Fraud , Payments Fraud

A House committee is seeking answers from the Federal Reserve Bank of New York about the recent $81 million SWIFT-related theft from the central bank of Bangladesh and its implications for U.S. financial services firms.

See Also: Data Center Security Study - The Results

The House Committee on Science, Space and Technology launched its probe after warnings from SWIFT that the heist from Bangladesh Bank's New York Fed account and related malware attacks were "part of a wider and highly adaptive campaign targeting banks," which may have targeted a dozen or more institutions (see 5 SWIFT Cyber Heist Investigations).

"This is deeply troubling and it is Congress' responsibility to ensure, through its oversight, that the NY Fed is taking all precautions to protect American finances and aggressively execute its own role as overseer of SWIFT," reads a May 31 letter to William C. Dudley, president of the New York Fed Reserve, signed by Lamar Smith, R-Texas, committee chairman, as well as committee member Barry Loudermilk, R-Ga.

SWIFT, formally known as the Society for Worldwide Interbank Financial Telecommunication, is a cooperative owned by 3,000 banks that bills itself as "the world's leading provider of secure financial messaging services." It's now used by 11,000 banks globally to daily process 25 million communications that collectively account for billions of dollars' worth of transfers.

But the security of that messaging system has been called into question following a series of reports that malware-using attackers have been injecting fraudulent messages into the SWIFT network as part of a campaign that may stretch back to at least 2013.

"We are writing to request a briefing and information related to the February incident as well as information related to the NY Fed's role in overseeing ... SWIFT," the House committee's letter reads. The deadline for the Fed to respond and brief the committee is June 14.

As the letter suggests, the central banks of the 11 countries that comprise the G10 - Belgium, Canada, France, Germany, Italy, Japan, the Netherlands, Sweden, Switzerland, the United Kingdom and the United States - together oversee SWIFT, with the National Bank of Belgium taking the lead role.

Probing SWIFT-Related Weaknesses

Other legislators and regulators also have been asking SWIFT-related questions.

On March 22, Rep. Carolyn B. Maloney, D-N.Y., wrote to the New York Fed seeking further details on the Bangladesh Bank heist, to which the Fed responded on April 14.

Also in April, Britain's central bank, the Bank of England, wrote to all U.K. banks seeking details of how they were responding to risks related to the SWIFT network.

On May 19, Sen. Tom Carper, D-Del., the ranking Democrat on the Senate Homeland Security and Governmental Affairs Committee, also wrote to Dudley at the New York Fed, asking how the Fed was responding to the bank heists.

On May 23, meanwhile, Maloney wrote to Fed Chair Janet Yellen, Comptroller of the Currency Thomas Curry and Federal Deposit Insurance Corp. Chairman Martin Gruenberg, asking if they planned to follow the Bank of England's lead and order all U.S. banks to conduct a full cybersecurity review.

War of Words

The Bangladesh Bank heist, which came to light in March, initially triggered a war of words, with Bangladeshi officials accusing SWIFT and the New York Fed of sharing in the blame for the heist by failing to spot and stop the fraudulent transfers. But the New York Fed fired back, saying that the transfer requests had been valid, and so they had been honored, per existing agreements. SWIFT, meanwhile, accused Bangladesh Bank of having substandard security practices, including weak passwords and nonexistent firewalls on systems that it used to interface with the SWIFT network (see SWIFT to Banks: Get Your Security Act Together).

On May 10, officials from Bangladesh Bank, SWIFT and the New York Fed met and then released a joint statement pledging to work more closely together. "The parties also agreed to pursue jointly certain common goals: to recover the entire proceeds of the fraud and bring the perpetrators to justice, and protect the global financial system from these types of attacks," they said.

The House Committee on Science, Space and Technology has also requested an update on the status of those initiatives as well as details of "any remedial steps" that the Fed has taken to address vulnerabilities related to using the SWIFT network.

Meanwhile, after initially blaming the breaches on banks, SWIFT has changed its tune and released a five-point security improvement plan, which includes better support for banks' information sharing and fraud-detection efforts. But no aspect of that plan, or related information sharing, will be mandatory.

SWIFT has also promised to issue more detailed security guidance to users.

Should SWIFT Cover Losses?

Some security experts, however, say SWIFT must do more, such as requiring banks to comply with new industry security regulations and external audits (see Blocking Hack Attacks: SWIFT Must Do More).

In a May 24 statement, Gottfried Leibbrandt, SWIFT's CEO, dismissed such proposals: "SWIFT is not all-powerful, we are not a regulator, and we are not a policeman; success here depends on all the stakeholders in and around the industry."

If investigators uncover more hack attacks and fraudulent SWIFT money-moving messages, however, or such attacks worsen, SWIFT may be forced to take stronger steps or risk further damage to its reputation.

Ricardo Villadiego, CEO of anti-fraud firm Easy Solutions, says it's useful to contrast SWIFT's response to hacked customers, versus how banks respond to their hacked customers. "From the SWIFT CEO's point of view, he is accurate when he is saying the SWIFT network wasn't compromised," Villadiego says. "That is true. But now what is also true is that if you compare this with traditional phishing attacks, the banks' systems weren't compromised, but the money was stolen from users."

In such cases, most banks promise to cover customers' losses. For example, Lloyds Bank, a British retail and commercial bank, offers the following online and mobile banking guarantee: "We guarantee to refund your money in the unlikely event you experience fraud with our Internet Banking service - as long as you've been careful, for example, by taking reasonable steps to keep your security information safe."

"It would be nice to see the same reaction from SWIFT here," Villadiego says.

Data Breach , Litigation

A federal judge in Georgia has cleared the way for a class-action lawsuit filed by card issuers against Home Depot over the retailer's massive 2014 payments breach to proceed. In making the ruling, the judge noted the banks' allegations regarding the retailer's security negligence appear to have merit.

See Also: Unlocking Software Innovation with Secure Data as a Service

The judge rejected most of Home Depot's motions to have various claims in the lawsuit dismissed, clearing the way for the case to go to trial. The issuers are seeking reimbursement from the retailer for breach-related expenses, such as the cost of reissuing cards and reimbursing cardholders for fraudulent transactions. They also seek declaratory relief for future breaches.

Between April and September 2014, some 56 million credit and debit cards in the U.S. and Canada were compromised as a result of an attack against Home Depot's point-of-sale system. Plaintiffs in the lawsuit, filed in May 2015, claim Home Depot failed to address known vulnerabilities in the system for several years, despite numerous warnings.

John Buzzard, a card fraud expert and the former head of FICO's Card Alert Service, says the plaintiffs' apparent success in convincing the court that Home Depot ignored warnings that its POS system was vulnerable to attack could be the game-changer that sets this case apart.

"The plaintiff's more than portrayed Home Depot as grossly negligent and seemingly uncaring prior to the actual breach," Buzzard says. "The proverbial airing of the dirty laundry, so to speak, gives them considerable leverage, I would think. This won't be a bad precedent at all if it travels through the court system and a competent jury renders its decision. This will be powerful regardless of the outcome. We all want to see more definitive legal action, and this may very well be it."

In another retail breach-related legal development, a federal judge on May 12 granted final approval to Target's $39.4 million settlement with issuers impacted by Target's 2013 breach.

Merits of the Suit

Al Pascual, head of fraud and security for Javelin Strategy & Research, says the Home Depot lawsuit likely will go to trial, rather than be settled out of court, like the Target suit.

"Based on Home Depot's recent reporting, the breach has cost them just over $5 per compromised account, not counting the insurance reimbursement the company received of $100 million," he says. "That is strikingly low and placed a disproportionate burden on affected financial institutions. My question is, if this suit isn't successful, then what kind of incentive is there for other organizations to address known security vulnerabilities? Why not just leave the banks on the hook for the bulk of the costs, because the customers will eventually get over it, right?"

In his ruling rejecting Home Depot's motion to dismiss the case, U.S. District Judge Thomas W. Thrash says dismissing the case would suggest that retailers are not responsible for ensuring their own cybersecurity, which is far from the reality of today's marketplace.

"The court declines the defendant's invitation to hold that it had no legal duty to safeguard information, even though it had warnings that its data security was inadequate and failed to heed them," Thrash writes. "To hold that no such duty existed would allow retailers to use outdated security measures and turn a blind eye to the ever-increasing risk of cyberattacks, leaving consumers with no recourse to recover damages, even though the retailer was in a superior position to safeguard the public from such a risk."

Claims of Negligence

In their lawsuit, the banks describe various points along the way when they allege Home Depot could have shored up security and chose not to. Warnings about vulnerabilities in Home Depot's data security practices date back to 2008, when Home Depot's IT team reported to management that the retailer's computer systems were "easy prey for hackers," the lawsuit states.

The suit also alleges that Home Depot was warned again, in 2009 and 2010, by "computer experts" and internal IT staff about the need to encrypt customer data at the point of sale as well as the need to address a security flaw "that allowed unauthorized persons to access the network and navigate freely without triggering any alarms."

In 2011, numerous employees working on data security issues in Home Depot's IT department left the company, "leaving the IT department understaffed," the suit claims. In July 2013, Home Depot suffered a "small data breach" that involved eight POS terminals that were infected with malware at a store in Dallas, the suit states. In December of that year, another store in Columbia, Md., was allegedly infected with POS malware as well, the suit adds.

"On Oct. 1, 2013, FishNet Security warned the defendant that its computer systems were vulnerable because the firewall was not operating properly," according to the suit. "In December of 2013, hackers installed malware at Target stores nationwide, and the defendant attempted to respond by assembling a task force to address the situation. In January of 2014, an outside security consultant told the defendant that its network was vulnerable to attack and did not comply with industry standards."

The suit alleges that in February 2014, Home Depot's data security task force offered recommendations for POS and network security, but by the time the company began to implement the recommendations, which included POS encryption, its systems had already been breached.

What Makes Case Unique?

Cybersecurity attorney Chris Pierson, who serves as CISO and general counsel at invoicing and payments provider Viewpost, says the details outlined in the lawsuit about claims made by security firms and former employees could be very damaging for Home Depot and very powerful for the issuers seeking reimbursement for breach-related expenses if they're proven to be true at trial.

"The allegations from former employees and other potential whistleblowers is truly unique, and their impact on the case could be measurable and bring about a swifter and more costly resolution to this matter," Pierson says. "This case presents some very important, if true, factual allegations that are usually not seen until later stages of litigation and full discovery."

Pierson says Home Depot is not likely to propose a settlement of the class-action lawsuit and instead will pursue more legal actions to disprove claims made by the card issuers.

"At this point in time, it is unlikely that Home Depot will seek to settle the case, but, rather, it will try to fight for a motion for summary judgment, alleging that even if these facts are true, the legal prongs have not been successfully proven," Pierson says. "If the allegations and facts in the current documents are, in fact, accurate, then Home Depot has a tougher road ahead."

Commenting on the judge's rejection of its motion to dismiss the case, Home Depot said: "We're naturally disappointed, but respect the decision of the court and we'll continue to focus primarily on our customers, which we've done throughout the process."

In March, Home Depot reached a $19.5 million settlement with consumers affected by its breach (see How Will Home Depot Consumer Settlement Affect Banks?).

Executive recruiter Bill Liguori helps many organizations find CISOs. What skills are these companies looking for today? "Our clients are asking for folks who can be business thinkers first, but have a good depth of technology, security and engineering behind them. Because without that business concept, they're not going to build something that continues to grow the organization."

The CISO's role has evolved much as the CIO role has changed, Liguori, a partner at executive search firm Leadership Capital Group, says in an interview with Information Security Media Group.

"The CIO function used to be seen as "back-office, purely cost-center, non-strategic," he notes. But today, "every business is a technology business. Every business relies heavily on technology to acquire new customers and service customers. ... And security becomes integral."

In the past, security was one of those functions that was about protecting assets and responding to all threats, the recruiter says. "Now, it's becoming something that's more focused on the core operational side of the business."

Common Characteristics

The CISO's role is similar across most industries, Liguori says. "There's a lot of commonality across the spectrum when it looks to security leaders," he says. "A little bit of it is dependent on the industry - some industries are more highly regulated than others ... But if you look at it at a broad, macro level, [organizations are looking for] security leaders to be able to translate the needs of the business and the organization."

And recruiting CISO candidates with the right combination of business and technical skills is challenging, he says.

"Security folks - the good ones - are really hard to find. ... Most organizations have a whole slew of security leaders. But when you start diving into ... how do you find the good ones, it's finding those who understand how to continue to drive the business."

In the interview (see audio player below photo), Liguori also discusses:

Liguori is a co-founder and partner responsible for the healthcare, insurance, hospitality, media and professional services practices at Leadership Capital Group. Previously, he was a vice president at a London-based retained executive search firm and served in various leadership roles at the data aggregation software company Yodlee and at the IT services and consulting firm Sapient Corp.

Anti-Fraud , Anti-Malware , Fraud

Russian authorities have arrested about 50 people in connection with an ongoing investigation into a hacker group that's suspected of unleashing malware-enabled hack attacks against customers of major Russian financial institutions.

See Also: 2016 Enterprise Security Study - the Results

The gang allegedly stole 1.7 billion rubles ($25.5 million) from accounts at multiple Russian financial services firms over a five-year period, Russia's federal security service, known as the FSB, says in a June 1 statement. It adds that Sberbank - the largest bank in Russia and Eastern Europe - assisted with its investigation, but didn't name any of the other victim banks.

The gang had attempted to steal a further 2.3 billion rubles ($34 million) by issuing false payment instructions, which were blocked, Russia's Interior Ministry tells Reuters.

The FSB, which is the successor to the Soviet KGB, says it made related arrests - supported by Interior Ministry and National Guard troops - in 15 regions across Russia.

"As a result of [house] searches a large quantity of computer equipment was confiscated along with communications gear, bank cards in false names and also financial documents and significant amounts of cash confirming the illegal nature of their activity," the FSB says.

All of the suspects have been charged with activities related to developing, distributing and using malware. After the raids, 18 primary suspects were denied bail, while three were placed under house arrest, according to the FSB.

Security experts say the malware used by attackers, called Lurk, was previously used primarily for click fraud, which refers to the practice of generating fake clicks on advertisements to illegally generate profits for website operators. But Moscow-based security firm Kaspersky Lab, which shared related intelligence with Russian banks and law enforcement agencies, says that 18 months ago, Lurk began to be deployed to assist in attacks against Russian banks, with attackers attempting to disguise their identity by using compromised VPN services.

"We realized early on that Lurk was a group of Russian hackers," says Ruslan Stoyanov, head of computer incidents investigation at Kaspersky Lab, in a statement. "Our company's experts analyzed the malicious software and identified the hacker's network of computers and servers. Armed with that knowledge, the Russian police could identify suspects and gather evidence of the crimes that had been committed."

Hackers Pummel Russian Banks

An unnamed source with knowledge of the investigation tells Russian news agency TASS that in March and April alone, six Russian banks - including Metallinvestbank, Metropol, Regnum and Russian International Bank - fell victim to related cyber attacks, and that Metallinvestbank alone lost 680 million rubles ($10.2 million).

As this week's arrests demonstrate, Russian authorities do target Russian residents who attack domestic targets (see Russian Cybercrime Rule No. 1: Don't Hack Russians). But in the past, gaining convictions has been difficult because under Russian law, investigators must prove that any cybercrime was accompanied by monetary theft from Russian organizations or individuals, according to Sergey Nikitin, deputy head of the computer forensics laboratory and malicious code analysis team at Moscow-based cybersecurity firm Group-IB (see Russia: 7-Year Sentence for Blackhole Mastermind).

The Malware

The Lurk malware used in the alleged cybercrime spree is primarily designed to infect systems and then download further malware, in part by using digital steganography, which refers in this case to hiding malware inside image files, according to Dell SecureWorks.

But that isn't the only type of malware being used to target Russian banks. This week, security firm Zscaler published a report on Android malware that's disguised as the official Sherbank mobile banking app. A Kaspersky Lab spokeswoman tells Information Security Media Group that the app isn't connected to the Lurk gang.

Regardless, the app demonstrates one way that hackers have been tricking banking customers into revealing their access credentials, thus allowing attackers to drain their accounts.

Zscaler doesn't detail how the Trojan app has been distributed, and notes that the Sherbank app currently available from Google Play is legitimate. But if a user installs the Trojan version on their device, the malware requests administrator privileges which "can cause devastating effects to the victim's device" if allowed, Shivang Desai, a security researcher at Zscaler, says in a blog post. Those abilities include intercepting SMS messages - which could be used to grab the one-time codes banks send to authorize transactions, especially for attacker-initiated money transfers - as well as the ability to call any number, which attackers could use to generate illegal profits by calling expensive toll numbers that they also control.

Attackers disguised their malware to look like Sberbank's Android app. (Source: zScaler)

Desai says the malware is also designed to present a fake log-in screen and steal credentials whenever users start up the Whatsapp app, Google Play Store, or the VTB 24 app, which provides access to accounts at Russian banking giant VTB. After the malicious app gets installed, it also suppresses all access to the legitimate apps.

"Even if the victim tries to access the original app, the malware will forcefully present its own fake login screen to the victim," he says, and after anyone provides their log-in credentials, they get sent to the attackers' command-and-control server.

Deleting the app can be difficult, short of wiping a device and reinstalling core software. "The malware has a very clever approach to remain persistent," Desai says. "It registers a broadcast receiver that triggers whenever the victim tries to remove administrator rights of the malware app, locking the Android device for a few seconds. As a result, it is not possible to uninstall this malicious app by revoking admin rights."

President Obama has made cybersecurity a national security and economic priority of his administration. A panel of cybersecurity policy experts says the administration's top IT security achievement is the February 2013 issuance of Executive Order 13636, which aims to improve critical infrastructure cybersecurity and resilience (see Obama Issues Cybersecurity Executive Order).

The executive order consists of two major parts: Establishing a process to share cyberthreat information with the private sector and directing the National Institute of Standards and Technology to create a cybersecurity framework to safeguard critical infrastructure's IT assets.

In this special edition of the ISMG Security Report (click on player beneath image to listen), you'll hear the panel of experts debate the effectiveness of the executive order, especially the NIST cybersecurity framework. The panelists voiced varying positions on whether the government should test the framework to determine the value it provides, especially to small businesses.

Cybersecurity Though-Leaders

The panelists include:

Panel Presents at Summit

This special edition was recorded after the panelists debated how the next president will deal with Obama's cybersecurity legacy, a session that kicked off Day 2 of the recent ISMG Fraud and Breach Prevention Summit in Washington.

Please check out our regular editions of the ISMG Security Report, which are posted on ISMG news websites on Tuesdays and Fridays. Here's a link to our previous report that examined global breach notification.

The ISMG Security Report theme music is by Ithaca Audio.

Breach Preparedness , Data Breach , Risk Management

There's a custom drone sitting in a laboratory in Sydney. Unlike many drones, no hacker has been able to take control of its flight systems.

See Also: From Authentication to Advanced Attack Vectors: Top Trends in Cybercrime in Q1 2016

The quadcopter represents years of work by researchers with Australia's national research agency, Data 61. What makes the drone's critical software ultra secure is a relatively tiny operating system that has been optimized for maximum security benefit.

The operating system, called seL4, was a breakthrough for Australian researchers aiming to develop secure systems for use in everything from in-flight computers to automotive controls to SCADA infrastructure.

The seL4 microkernel is a stripped down, slim version of the core code of an operating system. Kernels are especially security-sensitive because the code they run is allowed access to all other parts of a computer's hardware and software.

Mathematically Proven

Microkernels have been developed for more than four decades. But in 2009, researchers in Australia had a major breakthrough: they mathematically proved that seL4 will only behave according to a strict specification, a concept referred to as formal verification.

A mathematical proof demonstrates that seL4 contains no software vulnerabilities at all. "The proof shows that the code implements the specification, and no more and no less," says Ihor Kuz of Data61's Trustworthy Systems division. "So if the specification doesn't have a buffer overflow, there's no buffer overflow."

The seL4 microkernel maintains a strict separation between critical and non-critical functions. So if a hacker compromises an application running on top of seL4, access to other parts of the system are completely sealed off. There's simply no attack surface, and a hacker can't access or read or write to other parts of the system.

The microkernel's security, however, is dependent on some assumptions the researchers have made. For example, it could be undermined if the hardware platform it runs on contains deeply embedded spying code or has its own software vulnerabilities.

"We can't do anything against a hardware backdoor," says Gerwin Klein, research group leader for Data61's Trustworthy Systems. "Ultimately, if you can't trust what you're running on, you can't do much against that."

Also, Klein says the mathematical proof assumes that the behavior of the instruction set that the binary runs in is its actual behavior in the real world. "That's not something you can prove," he says. "It's something you write down."

Australia's Data61 research agency has developed a drone that uses an ultra-secure operating system called seL4 that is free of software vulnerabilities, making it resistant to hacking attempts.

Microkernel Gets a DARPA Shakedown

Kuz demonstrated an attack against the drone. Its mission computer - which is responsible for communicating with ground-based systems and instructing the flight controller - runs on seL4. If a hacker wanted to interfere with a flight, it's this computer that would be targeted.

Also running on top of seL4 is a virtualized instance of Linux, which controls the drone's camera. It's considered a non-critical system, and the camera communicates over Wi-Fi to send images. Kuz attacked the Linux instance, sending a fork bomb, which is a classic denial-of-service attack for Unix-based systems.

The camera crashes. But there's no way for Kuz to cross seL4's barrier to the mission computer, and the drone's flight systems are unaffected. "Whatever happens to the Linux stays in the Linux," Kuz says. "It's a little bit like Vegas."

Data61 has been working closely with the U.S. Defense Advanced Research Projects Agency to see how seL4 holds up in trials. Last year, a Boeing Little Bird helicopter was fitted with seL4 for an in-flight penetration test. The helicopter's critical systems couldn't be hacked.

The test was part of DARPA's High-Assurance Cyber Military Systems, a program that involves defense contractors such as Boeing and Rockwell Collins.

Commercial Use?

Data61's microkernel could be useful for a variety of industries where highly secure systems are needed. seL4 was released as open-source software about two years ago, so anyone can use it. Vehicle manufacturers would be prime candidates, especially after a flood of research has demonstrated that there are pervasive vulnerabilities in many of their software systems.

In mid-2015, for example, researchers Charlie Miller and Chris Valasek found that a vulnerability in a telematics unit could be exploited to gain control of a Jeep Cherokee's brakes. Fiat Chrysler recalled 1.4 million vehicles after the demonstration, which drew wide attention as it involved a journalist from Wired magazine driving the vehicle on a California highway.

On a related note, seL4 could be used in a vehicle's controller area network - a.k.a. CAN bus - which interfaces with a variety of sensors and systems. "Having an architecture and platform that provides isolation but integration would be of value," says Kevin Elphinstone, a principal researcher with Data61.

Products using seL4, however, may still be a few years away from reaching market. DARPA has given a number of grants to small enterprises, including a space company and a SCADA one, to use seL4. But because a microkernel is at the foundation of a product, it can take as long as five years to complete development, says Gernot Heiser, a computer science and engineering professor at the University of New South Wales.

There will likely still be a role for security software, even with systems using seL4. If untrustworthy software is used alongside seL4, there may still be a need for firewalls or intrusion detection systems, Klein says.

But not for seL4 itself. "The rootkit and virus scanners - they have a great business model, which is based on not solving the problem," Heiser says. "We hope to put them out of business."