of ordering the attacks (see Clinton, Trump Tackle Cybersecurity in Debate).

Not So Fancy

Fancy Bear's most public successes haven't relied on what most computer security experts would characterize as being exceptional hacking. Rather, the group has employed well-known social engineering techniques and tricks, which are often adequate against weak targets.

For example, WADA has said the group gained access to its ADAMS database, which is used for scheduling athletes for drug testing, through compromised login credentials. ADAMS was accessible through the web. It appears Fancy Bear set up domains to mimic WADA's real domain in order to capture usernames and passwords through phishing emails.

Komplex isn't very fancy, either. Getting it installed on machines is predicated on victims being duped by the PDF and ignoring warnings from Apple's operating system that an application will be installed.

Thomas Reed, a Mac expert with the security firm Malwarebytes, writes in a blog post that Komplex is "trivial in execution, trivial to detect and trivial to remove."

It doesn't appear that Komplex was signed with a developer's digital certificate from Apple. Although anyone can obtain those certificates, the inclusion of one makes an application appear more legitimate, at least on surface inspection.

Depending on how it is configured, Apple's Gatekeeper will block applications that are not available via the Mac App Store - which only hosts approved programs - or that do not come from a list of "identified developers" maintained by Apple.

Reed says that regardless of whether Komplex was signed, users would see a warning that the content is actually an application coming from the internet. That should raise a big red flag for users, because Komplex pretends to be a PDF.

"Of course, we know folks will still click right through stuff like that without reading it," Reed says.

Patrick Wardle, director of research with the company Synack, tested Komplex and found it also triggered another warning for users to download Apple's Xcode development suite. He posted a screenshot of the warning on Twitter. Komplex's various binaries appeared to be unsigned "and really not that sophisticated," Wardle says in an email.

looks like the OSX/Komplex malware authors didn't test on a non-developer box? #malwareFail pic.twitter.com/f4docEZvUk

Link to Fancy Bear

Palo Alto Networks found strong links between Komplex and another piece of malware that cybersecurity firm BAE Systems analyzed in June 2015. In particular, static elements for network communications, such as the composition of URLs and HTTP structure data, were the same, as well as the algorithm used to encrypt and decrypt network traffic, according to Palo Alto's blog post.

The malware found by BAE Systems didn't rely on social engineering to get installed. Instead, it used a zero-day vulnerability in MacKeeper, a security application for Mac that many experts advise not installing (see MacKeeper Hid Product Update Error).

"These overlaps suggest that the Trojan delivered by the MacKeeper vulnerability was, in fact, the Komplex Trojan," Palo Alto writes.

According to BAE's analysis from June 2015, real exploit attempts appeared in the wild only a few days after security researcher Braden Thomas developed proof-of-concept code that took advantage of the MacKeeper flaw.

The issue, now patched, caused MacKeeper to execute code contained within a maliciously crafted URL. Hackers often seize upon weaknesses in third-party applications, with Adobe's Flash browser plug-in among the most consistently targeted.

Palo Alto also found strong links between Komplex and a variant of the banking malware Carberp developed by Fancy Bear, even though Carberp is written for Windows.

The Carberp variant had the exact same token value for a command-and-control URL that was encoded into Komplex. Both programs' binaries also had the same file extensions for that URL and in the same order.

"Based on these observations, we believe that the author of Sofacy's Carberp variant used the same code, or at least the same design, to create the Komplex Trojan," Palo Alto writes.

Apple was notified about Komplex, Palo Alto says.