U.S. banks on high alert against cyberattacks

Computerworld - The Financial Services Information Sharing and Analysis Center (FS-ISAC) has put U.S. banks on high alert against cyberattackers seeking to steal employee network login credentials to conduct extensive wire transfer fraud.

The alert warns banks towatch out for hackers using spam, phishing emails, Remote Access Trojans and keystroke loggers to try and pry loose bank employee usernames and passwords.

The FBI has noticed a new trend where cyber criminals use stolen employee credentials to wire transfer hundreds of thousands of dollars from U.S. customer accounts to overseas banks, the FS-ISAC noted.

"The wire transfer amounts have varied between $400,000 and $900,000, and, in at least one case, the actor(s) raised the wire transfer limit on the customer's account to allow for a larger transfer," the alert said. The FS-ISAC noted that it has moved it cyberthreat level from 'elevated' to 'high' as a result of the activity.

A majority of recent victims have been small and medium-sized businesses, small banks and credit unions, the FS-ISAC said. However, a few large banks have also been hit by fraudsters.

The FS-IACS's warning comes the same week that two large U.S. banks -- Bank of America (BofA)and J.P. Morgan Chase --suffered unexplained network disruptions.

A group, calling itself the "Cyber fighters of Izz ad-din Al qassam " on Tuesday warned of an attack against BofA and the New York Stock Exchange. In a PasteBin message, the hitherto unknown group said it was targeting the two organizations in retaliation for a controversial anti-Islam movie that has roiled much of the Middle East for the past several days.

Both Chase and BofA acknowledged the network problems earlier this week but neither spelled out what caused it.

The FS-ISAC alert does not mention either bank by name nor does it refer to any specific incident. So it is unclear whether the alert has anything to do with the disruptions or whether the timing is purely coincidental.

The attacks, as described in the alert, suggest that criminals managed to gain extensive access to bank networks in at least a few instances.

According to the information-sharing center, in some cases, cyber attackers managed to steal login credentials from multiple bank employees and systems administrators. The attackers then circumvented the authentication mechanisms the banks put in place to detect and deter fraudulent wire transfers. "This allowed the intruders to handle all aspects of a wire transaction, including the approval."

Before attempting to initiate a fraudulent wire transfer, the intruders would obtain customer account transaction histories, read-up on the proper use of U.S. payment systems and learn or modify bank-specific wire transfer settings. "In at least one instance, actor(s) browsed through multiple accounts, apparently selecting the accounts with the largest balance."

In at least a few instances, the attackers launched distributed denial of service attacks either before or immediately after the wire transfer fraud, apparently to try and distract banks from what was really going on, the FS-ISAC alert said. The alert recommends more than 15 measures that banks can take to mitigate their exposure.

U.S. banks, small businesses and credit unions have been dealing with online wire fraud for several years. In recent years, overseas-based cyber attackers have siphoned out tens of millions of dollars from small businesses, school districts and local governments.

But in most earlier instances, hackers stole login credentials directly from the victims to initiate wire transfers.

Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan or subscribe to Jaikumar's RSS feed . His e-mail address is jvijayan@computerworld.com.

See more by Jaikumar Vijayan on Computerworld.com.

Read more about Cybercrime and Hacking in Computerworld's Cybercrime and Hacking Topic Center.