Bangladesh Bank attackers used custom malware that hijacked SWIFT software

The malware deleted transaction records from the database and printed out altered SWIFT confirmation messages, researchers say

The hackers who stole US $81 million from Bangladesh's central bank likely used custom malware designed to interfere with the SWIFT transaction software used by many financial institutions.

The attackers attempted to transfer $951 million out of Bangladesh Bank's account at the Federal Reserve Bank of New York in February, but most of the transfers were blocked before completion. The attackers did manage to send $81 million to accounts in the Philippines, and that money is still missing.

Researchers from BAE Systems have recently come across several malware components that they believe are part of a custom attack toolkit that was likely used in the heist.

The samples were uploaded to online malware repositories by someone in Bangladesh and they are designed to monitor, delete and alter transaction records in the database used by the SWIFT client software.

Brussels-based SWIFT, or the Society for Worldwide Interbank Financial Telecommunication, is a cooperative society owned by thousands of financial institutions that runs the world's largest secure financial messaging network.

One of the malware components bypasses a validation check in a library that's part of SWIFT's Alliance software suite, which stores transaction records in an Oracle Database, the BAE researchers said in a blog post Monday.

The rogue program then monitors SWIFT Financial Application messages for strings defined in an encrypted configuration file. When it detects a matching one, it identifies the corresponding database entry and deletes it.

The malware also monitors for login and logout events in the application and notifies command-and-control servers when they are detected.

Finally, the program can manipulate confirmation SWIFT messages, which are automatically printed out on paper by the bank's systems. Altering database records is not enough to hide fraudulent transactions because these printed confirmation messages could give an attack away, the BAE researchers said.

There are still many unknowns about the well-planned Bangladesh Bank heist, such as who was behind it, how they got into the bank's network in the first place, and how they initiated the rogue transfers. However, the existence of this custom malware toolkit should serve as a warning to other financial institutions.

"This malware was written bespoke for attacking a specific victim infrastructure, but the general tools, techniques and procedures used in the attack may allow the gang to strike again," the BAE researchers said. "All financial institutions who run SWIFT Alliance Access and similar systems should be seriously reviewing their security now to make sure they too are not exposed."

SWIFT is aware of the malware's existence. However, the program doesn't impact SWIFT's network or core messaging services, the organization said in an emailed statement.

"We understand that the malware is designed to hide the traces of fraudulent payments from customers’ local database applications and can only be installed on users’ local systems by attackers that have successfully identified and exploited weaknesses in their local security," SWIFT said.

"We have developed a facility to assist customers in enhancing their security and to spot inconsistencies in their local database records," the organization added. "However, the key defence against such attack scenarios remains for users to implement appropriate security measures in their local environments to safeguard their systems -- in particular those used to access SWIFT -- against such potential security threats."

According to investigators, one factor that contributed to the success of the attack against Bangladesh's central bank was the lack of proper segmentation between the bank's SWIFT systems and the rest of its network. The SWIFT-connected computers were linked to the network via cheap switches with no management capability and lacking a firewall, Reuters reported Friday.

Join the PC World newsletter!

Error: Please check your email address.

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Cool Tech

Crucial Ballistix Elite 32GB Kit (4 x 8GB) DDR4-3000 UDIMM

Learn more >

Gadgets & Things

Lexar® Professional 1000x microSDHC™/microSDXC™ UHS-II cards

Learn more >

Family Friendly

Lexar® JumpDrive® S57 USB 3.0 flash drive 

Learn more >

Stocking Stuffer

Plox Star Wars Death Star Levitating Bluetooth Speaker

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest News Articles

Resources

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?