SWIFT warns of malware attack on another of its customers

Funds transfer network SWIFT has warned banks to be on the alert for attempts to replicate an attack that tried to net $1 billion from Bangladesh Bank

Financial transaction network SWIFT has renewed its warning to customers to be on their guard following the discovery of malware at another bank using its services.

The bank first asked customers to take steps to secure their systems in the wake of an attempt to steal US$951 million from Bangladesh Bank in February. Attackers there appear to have used custom malware installed on computers at the bank to send fraudulent messages over the SWIFT network seeking to transfer money from the bank's account with the U.S. Federal Reserve Bank of New York.

That attack appears not to have been an isolated incident, as SWIFT said Friday it has now learnt more about a second instance in which malware was used.

While SWIFT did not name the target, a report from security researchers at BAE Systems, also published Friday, pointed to a commercial bank in Vietnam as the latest victim.

The malware attacks were not directly on the transaction network or core messaging system, but instead were targeted at customer banks' secondary security controls, SWIFT said.

With its ability to transfer billions of dollars to accounts around the world in a few keystrokes, the SWIFT financial transaction network is increasingly being instrumentalized in cyber attacks on financial institutions.

While the number of cases of fraud at its customers is so far small, forensic experts believe the new discovery is part of a wider and highly adaptive campaign targeting banks, SWIFT said.

Posting on the BAE Systems threat research blog, researchers Sergei Shevchenko and Adrian Nish said what ties together the cases discovered so far is the use of an unusual file wipe function the malware uses to make deleted files unrecoverable. The function first fills the file with random characters to ensure nothing can be recovered from the sectors it occupies on disk, then changes its name to a random string before deleting it.

In both cases, SWIFT said in its latest warning, the attackers have exploited vulnerabilities in the systems banks use to initiate fund transfers, stealing banks' credentials and using them to send irrevocable fund transfer orders over the SWIFT network.

In addition, the attackers have tampered with secondary controls such as records of statements and confirmations that the banks use to recognize fraud. For example, SWIFT said, in the latest case the attackers targeted the bank's PDF reader, using malices software to modify it so as to hide traces of the fraudulent transactions in PDF reports of payment confirmations.

SWIFT asked its customers to review security controls across all their payment systems, from employee checks to cyber defenses. Banks using PDF reader applications to review confirmation messages should take particular care, it said. The asked banks to help track down the fraudsters by advising it if any incidents were discovered.

Join the PC World newsletter!

Error: Please check your email address.

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Peter Sayer

IDG News Service
Show Comments

Cool Tech

Crucial Ballistix Elite 32GB Kit (4 x 8GB) DDR4-3000 UDIMM

Learn more >

Gadgets & Things

Lexar® Professional 1000x microSDHC™/microSDXC™ UHS-II cards

Learn more >

Family Friendly

Lexar® JumpDrive® S57 USB 3.0 flash drive 

Learn more >

Stocking Stuffer

Plox Star Wars Death Star Levitating Bluetooth Speaker

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest News Articles

Resources

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?