Jump to content

Bank hacked because of 10$ router without firewall

ParanoidWallet
By ParanoidWallet
in Tech News
 Share
Posted

According to this article from Business Insider, Bangladesh central bank was hacked. As from the title, the issue was a 2nd hand 10$ without any firewall configured... The hackers got away with around 81$ millions, but the whole hack attempted to transfer 951$ millions. Most of the payments got automatically blocked. Another 20$ millions were on it's way to Sri Lanka, but a misspelling in the company's name raised a red flag and the transfer got blocked.

Quote

Bangladesh's central bank was vulnerable to hackers because it did not have a firewall and used second-hand, $10 switches to network computers connected to the SWIFT global payment network, an investigator into one of the world's biggest cyber heists said.

I cannot believe that a central bank in any country would lack this quality of equipment. Not sure if this is just an issue in Bangladesh, but I do hope that banks all over the globe takes another look into their own systems to detect week links, after all, everyone uses credit cards and they are connected to the banks...

Link to business insider article: http://uk.businessinsider.com/r-bangladesh-bank-exposed-to-hackers-by-cheap-switches-no-firewall-police-2016-4?utm_content=buffer04ba7&utm_medium=social&utm_source=facebook.com&utm_campaign=buffer?r=US&IR=T

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

I would laugh if it turned out that this was committed by the paid astroturfers that Hillary Clinton is sending onto the interwebs to fight people that don't like her.

 

Gotta get that bribe money somewhere right?

Ketchup is better than mustard.

GUI is better than Command Line Interface.

Dubs are better than subs

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
1 minute ago, crystal6tak said:

No, 48 500 gb HDD's in raid 0, gotta use them second hands bro

No, you mean 200 120GB HDDs in raid 0 right? Gotta use even older drives man...

Looking at my signature are we now? Well too bad there's nothing here...

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

What? As I said, there seriously is nothing here :) 

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
2 minutes ago, Trik'Stari said:

I would laugh if it turned out that this was committed by the paid astroturfers that Hillary Clinton is sending onto the interwebs to fight people that don't like her.

 

Gotta get that bribe money somewhere right?

wait are people defending hillary clinton? 

Dutch Talk Thread

Unofficial LMG Social Media Accounts Website

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
17 minutes ago, ParanoidWallet said:

 

 

8 minutes ago, imreloadin said:

I bet they store all of their data on RAID 0 arrays too because they don't want to sacrifice speed also.....

Why would the engineers know about RAID 0? They couldnt put up a firewall

Please vote for Donald Trump. I am out of sitcoms to watch.

When lyfe gives you HDDs, make SSDs

 

 

 

Spoiler

My Troll PC

 

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
3 minutes ago, crystal6tak said:

No, 48 500 gb HDD's in raid 0, gotta use them second hands bro

Thats the next upgrade, right now they're at this lol

 

Either way, I'm not even that disappointed in a cheap router, but you can still have decent security with crap routers. This is full on 10 year old son of the manager needed a job xD 

 

  

                     .
                   _/ V\
                  / /  /
                <<    |
                ,/    ]
              ,/      ]
            ,/        |
           /    \  \ /
          /      | | |
    ______|   __/_/| |
   /_______\______}\__}
Spoiler

[i7-7700k@5Ghz | MSI Z270 M7 | 16GB 3000 GEIL EVOX | STRIX ROG 1060 OC 6G | EVGA G2 650W | ROSEWILL B2 SPIRIT | SANDISK 256GB M2 | 4x 1TB Seagate Barracudas RAID 10 ]

[i3-4360 | mini-itx potato | 4gb DDR3-1600 | 8tb wd red | 250gb seagate| Debian 9 ]

[Dell Inspiron 15 5567] 

 

 

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
3 minutes ago, RedWulf said:

Thats the next upgrade, right now they're at this lol

 

Either way, I'm not even that disappointed in a cheap router, but you can still have decent security with crap routers. This is full on 10 year old son of the manager needed a job xD 

 

 

yes, that's where my idea came from :)

Dutch Talk Thread

Unofficial LMG Social Media Accounts Website

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
4 minutes ago, mikat said:

wait are people defending hillary clinton? 

Yeah, a superpac is spending a couple mil paying people to go on twitter, reddit, news comment sections, to "correct" the alleged "misinformation" being spread about her.

 

Also known as astroturfing, which I was fairly sure is illegal.

Ketchup is better than mustard.

GUI is better than Command Line Interface.

Dubs are better than subs

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
3 minutes ago, Trik'Stari said:

Yeah, a superpac is spending a couple mil paying people to go on twitter, reddit, news comment sections, to "correct" the alleged "misinformation" being spread about her.

 

Also known as astroturfing, which I was fairly sure is illegal.

yup lol

Dutch Talk Thread

Unofficial LMG Social Media Accounts Website

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

Big cooperations usually go with the ultra cheapest stuff available, even though the slightly more expensive stuff saves them from a whackton of headaches and is the cheaper option in the end just because it fails less. I mean, look at the Dutch Railways Fyra debacle. NS (the Dutch railways operator) could've gone to anybody with experience in trains. Siemens, Bombardier, Alstom, the whole lot, but nooooo, lets go for the cheapest option: an Italian company that's been around since 2001 with very little experience and what you get is a train that breaks down (like, bottom panels breaking away from the train) on the 1st day of regular service, never driven at its intended speed of 250 km/h, and was in service for a whopping 40 days (yes, days) before it was withdrawn from service because of the technical problems with the damn thing. It cost the NS a lot more than needed because of all the breakdowns, which could've been prevented by going with the slightly more expensive trains that didn't break down all the time. Not one Fyra train ever arrived on schedule during those short 40 days of service. Not one.

Ye ole' train

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
1 hour ago, Arty said:

I thought i heard about this a month ago?

You did, but it was released today why the hack was possible, so to say.

The ability to google properly is a skill of its own. 

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
2 hours ago, mikat said:

yes lol,

or 3000 8 gb flash drives in raid 0 (if you can even have that many devices in a raid lol)

That is a lot of USB ports.

Main Rig "Rocinante" - Ryzen 9 5900X, EVGA FTW3 RTX 3080 Ultra Gaming, 32GB 3600MHz DDR4

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

In Bangladesh, you don't have to hack, you can just take whatever and run.

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

It always amazes me that large businesses even bother using such low end equipment when millions of customers are at stake. 

 

 

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

This basically tells me how seriously they don't take their security. 

"It pays to keep an open mind, but not so open your brain falls out." - Carl Sagan.

"I can explain it to you, but I can't understand it for you" - Edward I. Koch

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
12 minutes ago, Godlygamer23 said:

This basically tells me how seriously they don't take their security. 

They are very serious about not taking it seriously it seems. 

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

So this sounded really weird to me for a few reasons... Even without a firewall there should be other lines of defense in place. Do 10 dollar routers even exist, and if they do surely the entire infrastructure can't be made up of them (would probably go down several times a day because of the load)?

 

As it turns out, the headline is very clickbaity. The Forbes article says the hackers are suspected to have installed malware on the bank's officials' computers. It was not 10 dollar routers (report seem to have gotten switches and routers mixed up). The attack might have happened even with managed routers. The article itself states that better routers should have helped track how the attack was done (by having proper logs of all events on the network), but that by itself would not have stopped the attack from actually happening (because the bank didn't have anyone employed to monitor the network). The lack of VLAN seems like a huge security issue though.

 

 

TL;DR: It wasn't because of a 10 dollar router without a firewall the attack happened. A better router (or switch) would not have stopped the attack either. The bank messed up in other ways as well.

 

 

It's pretty funny that the hackers got found out because of a spelling mistake. Not because someone discovered that large sums of money were getting transferred.

Link to comment
Share on other sites
Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share
Go to topic listing Tech News

×