U.S. banks on high alert against cyberattacks
Hackers engaging in wire fraud by gaining access to bank networks, FS-ISAC says
Computerworld - The Financial Services Information Sharing and Analysis Center (FS-ISAC) has put U.S. banks on high alert against cyberattackers seeking to steal employee network login credentials to conduct extensive wire transfer fraud.
The alert warns banks towatch out for hackers using spam, phishing emails, Remote Access Trojans and keystroke loggers to try and pry loose bank employee usernames and passwords.
The FBI has noticed a new trend where cyber criminals use stolen employee credentials to wire transfer hundreds of thousands of dollars from U.S. customer accounts to overseas banks, the FS-ISAC noted.
"The wire transfer amounts have varied between $400,000 and $900,000, and, in at least one case, the actor(s) raised the wire transfer limit on the customer's account to allow for a larger transfer," the alert said. The FS-ISAC noted that it has moved it cyberthreat level from 'elevated' to 'high' as a result of the activity.
A majority of recent victims have been small and medium-sized businesses, small banks and credit unions, the FS-ISAC said. However, a few large banks have also been hit by fraudsters.
The FS-IACS's warning comes the same week that two large U.S. banks -- Bank of America (BofA)and J.P. Morgan Chase --suffered unexplained network disruptions.
A group, calling itself the "Cyber fighters of Izz ad-din Al qassam " on Tuesday warned of an attack against BofA and the New York Stock Exchange. In a PasteBin message, the hitherto unknown group said it was targeting the two organizations in retaliation for a controversial anti-Islam movie that has roiled much of the Middle East for the past several days.
Both Chase and BofA acknowledged the network problems earlier this week but neither spelled out what caused it.
The FS-ISAC alert does not mention either bank by name nor does it refer to any specific incident. So it is unclear whether the alert has anything to do with the disruptions or whether the timing is purely coincidental.
The attacks, as described in the alert, suggest that criminals managed to gain extensive access to bank networks in at least a few instances.
According to the information-sharing center, in some cases, cyber attackers managed to steal login credentials from multiple bank employees and systems administrators. The attackers then circumvented the authentication mechanisms the banks put in place to detect and deter fraudulent wire transfers. "This allowed the intruders to handle all aspects of a wire transaction, including the approval."
Before attempting to initiate a fraudulent wire transfer, the intruders would obtain customer account transaction histories, read-up on the proper use of U.S. payment systems and learn or modify bank-specific wire transfer settings. "In at least one instance, actor(s) browsed through multiple accounts, apparently selecting the accounts with the largest balance."
In at least a few instances, the attackers launched distributed denial of service attacks either before or immediately after the wire transfer fraud, apparently to try and distract banks from what was really going on, the FS-ISAC alert said. The alert recommends more than 15 measures that banks can take to mitigate their exposure.
U.S. banks, small businesses and credit unions have been dealing with online wire fraud for several years. In recent years, overseas-based cyber attackers have siphoned out tens of millions of dollars from small businesses, school districts and local governments.
But in most earlier instances, hackers stole login credentials directly from the victims to initiate wire transfers.
Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan or subscribe to Jaikumar's RSS feed . His e-mail address is email@example.com.
Read more about Cybercrime and Hacking in Computerworld's Cybercrime and Hacking Topic Center.
- Transforming Information Security: Future-Proofing Processes This report provides a valuable set of recommendations from 19 of the world'd leading security officers to help organizations build security strategies for...
- The Evolution of Corporate Cyberthreats Cybercriminals are creating and deploying new threats every day that are more destructive than ever before. While you may have more people devoted...
- 3 Questions to Ask Your DNS Host about Lowering DDoS Risks Neustar has had wide-ranging conversations with clients wanting to know how they can optimize protection as DDoS attacks increase in frequency and size.
- The Danger Deepens: 2014 Neustar Annual DDoS Attacks and Impact Report This report compares DDoS findings from 2013 to 2012, based on a survey of 440 North American companies, including 139 businesses delivering technology...
- Establish Cyber Resiliency: Developing a Continuous Response Architecture Many enterprises fail to proactively prepare the battlefield for a data breach by only leveraging outdated techniques that focus on the perimeter or...
- An Incident Response Playbook: From Monitoring to Operations As cyber-attacks grow more sophisticated, many organizations are investing more into incident detection and response capabilities. In this webcast, learn how to develop... All Cybercrime and Hacking White Papers | Webcasts