U.S. banks on high alert against cyberattacks
Hackers engaging in wire fraud by gaining access to bank networks, FS-ISAC says
Computerworld - The Financial Services Information Sharing and Analysis Center (FS-ISAC) has put U.S. banks on high alert against cyberattackers seeking to steal employee network login credentials to conduct extensive wire transfer fraud.
The alert warns banks towatch out for hackers using spam, phishing emails, Remote Access Trojans and keystroke loggers to try and pry loose bank employee usernames and passwords.
The FBI has noticed a new trend where cyber criminals use stolen employee credentials to wire transfer hundreds of thousands of dollars from U.S. customer accounts to overseas banks, the FS-ISAC noted.
"The wire transfer amounts have varied between $400,000 and $900,000, and, in at least one case, the actor(s) raised the wire transfer limit on the customer's account to allow for a larger transfer," the alert said. The FS-ISAC noted that it has moved it cyberthreat level from 'elevated' to 'high' as a result of the activity.
A majority of recent victims have been small and medium-sized businesses, small banks and credit unions, the FS-ISAC said. However, a few large banks have also been hit by fraudsters.
The FS-IACS's warning comes the same week that two large U.S. banks -- Bank of America (BofA)and J.P. Morgan Chase --suffered unexplained network disruptions.
A group, calling itself the "Cyber fighters of Izz ad-din Al qassam " on Tuesday warned of an attack against BofA and the New York Stock Exchange. In a PasteBin message, the hitherto unknown group said it was targeting the two organizations in retaliation for a controversial anti-Islam movie that has roiled much of the Middle East for the past several days.
Both Chase and BofA acknowledged the network problems earlier this week but neither spelled out what caused it.
The FS-ISAC alert does not mention either bank by name nor does it refer to any specific incident. So it is unclear whether the alert has anything to do with the disruptions or whether the timing is purely coincidental.
The attacks, as described in the alert, suggest that criminals managed to gain extensive access to bank networks in at least a few instances.
According to the information-sharing center, in some cases, cyber attackers managed to steal login credentials from multiple bank employees and systems administrators. The attackers then circumvented the authentication mechanisms the banks put in place to detect and deter fraudulent wire transfers. "This allowed the intruders to handle all aspects of a wire transaction, including the approval."
Before attempting to initiate a fraudulent wire transfer, the intruders would obtain customer account transaction histories, read-up on the proper use of U.S. payment systems and learn or modify bank-specific wire transfer settings. "In at least one instance, actor(s) browsed through multiple accounts, apparently selecting the accounts with the largest balance."
In at least a few instances, the attackers launched distributed denial of service attacks either before or immediately after the wire transfer fraud, apparently to try and distract banks from what was really going on, the FS-ISAC alert said. The alert recommends more than 15 measures that banks can take to mitigate their exposure.
U.S. banks, small businesses and credit unions have been dealing with online wire fraud for several years. In recent years, overseas-based cyber attackers have siphoned out tens of millions of dollars from small businesses, school districts and local governments.
But in most earlier instances, hackers stole login credentials directly from the victims to initiate wire transfers.
Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan or subscribe to Jaikumar's RSS feed . His e-mail address is email@example.com.
Read more about Cybercrime and Hacking in Computerworld's Cybercrime and Hacking Topic Center.
- Best iPhone, iPad Business Apps for 2014
- 14 Tech Conventions You Should Attend in 2014
- 10 Desktop Apps to Power Your Windows PC
- How to Add New Job Skills Without Going Back to School
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Who's Spying on You? You're aware of the threats of malware to your business but what about the ever-changing ground rules? Cybercriminals today are launching attacks against...
Red Hat Enterprise Linux - The Original Cloud Operating System
Linux adoption is growing against a number of measures, such as the
number of supercomputers that run Linux and the size of the contributing...
- OpenStack Hype vs. Reality: CIO Quick Pulse Open-source architecture can enable IT departments to build infrastructure-as-a-service (IaaS) clouds running on standard hardware.
- Building a Bridge to the Next Generation Data Center Selecting a widely adopted operating system is a foundational component of a standardization strategy.
- Webinar: Building a Big Data solution that's production-ready Big data solutions are no longer just a nice-to-have.
- Meg Whitman presents Unlocking IT with Big Data During this Web Event you will hear Meg Whitman, President and CEO, HP discuss HAVEn - the #1 Big Data platform, as well... All Cybercrime and Hacking White Papers | Webcasts