Security expert Brian Krebs wrote about an innovative new crime scheme that is costing Eastern European banks millions... and may be making its way west to the US.
According to Krebs, an “organized gang of hackers” from Russia and Ukraine made their way into the internal networks of numerous financial institutions, then installed malware to let the hackers drain bank ATMs.
Krebs says while most fraudsters focus on merchants or consumers, this group targets on infiltrating financial institutions and coming up with ways to steal money from them (fraudsters most likely focus on consumers and merchants since their security is weaker than the financial institutions).
This new hack has garnered the group $15 million from financial institutions in Eastern Europe. How’d they pull it off? The hackers sent bank employees malware ridden emails that looked like they were sent from Russian regulators. The malware attacked security holes in Microsoft Office, which were recently fixed.
Interestingly, the group also bought access to Windows computers at banks they were attempting to infiltrate that were hacked by other hackers. It seems like this could be a new tactic for large scale cyberattacks -- simply buy access to computers on internal networks already infected with malware.
Financial institutions in the US are getting “very frustrated” with these cyberattacks and their lack of options for retaliation. Just today, Bloomberg reported that US companies have been secretly exploring the idea of “revenge hacking.” The FBI is reportedly investigating to see if US banks worked with hackers to disable Iranian servers that were attacking the websites of major banks last year. In a closed door meeting in February 2013, JPMorgan Chase allegedly suggested this tactic be used.
Obviously, this would break anti-hacking laws, and get private companies and institutions into quite a bit of hot water. It might be tempting for hacking victims to fight fire with fire -- with their vast resources, it probably wouldn’t cost a lot to hire a couple of great hackers. But it’s pretty clear that the FBI is staunchly against these tactics and that these hacking groups have nothing but time on their hands to come up with more ways to attack companies.
The best way to combat hackers who are attempting to defraud your institutions is by having precautions in place before the hackers come. Acting reactively will just end badly.