SWIFT warns of malware attack on another of its customers

Funds transfer network SWIFT has warned banks to be on the alert for attempts to replicate an attack that tried to net $1 billion from Bangladesh Bank

Financial transaction network SWIFT has renewed its warning to customers to be on their guard following the discovery of malware at another bank using its services.

The bank first asked customers to take steps to secure their systems in the wake of an attempt to steal US$951 million from Bangladesh Bank in February. Attackers there appear to have used custom malware installed on computers at the bank to send fraudulent messages over the SWIFT network seeking to transfer money from the bank's account with the U.S. Federal Reserve Bank of New York.

That attack appears not to have been an isolated incident, as SWIFT said Friday it has now learnt more about a second instance in which malware was used.

While SWIFT did not name the target, a report from security researchers at BAE Systems, also published Friday, pointed to a commercial bank in Vietnam as the latest victim.

The malware attacks were not directly on the transaction network or core messaging system, but instead were targeted at customer banks' secondary security controls, SWIFT said.

With its ability to transfer billions of dollars to accounts around the world in a few keystrokes, the SWIFT financial transaction network is increasingly being instrumentalized in cyber attacks on financial institutions.

While the number of cases of fraud at its customers is so far small, forensic experts believe the new discovery is part of a wider and highly adaptive campaign targeting banks, SWIFT said.

Posting on the BAE Systems threat research blog, researchers Sergei Shevchenko and Adrian Nish said what ties together the cases discovered so far is the use of an unusual file wipe function the malware uses to make deleted files unrecoverable. The function first fills the file with random characters to ensure nothing can be recovered from the sectors it occupies on disk, then changes its name to a random string before deleting it.

In both cases, SWIFT said in its latest warning, the attackers have exploited vulnerabilities in the systems banks use to initiate fund transfers, stealing banks' credentials and using them to send irrevocable fund transfer orders over the SWIFT network.

In addition, the attackers have tampered with secondary controls such as records of statements and confirmations that the banks use to recognize fraud. For example, SWIFT said, in the latest case the attackers targeted the bank's PDF reader, using malices software to modify it so as to hide traces of the fraudulent transactions in PDF reports of payment confirmations.

SWIFT asked its customers to review security controls across all their payment systems, from employee checks to cyber defenses. Banks using PDF reader applications to review confirmation messages should take particular care, it said. The asked banks to help track down the fraudsters by advising it if any incidents were discovered.

Join the PC World newsletter!

Error: Please check your email address.

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Peter Sayer

IDG News Service
Show Comments

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?