Beta

Slashdot: News for Nerds

×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

cancel ×

75 comments

The Question is (1)

Jah-Wren Ryel (80510) | about 10 months ago | (#44910441)

Makes you wonder how many other times has this been done where the crooks got away scott free and the bank just didn't want to go public about it?

Re:The Question is (0)

Anonymous Coward | about 10 months ago | (#44910449)

I guess I am the guy who has to say over 9000. =( why me? why me?

Re:The Question is (0, Offtopic)

Dj Stingray (178766) | about 10 months ago | (#44910451)

And why did I have to be not logged in? Why? Why?

Re:The Question is (1)

AHuxley (892839) | about 10 months ago | (#44910471)

Time for the buddy system for all staff or contractors :)
As for the numbers, the KVM teams only have to be lucky once – the bank will have to be lucky always.

Re:The Question is (2)

Samantha Wright (1324923) | about 10 months ago | (#44910549)

Well, for the most part, the thefts have only involved tiny fractions of pennies normally lost due to rounding errors, so usually they don't get caught...

Re:The Question is (1)

Nyder (754090) | about 10 months ago | (#44917457)

Well, for the most part, the thefts have only involved tiny fractions of pennies normally lost due to rounding errors, so usually they don't get caught...

https://en.wikipedia.org/wiki/Superman_III [wikipedia.org]

Ya, Richard Pryor ftw.

Re:The Question is (1)

xenobyte (446878) | about 10 months ago | (#44921903)

The real life incident occurred in the 1970's. A technician realized that the rounding errors were money that could be stolen so he rewrote the rounding code so that everything from the sixth digit to the right of the decimal point were transferred to his account before the rounding operation that now essentially did nothing. This method left no trace and everything balanced out perfectly, except for one thing. Regular bank accounts were represented using a limited number of bits and the balance on his account managed to hit that limit causing an overrun which raised an alert and caused the bank to investigate where all that money came from, thus after some serious debugging revealing the scam. Had he only set up a business account this wouldn't have happened...

Today all rounding errors are tracked and accounted for so this is not possible anymore.

Re:The Question is (4, Interesting)

abigsmurf (919188) | about 10 months ago | (#44910611)

Apparently about 2/3rds of crooks get away with it. The ones who do are the ones who do a one off of $500,000 or so and the banks decide it's better to absorb the loss then to go to the police and take the PR and resources hit that goes with it. The ones who do get caught are the ones who get greedy and do it multiple times or go for too much. There was an interview on Radio 4 talking about it (may have been the catch-me-if-you-can guy, can't remember for sure).

Re:The Question is (1)

slick7 (1703596) | about 10 months ago | (#44912615)

Just like the banksters to use this excuse as a means of covering their tracks whe customers accounts are emptied. And banksters wonder why I refuse to use online banking.

Re:The Question is (1)

Zaiff Urgulbunger (591514) | about 10 months ago | (#44912989)

Makes you wonder how many other times has this been done where the crooks got away scott free and the bank just didn't want to go public about it?

Makes me wonder how many times it happened and the operator who's login was used got the blame.

whose (0)

Anonymous Coward | about 10 months ago | (#44917421)

not who's

Whatever happened... (1)

thsths (31372) | about 10 months ago | (#44910479)

... to good old security? You know, checking who gets into the staff premises of a bank?

I bet they thought it was a low risk area, because it was only handling "data". But "data" is money...

When the IT staff gets Subcontracted / contracted (2)

Joe_Dragon (2206452) | about 10 months ago | (#44911863)

Some times the works don't get staff ID's or it can be easy to say I got a call just now to come out or just show some paper work that looks like an work order. And they can say the system placed the call on it's own.

Re:Whatever happened... (1)

mjwx (966435) | about 10 months ago | (#44921319)

... to good old security? You know, checking who gets into the staff premises of a bank?

I've worked on government high security sites and corporate high security sites.

Only the former is really secure. The latter will eschew security for money.

At the government site (not a military site) a sub contractor who didn't have ID or was listed on the work order was denied access by the security guards. He and his boss yelled and screamed until some AFP officers (Australian Federal Police) appeared out of a hidden door and escorted them out. Conversely, I've seen people into "highly secure" data halls containing servers and racks from a dozen major clients because someone rang up and complained. Security officers in all corporations I've worked in get sacked if they interfere with business. OTOH in govt, they get told to do their job and have no problems getting in the way if the right forms aren't filed.

Weird KVM. (1)

SuricouRaven (1897204) | about 10 months ago | (#44910493)

Looks like a KVM-over-IP box, possibly. But those don't have video passthrough, so it'd be detected in no time at all. I can see how such a scam could work (KVM-over-IP + access point + VGA splitter), but not with the hardware described. You'd have to depend on employees leaving their station unlocked, but that is going to happen sooner or later.

I'm not sure if this is a deliberate Met policy of withholding the details of crimes to prevent imitation, or just non-technical reporting trying to express complicated networkystuff in a manner the layperson can understand.

You certainly couldn't get it at PC World, though. They only sell consumer gear. You might be able to get a plain local KVM if you're very lucky, but a KVM over IP? No chance. A quick check of their website shows no KVMs of any variety.

Re:Weird KVM. (1)

arbiter1 (1204146) | about 10 months ago | (#44910511)

Yea "KVM-over-IP box, possibly. But those don't have video passthrough," you might want to recheck around the web cause they do. Just took me a whole 2sec google search to fine like 5 of them that will do video as well. Softlayer which is a large host provider (for people that don't know) they have kvm over ip set on their network as well.

Re:Weird KVM. (0)

Anonymous Coward | about 10 months ago | (#44910555)

He meant video pass-through. Not just video support

Re:Weird KVM. (1)

_merlin (160982) | about 10 months ago | (#44910605)

Plenty of them do have video passthrough, e.g. Raritan Dominion, although those are pretty pricey.

Re:Weird KVM. (2)

thsths (31372) | about 10 months ago | (#44910619)

You've got to spend money to make money.

Re:Weird KVM. (1)

PPH (736903) | about 10 months ago | (#44912357)

Crooks never heard of Kickstarter?

Re:Weird KVM. (1)

Bert64 (520050) | about 10 months ago | (#44910685)

You dont need pass through, just a vga splitter...

Re:Weird KVM. (1)

Anonymous Coward | about 10 months ago | (#44910541)

This would do the trick and is pretty small :) http://www.lantronix.com/it-management/kvm-over-ip/spiderduo.html

Re:Weird KVM. (1)

bruce_the_loon (856617) | about 10 months ago | (#44910599)

You don't need video passthrough if you have a VGA splitter cable. One end to the monitor, one to the KVM over IP unit. http://www.minipc.de/catalog/il/858 [minipc.de]

That's if you haven't gone for the unit linked in one of the responses below that has passthrough.

Re:Weird KVM. (2)

Bert64 (520050) | about 10 months ago | (#44910673)

You'd be better off with a regular wireless access point that includes a built in switch...
Drop it in between an existing workstation (or other networked device like a printer) and the wall, legit device keeps working but the lan is now extended outside and you can sit outside or in a nearby coffee shop.

Once your on the internal network, the rest is absolutely trivial... A port scanning tool and a copy of metasploit, you'll have domain admin within a few minutes and chances are even if the important stuff is kept on non windows machines, it will be accessed from windows machines which are part of the domain so you just keylog the right workstations until you get access.

Re:Weird KVM. (1)

SuricouRaven (1897204) | about 10 months ago | (#44910747)

Except this is a bank - they probably have a little more security than that. Like 802.1x, which makes that process a little bit trickier, and the appearance of an unauthorised MAC is likely to trigger an IDS alert so you may need to hack the AP to make sure it stays quiet and lets you spoof a workstation.

Re:Weird KVM. (0)

Anonymous Coward | about 10 months ago | (#44910781)

There is no need to present "an unauthorized MAC". You do of course spoof a valid MAC address too, simple network sniffing will get you a useable one. No need to provoke an IDS here.

Re:Weird KVM. (5, Informative)

cbiltcliffe (186293) | about 10 months ago | (#44911325)

You can't sniff for a valid MAC until you've already got your illicit one in the network. By then, you've already triggered the IDS.
Any bank with IT worth keeping has MAC filtering on their switches. That alone will prevent your "access point/switch in the network line from a workstation" from working. At best, the legit device will stop working, resulting in a call to IT. At worst, the IDS will be triggered immediately, Either way, IT will investigate, find your additions to the network, probably call the police, get your AP fingerprinted, etc.etc.

A network device WILL be detected on anything but the simplest "plug it in and it works as recommended by Best Buy" kind of network. I've got two older Cisco Catalyst switches on my home/home business network; a 2950 and a 2960. Even these support locking a specific MAC to a port, so an unauthorized device won't work if plugged in. I`m going to set the 2960 this way soon, but haven`t yet as it`s a new addition to the network, as an emergency replacement for a different switch that died. The 2950, though, is on my workbench, which has customer machines connected and disconnected on a regular basis, so this kind of setting would be counterproductive.

So when I get the setup finalized, your "AP in a network cable" wouldn't even work on the trusted subnet of my home network, forget about a bank. My workbench subnet has no access to anything important, so unless you're wanting to hack a customer machine that's already infected with a dozen viruses, you're not going to get anywhere.

Re:Weird KVM. (1)

zippthorne (748122) | about 10 months ago | (#44911445)

is the MAC in the encrypted part of the packets? I was under the impression it was in the plaintext portion....

Re:Weird KVM. (1)

cbiltcliffe (186293) | about 10 months ago | (#44911595)

For a wireless network, you're right. The MAC is in the plaintext packet header.
But if your bank is using wireless intentionally, then you're already screwed. I don't know of any bank in my area that has a wireless network, other than the occasional "HP_Setup" ad-hoc from a wireless-capable printer that hasn't had the wireless disabled. You'd need to be on the wire already to pick up a MAC anywhere around me, and there's no way to do that without triggering the IDS.
Plus, the MAC you'd pick up in the unencrypted wireless headers would be the wireless MAC. You'd not be able to use that on the wire with a device like in the story, because a wireless MAC never touches the wired network, unless you're using a consumer-grade access point/switch/router type device that directly connects them together. Again, if your bank is using something like this by choice, you're already screwed. I suppose a single AP plugged directly into an otherwise wired network would also let this happen, but the "you're already screwed" part still stands in that case, too.

Re:Weird KVM. (1)

Zero__Kelvin (151819) | about 10 months ago | (#44913033)

"For a wireless network, you're right. The MAC is in the plaintext packet header."

No need for the "For a wireless network" qualifier. The MAC address is in ISO layer 2, to wit, the data link. Encryption happens in layer 4, the transport layer (HTTPS == HyperText Transport Protocol / Secure). If Layer 2 was encrypted every switch on the network would have to have the key for every session (a severe security flaw in itself), but how would it know which key to use since it couldn't know where the data was coming from without decrypting it first.? See also ... [wikipedia.org]

Re:Weird KVM. (1)

zippthorne (748122) | about 10 months ago | (#44913133)

There are plenty of practices that "if that's the case, you're already screwed." If you're relying on someone running a business not to choose them, and they appear to be cheaper than doing things the right way, then I think I can state quite confidently, "you're already screwed."

Your security needs are not the same as the bank's business needs. They need you to believe that your money is secure, and they need the regulators to believe that they are in compliance with any regulations or making good-faith efforts to be in compliance.

They will invariably choose what they believe to be the least cost method of satisfying those requirements, and they may chose not based on costs to the organization as a whole, but rather the costs for a specific decision maker within the organization.

Re:Weird KVM. (1)

sjames (1099) | about 10 months ago | (#44911851)

Whoever did this had physical access for some time to a PC that had an authorized MAC address. Their access was good enough to insert a KVM un-noticed.

So, get PCs MAC, and us it on PCs port to access the LAN in order to find more MAC addresses. As far as the switch knows, everything is kosher. You could even splice in a device that looks like the switch to the PC and looks like the PC to the switch. Program it to transparently bridge the normal traffic and inject/intercept whatever you need.

Re:Weird KVM. (1)

Zero__Kelvin (151819) | about 10 months ago | (#44912987)

"You can't sniff for a valid MAC until you've already got your illicit one in the network."

On what [stackexchange.com] planet and in what universe?

Re:Weird KVM. (1)

Da J Rob (469571) | about 10 months ago | (#44914021)

You can't sniff for a valid MAC until you've already got your illicit one in the network. By then, you've already triggered the IDS.

Passive Network Tap [hackaday.com]

Re:Weird KVM. (1)

Slayer (6656) | about 10 months ago | (#44916739)

All these banks employ nothing but the highest levels of security expertise, that's how, for instance, scores of Bank of America ATM terminals got infected with Code Red or Nimda back then .....

Re:Weird KVM. (1)

eudaemon (320983) | about 10 months ago | (#44919755)

Really? You've never heard of a transparent bridge? It is possible to work entirely in passthrough mode and quietly learn all MACs on the network whilst never doing anything yourself but packet passing. If there's no new MAC on the network, there's nothing to trigger IDS.

Re:Weird KVM. (1)

uninformedLuddite (1334899) | about 10 months ago | (#44921951)

You're joking right? What the hell has happened to /.

Re:Weird KVM. (1)

s0litaire (1205168) | about 10 months ago | (#44911041)

It's probably more like a glorified "keylogger"

A simple KVM box with one of those low powered credit card PC's fitted inside, stick in a rechargeable battery and wire it to draw power from the usb input, It sits there day after day recording key strokes and mouse movements with the odd screen grab. the on board PC then compresses it in to manageable chunks of zips, rars or tar's and waits for one of the gang to walk into the Bank at a busy time of the day. Then it sends it to a receiver via wifi in the crooks bag/pocket in the 10-20 mins he is waiting to get served. If one visit is not enough then they hand it over to another member who gets in line and waits for it to finish.

Never problem for banks. (-1)

Anonymous Coward | about 10 months ago | (#44910543)

They will just ask Central Bank to print some extra money. Problem solved.
For the rest of you, go to work to earn some pennies.

Re:Never problem for banks. (2, Informative)

Anonymous Coward | about 10 months ago | (#44910711)

They will just ask Central Bank to print some extra money. Problem solved. For the rest of you, go to work to earn some pennies.

I'm assuming you are from the US, because that is were this "printing money is bad" meme seems to have been resurrected lately. Central banks are managing the money supply to balance and the economy, and in most modern western economies this is working as intended - keeping a stable currency value, steady low inflation and fueling economic growth or counteracting recession. Outside that the slogan "printing money" sounds like something bad is going on, I don't really understand what it is about the real world effect of this that you are dissatisfied with.

If there was no "printing money" you would get deflation, which would be really bad for any modern economy. For one it increases the real value of debt, curbing investments, contributing to or amplifying recession and can lead to a deflationary spiral. (on a personal scale, imagine your house mortgage just growing and growing in real value you owe, the actual house value would not necessarily follow)

Re:Never problem for banks. (0)

Anonymous Coward | about 10 months ago | (#44910783)

I'm assuming you are from the US, because that is were this "printing money is bad" meme seems to have been resurrected lately. Central banks are managing the money supply to balance and the economy, and in most modern western economies this is working as intended - keeping a stable currency value, steady low inflation and fueling economic growth or counteracting recession. Outside that the slogan "printing money" sounds like something bad is going on, I don't really understand what it is about the real world effect of this that you are dissatisfied with.

Here is the argument:
Every fiat currency in history constantly loses value in the process of "balancing the economy" until the system implodes on itself creating a massive deflation all at once followed by panicked money printing and inflation. This occurs rather than the series of relative minor events that would have occurred otherwise. The process also has the side effect of encouraging wasteful spending and use of resources. Also, the entities that receive the printed money (government and large financial institutions) are given too much power over how then to use this newly created money/reserves and the people in charge of these entities get to spend it on their pet projects at the expense of less well connected people (their money is now devalued).

If there was no "printing money" you would get deflation, which would be really bad for any modern economy. For one it increases the real value of debt, curbing investments, contributing to or amplifying recession and can lead to a deflationary spiral. (on a personal scale, imagine your house mortgage just growing and growing in real value you owe, the actual house value would not necessarily follow)

These are problems created by printing money in the first place. Yes, at this point it is a major problem and the money printing can not stop without causing major pain for a lot of people, the only thing to do is keep kicking the can down the road or wind it down very slowly.

Re:Never problem for banks. (2)

dnaumov (453672) | about 10 months ago | (#44910929)

They will just ask Central Bank to print some extra money. Problem solved.
For the rest of you, go to work to earn some pennies.

I'm assuming you are from the US, because that is were this "printing money is bad" meme seems to have been resurrected lately. Central banks are managing the money supply to balance and the economy, and in most modern western economies this is working as intended - keeping a stable currency value, steady low inflation and fueling economic growth or counteracting recession.

So I see the brainwashing regarding "minor inflation is good" did work on you. Back in my day, we had a word for FALLING prices on essential goods, it was called "progress".

Re:Never problem for banks. (2, Interesting)

Anonymous Coward | about 10 months ago | (#44911007)

So I see the brainwashing regarding "minor inflation is good" did work on you. Back in my day, we had a word for FALLING prices on essential goods, it was called "progress".

Yeah, I would love to see the price on my house keep falling in value while the debt keep growing.. On the business side this effect will limit investments.

Re:Never problem for banks. (1)

dnaumov (453672) | about 10 months ago | (#44917489)

So I see the brainwashing regarding "minor inflation is good" did work on you. Back in my day, we had a word for FALLING prices on essential goods, it was called "progress".

Yeah, I would love to see the price on my house keep falling in value while the debt keep growing.. On the business side this effect will limit investments.

Solution: don't get in debt. On the grand scale of things, mortgages are a very new "invention".

Re:Never problem for banks. (0)

Anonymous Coward | about 10 months ago | (#44912467)

My brain-washing says that the economy doesn't run if money doesn't change owners, and people are more likely to hold onto money if there's deflation (=money appreciates in value). Which is why the politicians try to avoid deflation, and the best way to do that is to have a small inflation.

See e.g. Japan who are now printing loads of money, hoping to get rid of the mild deflation that's been ongoing for the last decade or so.

Re:Never problem for banks. (0)

Anonymous Coward | about 10 months ago | (#44911175)

You knowledge of economic history is severely inadequate. Here are two lessons about the risks of incurring large debts and printing money to pay them -
http://en.wikipedia.org/wiki/Hyperinflation_in_the_Weimar_Republic [wikipedia.org]
http://en.wikipedia.org/wiki/Hyperinflation_in_Zimbabwe [wikipedia.org]

Re:Never problem for banks. (0)

Anonymous Coward | about 10 months ago | (#44911331)

Keynesian nonsensical scaremongering yet again. Steady inflation is anything but stable and the current target of 2% effectively steals 45% of a man's savings after 30 years.

The only honest target is 0%.

Oh, and there's no such thing as a "deflationary spiral" that is comparable to hyperinflation. The former is a negative feedback loop that ends itself when price meets utility value while the latter is a positive feedback loop that has no control mechanism other than the entire economy imploding.

Re:Never problem for banks. (1)

sjames (1099) | about 10 months ago | (#44911871)

The problem is when you print money and use it to bail out a private entity that is considered too big to fail. Particularly when you also keep socking it to individuals who are apparently too small to succeed.

Ugh... (1)

gigaherz (2653757) | about 10 months ago | (#44910573)

Can we rename it VKM, so that it doesn't conflict with Kernel-based Virtual Machine?

Re:Ugh... (5, Insightful)

_merlin (160982) | about 10 months ago | (#44910597)

KVM switches have had that name since at least the early '90s. How about Linux developers check to see that the aren't causing naming conflicts when they christen their projects?

Re:Ugh... (1)

Joining Yet Again (2992179) | about 10 months ago | (#44910639)

To be fair, this cloudy out-of-your-control virtual nonsense has been around since the '60s. But then we called it a virtual machine monitor (VMM).

Has anyone stopped to think how poorly systems are now architected that each person has gone back to feeling they need a whole piece of virtual hardware to themselves? Regression - it's not just economic.

Re:Ugh... (0)

Anonymous Coward | about 10 months ago | (#44910955)

Has anyone stopped to think how poorly systems are now architected that each person has gone back to feeling they need a whole piece of virtual hardware to themselves? Regression - it's not just economic.

Yep, every single day.

I support customers, of whom 90% are all in Virtual Environments.

It's not so much systems are poorly architected* that it is just convenient to 'quickly' knock up a new 'clean' VM so Bob can do what he wants. It seems to be easier for Admins to think in terms of machines than users/applications on a given machine - it's as if they are all kind of Desktops/Laptops instead of /home directories. I don't know if it is the paucity of good tools for these Virtual Host envs or that storage is 'cheap'.

Maybe it's just easier to say this 'machine' is our mail server, tihs 'machine' is our web server, this 'machine' is our doodad-checker server, this machine is our etc.

*Although i would say that is a valid point, the skill set of managing large NAS/SAN environments has gone, is going, the way of Backups (i.e. dedicated team of people turns into just people who click a GUI and push a 'help me' button when they see a 'red light' so to speak), no understanding what they are doing

Re:Ugh... (1)

utkonos (2104836) | about 10 months ago | (#44911167)

From a security and sandboxing perspective this paradigm is much more secure than running all the variety of services on one instance or server. If you use FreeBSD jails it becomes even more secure because each jail only has the resources and libraries available to run the single application that you want to run. The whole resource argument is a non-starter. You are thinking in terms of old hypervisors that don't do memory deduplication. Most all modern virtualization environments do this and allow you to run a very large number of VMs with very little cost. There is a great video [youtube.com] from ShmooCon this year that describes this technology excellently. You should fast forward to 6:33 to skip straight to the pertinent section of the talk. Then fast forward to 24:50 to see a demonstration of this technology in action (KVM's version).

No it isn't (1)

zippthorne (748122) | about 10 months ago | (#44911493)

All that duplication of OS, and you get the perceived benefit of increased separation, but you've still go a thing running that launches other things, all on the same machine, only now with the overhead of running the first thing inside another thing inside itself....

The only security benefit is in the thing that contains the thing that runs the stuff. If this piece of software sufficiently segregates the running applications, then it is secure, if it does not, then you're in the same boat as before except you need three times the hardware just to get started.

A well-designed operating system would keep the applications just as separate with only 1x the overhead of an operating system. The fact that we're using VM's all over the place is clear evidence that we haven't got operating systems figured out right now.

Re:No it isn't (1)

sjames (1099) | about 10 months ago | (#44911925)

It's pretty amazing how little overhead virtualization adds these days. In exchange, you avoid the pain of having to seperate out services one by one if you ever have to migrate. This is particularly helpful if you have a server go down and you need to divide the services it was performing amongst several other machines as you restore from backups. It's much easier to just stick the mail server on A and the web server for de0partment X on B, etc.

Re:Ugh... (0)

Anonymous Coward | about 10 months ago | (#44911095)

Ah, how I year for the halcyon days when we communicated via drum and had english long pig on the barbie.

Re:Ugh... (0)

Anonymous Coward | about 10 months ago | (#44910891)

Agreed. While we're at it, we should let DRM die as well; every time I see it I immediately think of Direct Rendering Manager, only to be disappointed.

Re:Ugh... (1)

jones_supa (887896) | about 10 months ago | (#44910933)

Then we also have IDE for Integrated Drive Electronics and Integrated Development Environment.

Re:Ugh... (0)

Anonymous Coward | about 10 months ago | (#44911053)

Acronyms are relevant in their own sphere. So stop being a pretentious prick.

Re:Ugh... (1)

Shavano (2541114) | about 10 months ago | (#44911209)

But in some cases, the environments overlap and then you can have a hard time sorting them out.

Re:Ugh... (0)

Anonymous Coward | about 10 months ago | (#44911439)

>Acronyms are relevant in their own sphere.
This reply should have been to the top-level post, but the prick remark means someone struck a nerve and caused you maximum gluteus-grievance.

Hmm. (0)

Anonymous Coward | about 10 months ago | (#44910845)

“Those responsible for this offence are significant players within a sophisticated and determined organised criminal network, who used considerable technical abilities and traditional criminal know-how to infiltrate and exploit secure banking systems,”

Also known as some people with a bit of technical knowledge and a grasp of basic social engineering. Gotta love it when they make something sound like rocket science so folks won't realize what little is really involved.

Re:Hmm. (4, Informative)

raburton (1281780) | about 10 months ago | (#44910957)

Also known as some people with a bit of technical knowledge and a grasp of basic social engineering. Gotta love it when they make something sound like rocket science so folks won't realize what little is really involved.

The access might have been fairly straight forward, but we don't know what they did with it. What do you do once you are in? Just because you're on the banks network doesn't mean it's easy to steal money. I'm thinking back to the last time I was in a machine room on my own at a bank and wondering what I could have done if I'd wanted to, not really sure. Maybe you can find a convenient gui with buttons like "add money to an account (untraceable)" but failing that you're going to need a reasonable amount of IT/banking knowledge. If you're wanting to mod a CICS transaction written in COBOL to siphon off money without leaving any trace then you'll need more skills than the average crook. On the other hand they got caught, so maybe it was all over their heads...

Re:Hmm. (1)

sjames (1099) | about 10 months ago | (#44911937)

Don't you know? The process involves plugging the lan cable into your ear and then playing a video game involving glowing buildings by waving your hands in the air.

This replaced the old interface where the computer would ask you in a 60 point font if you wanted all of da money.

Re:Hmm. (1)

citizenr (871508) | about 10 months ago | (#44912021)

Install it on one of the computers processing transfers.
Let it run for a week while monitoring patterns and learning gui.
Prepare some dodgy accounts, usually you take a hobo off the street, clean him up, make him open proper bank account, give him drugs/vodka/whatever he wants and drop him off where you found him. You use those accounts regularly to make them look legit.
Once you have your window of opportunity (lunch break, loo visit, whatever) start transferring money to a bunch of accounts you prepared earlier.
Immediately go on a shopping spree, commodities (truck full of cigarettes, TVs, even hi end food). It might seem small time until you realize truck with cigs is worth couple of million euros.

Users (4, Interesting)

Skiron (735617) | about 10 months ago | (#44911013)

When I was syadmin a few years ago, I really used to get SO bloody angry with the maintenance guys, as they used to call in photocopy machine engineers when the things went wrong. Of course, they never informed the IT department (ME!), so all of a sudden, when I was going somewhere, I saw an 'unknown' guy hooked up with a laptop on the companies network *.

No matter WHAT I told them about security, it didn't matter - a working photocopier was more important than security.

This is obviously a similar situation - some 'official looking' technical guy turns up, tells a few porkies, and the staff just let him get on with it without any checks.

* I later coded a short perl script to send me a mail when an unknown MAC connected to the LAN.

Why get an email instead of stopping it? (0)

Anonymous Coward | about 10 months ago | (#44912097)

As stated above, any network equipment worth using has MAC filtering. Just set up all access port security as single MAC only, sticky so you don't have to hardcode them all, and shutdown on violation. Done. No more alien network interfaces on your network.

Why would you take the time to code a script but not do the bare bones network administration task of setting port security? It's only five lines of configuration on Cisco equipment:

int ra f0/x-y
switch mode acc
switch port-s mac sticky
switch port-s max 1
switch port-s vi sh

A whole lot easier than a custom one off job that will only tell you when something has already gone wrong.

Re:Why get an email instead of stopping it? (0)

Anonymous Coward | about 10 months ago | (#44912929)

dumb switch and smart servers can do the job on a fraction of the cost of a good router...

Re:Why get an email instead of stopping it? (0)

Anonymous Coward | about 10 months ago | (#44913941)

That isn't a router config.

Re:Users (2)

antdude (79039) | about 10 months ago | (#44914725)

It bugs me why IT people don't handle printer, copy, and fax machine issues (e.g., changing cartridges) at my huge workplace. They use maintenance guys.

Banking idea (-1)

Anonymous Coward | about 10 months ago | (#44911127)

I think this post is very informative for us http://hightechbd.com/ [hightechbd.com]

e-Crimes? da fuq? (1)

FuzzNugget (2840687) | about 10 months ago | (#44911151)

Because they used an electronic gadget in the commission of a crime? This was a social engineering ploy, the tech played a minor role. Even TFA (yes, I read it) explained that the technology involved was "crude."

The "tech expert" they interviewed is just adding fuel to the idiot fire by explaining that antivirus won't help, giving undeserved credence to the notion that this was a technological attack.

Stop prefixing e- and cyber- and other bullshit to make yourself sound modern because you actually sound like an old fart bitching about "newfangled gizmos" that they don't understand.

Criminal Masterminds (1)

Going_Digital (1485615) | about 10 months ago | (#44911223)

It is funny how the media reports it as a sophisticated attack with criminal masterminds as they don't want you to know that it is something that pretty much anybody with a little tech understanding could do. They are only reporting this one because they were such clever criminal masterminds that they got caught doh! Anyone with the courage to go in to a bank masquerading as in IT contractor could plug such a device into a PC. In fact I'm sure many geeks could come up with a far less obvious solution fitted internally. The problem is banks; especially in the UK are living in the steam era and think of their buildings and therefore their internal network secure. Surely staff should be required to use some sort of NFC tag or similar so that the computer can only be operated while they are sat at it and locks when they walk away.

Re:Criminal Masterminds (1)

cbiltcliffe (186293) | about 10 months ago | (#44911519)

It is funny how the media reports it as a sophisticated attack with criminal masterminds as they don't want you to know that it is something that pretty much anybody with a little tech understanding could do. They are only reporting this one because they were such clever criminal masterminds that they got caught doh!

I'm sure it's also that they want it to seem that the police are complete tech geniuses that can thwart any crime, no matter how much of a "criminal mastermind" the perpetrator is. In reality, of course, they're just as incompetent as the criminals for the most part.

British public hit by banking crooks, more like (0)

Anonymous Coward | about 10 months ago | (#44912533)

Banks create money out of thin air every time somebody takes out a loan.
www.positivemoney.org

97% of the money in existence is BANK money - meaning it is a DEBT to a bank somewhere, meaning the banks (i.e. the private individuals who own them) own 97% of everything.

Check for New Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Create a Slashdot Account

Loading...